MSGraph - Error AADSTS700016: Application with identifier

[CHiLL]

We have started encountering issues when attempting to authenticate with our MSGraph command. Whenever we issue the "Connect-MSGraph" command, we are prompted to enter our credentials (I'm using my M365 global admin account) and once I enter my MFA code, I am greeted with the following error:

AADSTS700016: Application with identifier '' was not found in the directory '

 

It appears that the app with that ID doesn't exist and I can't see it in the deleted items. I have attempted to re-create an app called "Microsoft Graph Command Line Tools", which has a new ID of . I've assigned my account permissions and given it access to "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All" and "User.Read". Primarily because I'm trying to access Intune.

 

However, whenever I attempt to run "Connect-MSGraph" again, it's failing and showing . I don't know how this command knows which app ID to pull or how to change it to use the new app. Nor do I even know if I've re-created it correctly.

 

Although, I can use the command "Connect-AzureAD", which presents the same credentials box, where I can successfully authenticate with the same credentials and PS will connect to AzureAD.

[bicky]

I think this is related to the Intune PowerShell application ID (d1ddf0e4-d672-4dae-b554-9d5bdfd93547). You will need to create new app with the permission you require and use that to authenticate.

 

https://learn.microsoft.com/en-us/mem/intune/fundamentals/in-development#plan-for-change-update-your-powershell-scripts-with-a-microsoft-entra-id-registered-app-id-by-april-2024

 

 

Authenticate MS Graph

https://learn.microsoft.com/en-us/powershell/microsoftgraph/authentication-commands?view=graph-powershell-1.0#using-connect-mggraph

https://www.alitajran.com/connect-to-microsoft-graph-powershell/

[CHiLL]

I think this is related to the Intune PowerShell application ID (d1ddf0e4-d672-4dae-b554-9d5bdfd93547). You will need to create new app with the permission you require and use that to authenticate.

 

https://learn.microsoft.com/en-us/mem/intune/fundamentals/in-development#plan-for-change-update-your-powershell-scripts-with-a-microsoft-entra-id-registered-app-id-by-april-2024

 

 

Authenticate MS Graph

https://learn.microsoft.com/en-us/powershell/microsoftgraph/authentication-commands?view=graph-powershell-1.0#using-connect-mggraph

https://www.alitajran.com/connect-to-microsoft-graph-powershell/

That is the application ID! I wasn't sure if that was unique, hence why I excluded it. Searching for "Intune PowerShell" shows me the application with that application ID, so I don't know why it wouldn't appear when I searched for it via the ID alone.

 

I have confirmed that the account I am using has permissions to access the app, but I'm still getting the same error. I don't know why it can't locate the app within our tenant when I can view and edit it in the portal.

[robk]

I found lots of info on creating a new application, but not all of the documentation mentioned "Update-MSGraphEnvironment -AppId " which is the key to getting it working!

 

https://learn.microsoft.com/en-us/answers/questions/1659638/weve-detected-a-microsoft-intune-powershell-script

 

Is the instructions I ended up following.

[CHiLL]

Thanks to information from @robk and this site: https://chanmingman.wordpress.com/2022/04/22/aadsts50011-the-redirect-uri-urnietfwgoauth2-0oob-specified-in-the-request-does-not-match-the-redirect-uris-configured-for-the-application/, I've managed to fix it by creating a new app registration in Entra admin > Applications > App registrations. Once created, I added API permissions for "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All" and "User.Read", plus granted admin consent for our tenant. Then in Authentication, I added an authenication method for "Mobile and desktop applications Redirect URIs" and added an extra URI for "urn: ietf: wg: oauth: 2.0: oob" (spaces added because it created emojis), as that was specified in the new error message I was receiving. I also checked the box for "https://login.microsoftonline.com/common/oauth2/nativeclient", as that was also selected in the screenshot from Chanmingman's Blog. I then ran the command @robk mentioned "Update-MSGraphEnvironment -AppId .

 

Once all that was done, I was able to successfully authenticate via the Connect-MSGraph command and run some Intune commands.