AADSTS700027 error

Question

Hi!

I am working at the moment to get the token using POST login.microsoftonline.com:443/{tenantID}/oauth2/v2.0/token.

I am able to create a client_assertion, but I am getting this error with the API call:

{ "error": "invalid_client", "error_description": "AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found., Please visit the Azure Portal, Graph Explorer or directly use MS Graph to see configured keys for app Id '8b76b6d9-4732-4558-a4b5-40d5ff2ed6ef'. Review the documentation at https://docs.microsoft.com/en-us/graph/deployments to determine the corresponding service endpoint and https://docs.microsoft.com/en-us/graph/api/application-get?view=graph-rest-1.0&tabs=http to build a query request URL, such as '[https://graph.microsoft.com/beta/applications/8b76b6d9-4732-4558-a4b5-40d5ff2ed6ef']]. Trace ID: 40dccc8c-276d-4927-b6e0-583bf24f9000 Correlation ID: 55f49a48-adab-4470-b42d-f100f63bc15d Timestamp: 2026-06-09 14:01:21Z", "error_codes": [ 700027 ], "timestamp": "2026-06-09 14:01:21Z", "trace_id": "40dccc8c-276d-4927-b6e0-583bf24f9000", "correlation_id": "55f49a48-adab-4470-b42d-f100f63bc15d", "error_uri": "https://login.microsoftonline.com/error?code=700027" }

The thumbprint is correct, because otherwise I get a similar error but with the line "Thumbprint of key used by client" in the error as well. The certificate is still valid, and is available in the app registration.

Answer 1

Apparently I encoded the thumbprint base64 for the jwt-header, but it had to be encoded: Base64url-encoded SHA-256 thumbprint of the X.509 certificate's DER encoding

 That fixed it.

Answer 2

The error AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found.] means the Microsoft identity platform cannot find a public key on the app registration that matches the certificate used to sign the client_assertion.

For a successful client credentials flow with a certificate, the following must all be true:

1. The certificate’s public key must be uploaded as a certificate credential on the same app registration whose client_id is used in the token request.
2. The client_assertion must be a JWT signed with the private key corresponding to that uploaded certificate.
3. The key identifier that AAD derives from the signing certificate (thumbprint / key ID) must match one of the keys configured on the app.

Given that the thumbprint is correct and the certificate is valid and visible in the app registration, focus on these checks:

1. Confirm the app registration and tenant
   • Ensure the client_id in the token request is exactly the same app registration where the certificate is configured.
   • Ensure the {tenantID} in the token endpoint matches the tenant where that app registration lives.
2. Verify the certificate is configured as a credential
   • In the app registration, the certificate must be added under the certificate credentials section (not only as a signing or encryption key for tokens).
   • If multiple certificates are configured, verify that the one used to sign the client_assertion is among them.
3. Validate the client_assertion construction
   • The request must use the certificate-based variant of client credentials:
     • grant_type=client_credentials
     • client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
     • client_assertion=<JWT signed with the app’s certificate>
   • Do not send client_secret in this request; for certificate auth it is replaced by client_assertion_type and client_assertion.
   • Ensure the JWT header correctly reflects the signing algorithm and key (for example, alg=RS256 and a kid that corresponds to the uploaded certificate, if set).
4. Re-upload or rotate the certificate if needed
   • If the certificate was reissued or changed, the public key on the app registration might no longer match the private key used to sign the assertion. Remove the old certificate credential and upload the current one, then retry the token request.
5. Use the correct scope format
   • Ensure the scope parameter is the resource identifier suffixed with /.default (for example, https://graph.microsoft.com/.default), as required by the client credentials flow.

Once the app registration has the correct certificate credential and the client_assertion is signed with the matching private key, the AADSTS700027 error should stop and the token request will succeed.

---

References:

• Microsoft identity platform and the OAuth 2.0 client credentials flow
• Use certificates with Microsoft.Identity.Web
• Troubleshoot access token signature validation errors