AADSTS500011: resource principal not found
The app asked for a token to a resource (an API or service) that Entra ID can't find in the tenant.
From Microsoft's documentation, checked 9 Nov 2026.
AADSTS500011: The resource principal named [resource URL] was not found in the tenant named [tenant ID].Also searched as: InvalidResourceServicePrincipalNotFound
What it means
The resource principal, the application or service the token is for, isn't in the tenant. That happens when the resource app hasn't been provisioned or consented to in the tenant, or when the request names the wrong resource URL or tenant ID.
Common causes
- The resource application isn't provisioned by an administrator in the tenant.
- No user in the tenant has consented to the resource application.
- The resource URL isn't configured correctly.
- The tenant ID isn't correct.
How to fix it
Find the failing sign-in
In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out.
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 500011 and createdDateTime ge $since" -Top 10Check the resource is in the tenant
In Microsoft Entra ID > Enterprise applications, check the resource application is listed, configured, and has the permissions and consent it needs.
Check the resource URL and tenant ID
Compare the resource URL and tenant ID in the error with the resource you provisioned and your tenant ID, and correct the authentication request.
How to confirm it's fixed
- The authentication request succeeds once the resource URL and tenant match a provisioned resource.
Related engineering templates
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.