AADServicePrincipalNotFound
Microsoft Entra or Microsoft Graph returns `AADServicePrincipalNotFound` when the requested service principal object cannot be resolved in the active tenant.
Last reviewed: February 8, 2026|Source-backed guidance under our editorial policy
Start Here
Use the closest compare guide, playbook, or adjacent error page to narrow the decision faster before you start changing production systems.
This page is part of the Error Reference library. Learn more about the project or report a correction.
What Does AAD Service Principal Not Found Mean?
Identity-driven provisioning and RBAC assignment steps fail because automation is targeting a principal object that does not exist in that tenant.
Common Causes
- -Object ID or app ID belongs to a different tenant than the one used by the current request.
- -Enterprise application (service principal) was deleted, disabled, or never provisioned in this tenant.
- -Multi-tenant onboarding skipped admin consent, so service principal creation never completed.
- -Automation cached an outdated principal ID after app re-registration or tenant migration.
How to Fix AAD Service Principal Not Found
- 1Query service principals in the target tenant and confirm the exact object/app ID pair exists.
- 2Provision missing enterprise app objects in that tenant before role assignment or token workflows.
- 3Update runtime configuration to use tenant-correct principal identifiers from authoritative identity inventory.
- 4Retry the failed operation only after consent/provisioning completes and directory replication settles.
Step-by-Step Diagnosis for AAD Service Principal Not Found
- 1Capture failing request details including tenant ID, principal identifier, and API path.
- 2Inspect Entra enterprise apps and Graph query results to confirm principal existence and status.
- 3Trace onboarding/consent flow history for the tenant to detect incomplete service principal provisioning.
- 4Compare deployed configuration against identity registry to find stale or cross-tenant IDs.
Tenant-Scoped Principal Identity Validation
- -Verify principal object ID in the same tenant used by the failing request (example: object ID copied from home tenant but operation runs in customer tenant).
- -Resolve by
appIdand confirm expectedservicePrincipalobject is present and enabled (example: app registration exists but enterprise app instance is missing).
Provisioning and Consent Flow Checks
- -Audit consent/onboarding events for target tenant (example: multi-tenant app consent canceled before service principal creation).
- -Inspect automation for re-registration drift (example: app recreated with new appId while RBAC scripts still reference old service principal object ID).
Seen in Production
Cross-tenant onboarding skipped admin consent step
Frequency: common
Example: RBAC bootstrap cannot find the expected service principal in customer tenant.
Fix: Complete tenant consent and confirm enterprise app object is provisioned before role assignment.
Application re-registration invalidated stored object ID
Frequency: rare
Example: Automation uses old service principal ID after security team recreated app registration.
Fix: Refresh principal identifiers from identity registry and redeploy configuration.
Debugging Tools
- -Microsoft Graph Explorer and servicePrincipal queries
- -Entra admin center enterprise applications
- -Sign-in and audit logs for consent/provisioning events
- -Configuration drift checks for tenant and principal IDs
How to Verify the Fix
- -Re-run directory lookup and confirm service principal is returned in the intended tenant.
- -Retry RBAC or deployment operation and verify not-found identity errors are gone.
- -Validate dependent token acquisition and resource operations succeed with corrected principal IDs.
How to Prevent Recurrence
- -Maintain per-tenant identity inventory for service principals and rotate references through controlled release pipelines.
- -Gate onboarding completion on successful service principal provisioning and consent verification.
- -Add startup checks that validate critical principal IDs before executing privileged automation.
Pro Tip
- -store both
appIdand tenant-localservicePrincipal objectIdin config and alert when either changes unexpectedly.
Official References
Provider Context
This guidance is specific to Azure services. Always validate implementation details against official provider documentation before deploying to production.