microsoft / microsoft/vscode-azureresourcegroups

[CoR] Sign in with Microsoft fails with AADSTS500011 after deployment

Open
#1,857 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

AT-CTI CoR
Dominant language
TypeScript
Stars
78
Forks
55
Avg merge
16h 49m
Merged PRs (30d)
139

Description

OS: Win11 x64
Build Version: 0.12.8-alpha.0
VS Code Version: Version: 1.137.0

Repro Steps:

  1. Create a full-stack task management application with a React frontend, Node.js backend, Azure Database for PostgreSQL, and passwordless Microsoft Entra ID authentication
  2. Select the AzCode2607 subscription and deploy the application
  3. Wait until Deployment Results shows Deployment Complete and all health checks pass
  4. Select Open App->Select Sign in with Microsoft.
  5. Observe the sign-in result

Expect:
Users should be able to sign in successfully and access the deployed application to perform CRUD operations.

Actual:
Microsoft Entra sign-in fails with the following error:
AADSTS500011: The resource principal named api://14f8102f-91c7-4967-b280-48f9b1dfc4c4 was not found in the tenant.
Image

More Info:

  1. The issue reproduces both authentication paths:
    -Deployed application: Open App → Sign in with Microsoft
    -Local development: Run API Tests → Acquire access token
  2. The application was deployed to the AzCode2607 tenant: ef2cc25a-145b-4fa7-a7ea-67780f6c3a35
  3. The generated API App Registration exists in AzCode2607 and is configured as a single-tenant application: signInAudience: AzureADMyOrg
  4. The Application ID URI matches the API resource requested during sign-in: api://14f8102f-91c7-4967-b280-48f9b1dfc4c4
  5. The generated authorization request uses: login.microsoftonline.com/common/oauth2/v2.0/authorize
  6. The sign-in error references the Microsoft tenant instead of the AzCode2607 tenant: 72f988bf-86f1-41af-91ab-2d7cd011db47

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the sign-in flow through Open App and Run API Tests, then inspect the generated authorization request and API App Registration configuration. Compare the requested tenant and resource with the AzCode2607 deployment; done means both deployed and local authentication succeed without AADSTS500011.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, node.js, postgresql, react, typescript
Domain
authentication, backend, cloud, database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.