Repository navigation
The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. #33887
Description
Describe the bug
invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)
Related command
az logout
az login --tenant "05d75c05-fa1a-42e7-9cf1-eb416c396f2d" --scope "api://ingestion.pensieve/.default"
Errors
invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)
Issue script & Debug output
invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)
Expected behavior
invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)
Environment Summary
(.venv) s.shindigeri@MMDH4K6W2F5YH scm-central-gitops % az --version
azure-cli 2.81.0 *
core 2.81.0 *
telemetry 1.1.0
Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0
Python location '/opt/homebrew/Cellar/azure-cli/2.81.0/libexec/bin/python'
Config directory '/Users/s.shindigeri/.azure'
Extensions directory '/Users/s.shindigeri/.azure/cliextensions'
Python (Darwin) 3.13.11 (main, Dec 5 2025, 16:06:33) [Clang 17.0.0 (clang-1700.4.4.1)]
Legal docs and information: aka.ms/AzureCliLegal
Additional context
invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)
Activity
azure-client-tools-bot-prd commentedon Aug 13, 2026
Hi shivashankar shindigeri (@shiva731),
2.81.0 is not the latest Azure CLI(2.89.1).
If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.
yonzhan commentedon Aug 13, 2026
Thank you for opening this issue, we will look into it.
x-engineering-agent commentedon Aug 13, 2026
Hi Yong Zhang (@yonzhan), thanks for the report. Before we can investigate, could you help clarify a few things:
az login --tenant "05d75c05-..." --scope "api://ingestion.pensieve/.default"to do? The current 'Expected behavior' section just repeats the error text, so it's not clear what the desired outcome is.api://ingestion.pensievea custom/first-party API you registered yourself, or is it expected to work out of the box with the public Azure CLI client app (04b07795-8ddb-461a-bbee-02f9e1bf7b46)? AADSTS650057 typically means the target resource's app registration hasn't exposed/granted that scope to the Azure CLI client app ID, which is usually an app registration/tenant configuration issue rather than a CLI bug.api://ingestion.pensieveand consented to the requested scope?az login --scope <resource>/.defaultwork for other resources in the same tenant, or only this one fails?I'll pick this up automatically once you reply.
Posted by agent-assist (autonomous bug-fix pipeline).
x-engineering-agent commentedon Aug 16, 2026
Hi shivashankar shindigeri (@shiva731), just following up on the questions above since we haven't heard back:
az login --tenant "05d75c05-fa1a-42e7-9cf1-eb416c396f2d" --scope "api://ingestion.pensieve/.default"to do? The 'Expected behavior' section currently just repeats the error text, so it's unclear what outcome you were hoping for.api://ingestion.pensievea custom/first-party API you registered yourself, or is it expected to work out of the box with the public Azure CLI app registration (04b07795-8ddb-461a-bbee-02f9e1bf7b46)?If we don't hear back, we may not be able to make further progress on this issue. Thanks!
Posted by agent-assist (autonomous bug-fix pipeline).
x-engineering-agent commentedon Oct 25, 2026
Hi shivashankar shindigeri (@shiva731), the error shows Azure CLI's public client requesting access to a custom
api://resource for which that client has no registered permissions. An Azure CLI maintainer clarified the same AADSTS650057 case in #32579: the CLI's client ID is not supported for calling third-party applications.Next step: If this is your API, register a client application you control, grant it access to the API and obtain the token through that client instead of using
az login --scopewith Azure CLI's public client. The sandbox cannot access your tenant-specific API to reproduce its configuration, so this is guidance based on the reported error and that maintainer answer, not a verified live reproduction. There is no CLI code change indicated by the available evidence.Posted by x-engineering-agent (Fixer)