Enable/Verify tenant scripts omit the 'Work IQ' app (fdcc1f02-...) - AADSTS650052 persists while Verify reports a false pass

Summary

scripts/Enable-WorkIQToolsForTenant.ps1 does not provision the Work IQ application (fdcc1f02-fc51-4226-8753-f668596af7f7), which is the app that actually triggers AADSTS650052 during CLI/MCP authentication. As a result the script does not resolve the error its own .SYNOPSIS claims to resolve.

Worse, scripts/Verify-WorkIQTenant.ps1 checks the same incomplete list and therefore reports "All checks passed. Work IQ is fully provisioned in this tenant." for a tenant that cannot authenticate. The false pass actively misdirects the operator away from the real cause.

Repro steps

1. On a tenant that has never had the Work IQ service principal created, run:
   • pwsh -NoProfile -File scripts/Enable-WorkIQToolsForTenant.ps1
   • pwsh -NoProfile -File scripts/Verify-WorkIQTenant.ps1
2. Both complete successfully. Verify prints All checks passed. Work IQ is fully provisioned in this tenant.
3. Attempt to authenticate the Work IQ MCP server / CLI.

Actual behavior

Authentication fails:

Authorization Failed
AADSTS650052: The app is trying to access a service
'fdcc1f02-fc51-4226-8753-f668596af7f7' (Work IQ) that your organization
'<tenant-id>' lacks a service principal for. Contact your IT Admin to review
the configuration of your service subscriptions or consent to the application
in order to create the required service principal.

Expected behavior

Either:

• Enable-WorkIQToolsForTenant.ps1 provisions fdcc1f02-fc51-4226-8753-f668596af7f7 along with the others, or
• the scripts explicitly document that this app is a separate prerequisite and Verify-WorkIQTenant.ps1 fails (or at minimum warns) when it is absent.

Today it does neither, and reports success instead.

Root cause

The app named in the error is not referenced anywhere in the repository. A repo-wide search for fdcc1f02 returns zero matches.

Enable-WorkIQToolsForTenant.ps1 (lines 37–51) defines the full set of app IDs it will create:

App	App ID	Provisioned by script?
Work IQ (named in the error)	fdcc1f02-fc51-4226-8753-f668596af7f7	no
Work IQ Tools	ea9ffc3e-8a23-4a7d-836d-234d7c7565c1	yes
Work IQ CLI	ba081686-5d24-4bc6-a0d6-d034ecffed87	yes
9 × mcp_* servers (Mail, Me, Calendar, Teams, OneDrive, SharePoint, Admin, Word, M365Copilot)	various	yes

Note that Work IQ Tools (ea9ffc3e-…) and Work IQ (fdcc1f02-…) are different applications. Having the former does not satisfy the token request for the latter.

Verify-WorkIQTenant.ps1 (lines 37–49) hardcodes the same list, so it is structurally incapable of detecting this condition.

Documented prerequisite

Enable your tenant for Work IQ (Microsoft Learn) documents fdcc1f02-fc51-4226-8753-f668596af7f7 as a separate one-time Global Administrator step:

az ad sp create --id fdcc1f02-fc51-4226-8753-f668596af7f7

or POST https://graph.microsoft.com/v1.0/servicePrincipals with body {"appId": "fdcc1f02-fc51-4226-8753-f668596af7f7"}.

Nothing in this repository's README, ADMIN-INSTRUCTIONS.md, or scripts points the operator at that page, so an admin who follows the repo instructions end-to-end lands on a tenant that reports healthy but does not work.

Suggested fix

1. Add fdcc1f02-fc51-4226-8753-f668596af7f7 to the provisioning list in Enable-WorkIQToolsForTenant.ps1.
2. Add it to the checked list in Verify-WorkIQTenant.ps1 so the verifier can fail on this condition.
3. Cross-reference the Microsoft Learn enablement page from ADMIN-INSTRUCTIONS.md, including the billing prerequisites it lists (usage-based billing plan in Copilot Studio with an assigned Azure subscription/resource group), which are also not mentioned in this repo.

Related

• #80 (closed) — Work IQ Tenant Enablement Issues; referenced from the script header.
• #85 — AADSTS65002, a different failure mode.

Start with the app-ID lists in scripts/Enable-WorkIQToolsForTenant.ps1 (lines 37–51) and scripts/Verify-WorkIQTenant.ps1 (lines 37–49), then review ADMIN-INSTRUCTIONS.md and the linked Microsoft Learn prerequisite. Reproduce the missing-service-principal case with both scripts. Done means the documented Work IQ prerequisite is handled consistently and verification no longer reports a false pass when authentication cannot work.