New Entra tenant with no subscriptions — Azure Portal defaults to “Microsoft Services” tenant and throws AADSTS160021

Question

New Entra tenant with no subscriptions — Azure Portal defaults to “Microsoft Services” tenant and throws AADSTS160021

Raymond 0

Hi,

I created a new Microsoft Entra ID tenant and can sign in successfully. I am an admin in the tenant.

Current state:

Entra tenant exists and loads correctly

Azure Portal loads

No Azure subscriptions are present

Portal settings → Directories + subscriptions shows “No subscriptions in this directory”

When accessing Azure Portal features or signing in without forcing the tenant, the portal defaults to the “Microsoft Services” tenant and shows the following error:

Selected user account does not exist in tenant ‘Microsoft Services’ and cannot access the application ‘e6694c91-1590-4e35-9bb7-b865c638b9c1’ in that tenant.

I also see a portal banner stating:

“Experiencing authentication issues. The portal is having issues getting an authentication token. The experience rendered may be degraded.”

Additional details shown by the portal:

interaction_required: AADSTS160021

Application requested a user session which does not exist

Extension: Microsoft_Azure_Support

Resource: self

Client ID: e6694c91-1590-4e35-9bb7-b865c638b9c1

Correlation ID: 3e315def-7dc5-457c-bb82-028352b609b9

Timestamp: 2025-12-30

I would like to confirm:

Is this expected behavior for a brand-new tenant with no subscriptions?

Will completing Microsoft for Startups enrollment automatically create a subscription and resolve this behavior?

Or should I manually create a Pay-As-You-Go subscription to establish a billing context?

Thanks.

Farzeen Anwar 0 Reputation points

2025-12-30T15:46:12.27+00:00
Yes — this behavior is expected for a brand-new Microsoft Entra tenant with no Azure subscriptions.

Let me address each part and explain what’s happening behind the scenes.

Why this happens

When you create a new Microsoft Entra ID tenant without an Azure subscription:

The Azure Portal still allows sign-in but many portal extensions (Support, Cost Management, Resource Graph, etc.) require a subscription context

When no subscription exists, the portal may:

Fail to resolve the correct tenant context

Fall back to the internal “Microsoft Services” tenant

Trigger AADSTS160021 (interaction_required) errors

Show the banner: “The portal is having issues getting an authentication token”

The Client ID you see (e6694c91-1590-4e35-9bb7-b865c638b9c1) belongs to a built-in Azure portal extension, not your tenant — so the issue is environmental, not a misconfiguration.

Answers to your specific questions

1.     Is this expected behavior for a new tenant with no subscriptions?

Yes. A tenant with no billing or subscription context cannot fully initialize Azure Portal services, and the authentication symptoms you’re seeing are a known side effect.

2.     Will Microsoft for Startups enrollment fix this?

Yes — once it creates a subscription.

Enrollment in Microsoft for Startups typically:

Provisions an Azure subscription

Establishes a billing scope

Resolves tenant-resolution and token issues in the portal

Important: The issue will persist until the subscription is actually provisioned. Approval alone does not fix it.

3.     Should I create a Pay-As-You-Go subscription manually?

Yes — if you need immediate access.

Creating any Azure subscription (Pay-As-You-Go, CSP, EA, or Startups) will:

Anchor the tenant to a valid billing context

Stop the portal from defaulting to “Microsoft Services”

Resolve the AADSTS160021 and degraded authentication banner

This is the fastest and most reliable fix if you don’t want to wait for Startups provisioning.

Recommended next steps (best practice)

Create at least one Azure subscription in the tenant

Sign out of the Azure Portal

Clear browser cache (or use InPrivate/Incognito)

Sign back in and explicitly select the tenant

Verify under Directories + subscriptions that the subscription is active

Once a subscription exists, the issue should resolve automatically.

2 answers

Your answer

Answer 1

Hey there, Raymond

It seems as though you have managed to create an Azure tenant without signing up for Azure. I suspect this is because you have created a tenant through a different method rather then the Azure sign up form.

Will completing Microsoft for Startups enrollment automatically create a subscription and resolve this behavior?

If you have not signed up to Azure before, please sign up for the Azure free trial here: https://go.microsoft.com/fwlink/?linkid=2322223&clcid=0x809

Please go through the process of creating your Azure account and see if it assigns the free trial subscription on your account.

Hope this helps,
Nathan

Answer 2

When you create a new Microsoft Entra ID tenant without any subscriptions, it is expected that you will encounter limitations, such as the error messages you described. The Azure portal requires at least one subscription to fully utilize its features and services. Without a subscription, the portal may default to a different tenant, such as the "Microsoft Services" tenant, leading to authentication issues like the AADSTS160021 error you are experiencing.

To resolve this behavior, you will need to establish a billing context by creating a subscription. You can either:

Complete the Microsoft for Startups enrollment, which may provide you with a subscription, or
Manually create a Pay-As-You-Go subscription to ensure that your tenant is properly set up for Azure services.

In summary, having a subscription is necessary for accessing Azure portal features and to avoid the authentication issues you're encountering.