Error code search

BadResourceRequest - To redeem the code for an access token, the app should send a POST request to the /token endpoint. Also, prior to this, you should provide an authorization code and send it in the POST request to the /token endpoint. Refer to this article for an overview of OAuth 2.0 authorization code flow. Direct the user to the /authorize endpoint, which will return an authorization_code. By posting a request to the /token endpoint, the user gets the access token. Check App registrations > Endpoints to confirm that the two endpoints were configured correctly.

BadResourceRequestInvalidRequest - The endpoint only accepts {valid_verbs} requests. Received a {invalid_verb} request. {valid_verbs} represents a list of HTTP verbs supported by the endpoint (for example, POST), {invalid_verb} is an HTTP verb used in the current request (for example, GET). This can be due to developer error, or due to users pressing the back button in their browser, triggering a bad request. It can be ignored.

Failed to parse provider signing keys - When validating signing keys provided by JWKS endpoint, they are not in the expected format.

PassThroughUserMfaError - The external account that the user signs in with doesn't exist on the tenant that they signed into; so the user can't satisfy the MFA requirements for the tenant. This error also might occur if the users are synced, but there is a mismatch in the ImmutableID (sourceAnchor) attribute between Active Directory and Microsoft Entra ID. The account must be added as an external user in the tenant first. Sign out and sign in with a different Microsoft Entra user account. For more information, please visit configuring external identities.

OrgIdWsFederationMessageInvalid - An error occurred when the service tried to process a WS-Federation message. The message isn't valid.

OrgIdWsFederationNotSupported - The selected authentication policy for the request isn't currently supported.

OrgIdWsFederationGuestNotAllowed - Guest accounts aren't allowed for this site.

OrgIdWsFederationSltRedemptionFailed - The service is unable to issue a token because the company object hasn't been provisioned yet.

OrgIdWsTrustDaTokenExpired - The user DA token is expired.

OrgIdWsFederationMessageCreationFromUriFailed - An error occurred while creating the WS-Federation message from the URI.

GraphRetryableError - The service is temporarily unavailable.

GraphServiceUnreachable

GraphNonRetryableError

GraphUserUnauthorized - Graph returned with a forbidden error code for the request.

AdminConsentRequired - Administrator consent is required.

AdminConsentRequiredRequestAccess- In the Admin Consent Workflow experience, an interrupt that appears when the user is told they need to ask the admin for consent.

No reply address provided.

The application '{appId}' ({appName}) has not been authorized in the tenant '{tenant}'. Applications must be authorized to access the external tenant before partner delegated administrators can use them. Provide pre-consent or execute the appropriate Partner Center API to authorize the application.

InvalidRequestParameter - The parameter is empty or not valid.

AADSTS901002: The 'resource' request parameter isn't supported.

InvalidEmailAddress - The supplied data isn't a valid email address. The email address must be in the format [email protected].

NoEmailAddressCollectedFromExternalOidcIDP - No email address was obtained from the external OpenID Connect (OIDC) identity provider. This usually happens when the user selects Hide my email upon signing up.

EmailAddressCollectedFromExternalOidcIDPNotVerified - No verified email address was obtained from the identity provider. The email address is not verified in the ID token from the external OIDC identity provider.

NoExternalIdentifierCollectedFromExternalOidcIDP - The external identifier does not exist in the ID token from the external OIDC identity provider.

InvalidUriParameter - The value must be a valid absolute URI.

InvalidXml - The request isn't valid. Make sure your data doesn't have invalid characters.

Application identifier is expected to be a GUID.

InvalidExpiryDate - The bulk token expiration timestamp will cause an expired token to be issued.

InvalidRequestInput

InvalidUserCode - The user code is null or empty.

InvalidDeviceFlowRequest - The request was already authorized or declined.

InvalidEmptyRequest - Invalid empty request.

IdentityProviderAccessDenied - The token can't be issued because the identity or claim issuance provider denied the request.

V1ResourceV2GlobalEndpointNotSupported - The resource isn't supported over the /common or /consumers endpoints. Use the /organizations or tenant-specific endpoint instead.

DebugModeEnrollTenantNotFound - The user isn't in the system. Make sure you entered the user name correctly.

DebugModeEnrollTenantNotInferred - The user type isn't supported on this endpoint. The system can't infer the user's tenant from the user name.

NonConvergedAppV2GlobalEndpointNotSupported - The application isn't supported over the /common or /consumers endpoints. Use the /organizations or tenant-specific endpoint instead.

Could not open file stream: [2]. System error: [3]

Cannot create the file '[2]'. A directory with this name already exists.

Please insert the disk: [2]