Azure "AADSTS700016: application not found" on az login in CI
By Kaveh Alemi·Latchkey
Entra ID could not find an application registration matching the client ID in the named tenant. The az login (or azure/login) credentials reference an app that does not exist there, so authentication fails before any resource call.
What this error means
az login or azure/login fails with "AADSTS700016: Application with identifier '<client-id>' was not found in the directory '<tenant>'".
Azure
AADSTS700016: Application with identifier 'd1f2...' was not found in the directory
'contoso.onmicrosoft.com'. This can happen if the application has not been installed
by the administrator of the tenant or consented to by any user in the tenant.
Diagnose it: credentials and state before configuration
Infrastructure jobs fail on access far more often than on configuration. Confirm the runner can authenticate and reach remote state before reading the plan.
Terminal
# who am I on this runner?
<cloud-cli> auth list 2>/dev/null || <cloud-cli> sts get-caller-identity
# can the backend be reached and locked?
terraform init -backend=true -input=false
Common causes
Wrong client ID or tenant
The client-id secret is mistyped or belongs to a different tenant than the tenant-id, so Entra finds no matching app.
The app registration was deleted
The service principal/app registration was removed or recreated, so the old client ID no longer resolves.
How to fix it
Verify the client ID and tenant match the registration
Confirm the app registration exists and note its client (application) ID and tenant.
Update the AZURE_CLIENT_ID and AZURE_TENANT_ID secrets to match exactly.
Re-run the login.
Terminal
az ad app show --id "$AZURE_CLIENT_ID" --query appId -o tsv
Recreate the service principal if it was removed
If the registration is gone, create a new one and update the CI secrets with the new client ID.
Terminal
az ad sp create-for-rbac --name ci-deployer \
--role contributor --scopes /subscriptions/$SUB
How to prevent it
Store client ID and tenant ID together and update them as a pair.
Reference the same tenant the app registration lives in.
Rotate credentials by updating secrets when the SP is recreated.
Frequently asked questions
What causes Azure "AADSTS700016: application not found" on az login in CI?
There are 2 common causes: wrong client id or tenant and the app registration was deleted. The client-id secret is mistyped or belongs to a different tenant than the tenant-id, so Entra finds no matching app.
How do I fix Azure "AADSTS700016: application not found" on az login in CI?
There are 2 fixes depending on which cause you have: verify the client id and tenant match the registration and recreate the service principal if it was removed. Work through them in order, since the first is the most common.
What does Azure "AADSTS700016: application not found" on az login in CI actually mean?
az login or azure/login fails with "AADSTS700016: Application with identifier '<client-id>' was not found in the directory '<tenant>'".
How do I stop Azure "AADSTS700016: application not found" on az login in CI happening again?
Store client ID and tenant ID together and update them as a pair. The prevention section lists 3 changes that keep it from recurring.
