Azure "AADSTS700016: application not found" on az login in CI

Entra ID could not find an application registration matching the client ID in the named tenant. The az login (or azure/login) credentials reference an app that does not exist there, so authentication fails before any resource call.

What this error means

az login or azure/login fails with "AADSTS700016: Application with identifier '<client-id>' was not found in the directory '<tenant>'".

AADSTS700016: Application with identifier 'd1f2...' was not found in the directory
'contoso.onmicrosoft.com'. This can happen if the application has not been installed
by the administrator of the tenant or consented to by any user in the tenant.

Common causes

Wrong client ID or tenant

The client-id secret is mistyped or belongs to a different tenant than the tenant-id, so Entra finds no matching app.

The app registration was deleted

The service principal/app registration was removed or recreated, so the old client ID no longer resolves.

How to fix it

Verify the client ID and tenant match the registration

1. Confirm the app registration exists and note its client (application) ID and tenant.
2. Update the AZURE_CLIENT_ID and AZURE_TENANT_ID secrets to match exactly.
3. Re-run the login.

az ad app show --id "$AZURE_CLIENT_ID" --query appId -o tsv

Recreate the service principal if it was removed

If the registration is gone, create a new one and update the CI secrets with the new client ID.

az ad sp create-for-rbac --name ci-deployer \
  --role contributor --scopes /subscriptions/$SUB

How to prevent it

• Store client ID and tenant ID together and update them as a pair.
• Reference the same tenant the app registration lives in.
• Rotate credentials by updating secrets when the SP is recreated.

Related guides