Single-Tenant Azure AD App Returns "Application Not Found" Error During OAuth Token Exchange — Even After Admin Consent and Fresh Registration

Question

I have created a single-tenant Azure AD application (registered for one specific organizational tenant only) and successfully granted admin consent. The application exists in the portal, the service principal exists in Enterprise Applications, and admin consent shows as "Granted." However, when attempting OAuth token exchange, the endpoint returns:

AADSTS700016: Application with identifier [APP_ID] was not found in the directory [TENANT_DOMAIN].

Details:

Scenario:

• Single-tenant app (not multitenant)
• Registered in organizational Azure AD tenant
• Admin consent granted and confirmed in portal
• Service principal visible in Enterprise Applications
• Redirect URI properly configured
• Credentials valid

Attempt 1 (Initial App):

• App registered as multitenant
• Changed to single-tenant after publisher verification warning
• Result: AADSTS700016 error after 10+ minute sync wait

Attempt 2 (Fresh App):

• Created new app as single-tenant from registration
• Admin consent granted immediately after setup
• Result: AADSTS700016 error (same issue, fresh app)

Token endpoint behavior:

• Endpoint: https://login.microsoftonline.com/{TENANT}/oauth2/v2.0/token
• Credentials sent: Valid client_id, client_secret, authorization code
• Response: "Application not found"
• But app IS visible in both App Registrations and Enterprise Applications portals

Diagnostic Data:

• Request ID: <PII REMOVED>
• Correlation ID: <PII REMOVED>
• Timestamp: 2026-03-29T20:59:53Z

Questions:

1. Why does the token endpoint report "application not found" when the app exists in both portals?
2. Is there a service principal sync delay between Enterprise Applications and the token endpoint?
3. Should single-tenant apps have different configuration for token endpoint access?

This appears to be an Azure AD infrastructure issue rather than misconfiguration, but I want to rule that out.

Answer 1

Hello Edward Litke

Thank you for reaching out to Microsoft Q&A.

The single-tenant app and its service principal aren’t being located by the token endpoint, even though you see them in the portal. Here’s what I’d double-check:

1. Token endpoint URL
   • Make sure you’re hitting https://login.microsoftonline.com/{TENANT}/oauth2/v2.0/token where {TENANT} is your Azure AD tenant ID (GUID) or your verified initial domain (e.g. contoso.onmicrosoft.com).
   • If you accidentally put the client/app ID in that segment, AAD won’t find the app in that directory and you’ll get AADSTS700016.
2. Well-Known OpenID configuration
   • Go to https://login.microsoftonline.com/{TENANT}/v2.0/.well-known/openid-configuration (or insert “/id/” after the tenant if you’re using the v1 style).
   • If that endpoint errors out or still shows “not found,” the tenant identifier is likely wrong.
3. Service principal provisioning lag
   • For a single-tenant app, provisioning in your own directory is almost instantaneous (typically seconds–a few minutes max). You shouldn’t need to wait longer than 10 minutes. There’s no cross-directory sync for single-tenant apps.
4. Single-tenant vs. multi-tenant configuration
   • There’s no extra “switch” required in the token URL for single-tenant apps—it’s just your tenant instead of “common” or “organizations.” The rest of the OAuth flow and endpoint parameters (client_id, client_secret, code, redirect_uri, scopes) are exactly the same.

Let us know the above steps helps.

Thanks

Microsoft docs:-

• Troubleshoot consent issues in Microsoft Entra ID: https://docs.microsoft.com/troubleshoot/entra/entra-id/app-integration/troubleshoot-consent-issues
• Problems signing in to a Microsoft application: https://docs.microsoft.com/entra/identity/enterprise-apps/application-sign-in-problem-first-party-microsoft#problems-with-application-consent
• Unexpected error when performing consent to an application: https://docs.microsoft.com/entra/identity/enterprise-apps/application-sign-in-unexpected-user-consent-error#getting-administrator-permission
• Admin consent requirements: https://docs.microsoft.com/azure/active-directory/manage-apps/configure-user-consent