trying to get Entra ID registration, getting Azure CLI permission error

[stokoe-app]

Describe the bug

AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://74cc6976-7a58-4bcc-b197-6edc8fb2d4ba. Resource app ID: 74cc6976-7a58-4bcc-b197-6edc8fb2d4ba. List of valid resources from app registration: . Trace ID: 7463f5ce-fc3f-426c-b1e1-310d567b3a01 Correlation ID: fed05e23-dfeb-49b7-ae9b-4872ea919796 Timestamp: 2025-12-26 19:51:49Z

Related command

az login --tenant "[ID]" --scope "[api]"

Errors

AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://74cc6976-7a58-4bcc-b197-6edc8fb2d4ba. Resource app ID: 74cc6976-7a58-4bcc-b197-6edc8fb2d4ba. List of valid resources from app registration: . Trace ID: 7463f5ce-fc3f-426c-b1e1-310d567b3a01 Correlation ID: fed05e23-dfeb-49b7-ae9b-4872ea919796 Timestamp: 2025-12-26 19:51:49Z

Issue script & Debug output

?

Expected behavior

get the device enrolled

Environment Summary

azure-cli 2.81.0

core 2.81.0
telemetry 1.1.0

Extensions:
log-analytics 1.0.0b1

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/homebrew/Cellar/azure-cli/2.81.0/libexec/bin/python'
Config directory '/Users/mcc0nnell/.azure'
Extensions directory '/Users/mcc0nnell/.azure/cliextensions'

Python (Darwin) 3.13.11 (main, Dec 5 2025, 16:06:33) [Clang 17.0.0 (clang-1700.4.4.1)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az login started failing today #26609
• Unable to authenticate within the scope of an Azure Container Registry #30445

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

You are incorrectly specifying the scope for az login. az login scope can only be at the resource provider namespace level. In other words, you can only az login at the level of all Azure Container Registries, in which case you will get an Entra Token valid for authenticating with all Azure Container Registries only.

To do so, run:

az login --scope https://containerregistry.azure.net/.default

Performing az login at the scope of an individual ACR resource is currently unsupported.

Reference:

• Unable to authenticate within the scope of an Azure Container Registry #30445 (comment)

Solution 2:

AADSTS500011 is returned by Microsoft Entra ID service, not Azure CLI.

Are you following any documentation or did you receive any error message that tells you to run az login --scope https://<my ACR name>.azurecr.io/.default --tenant <tenant id>?

Reference:

• Unable to authenticate within the scope of an Azure Container Registry #30445 (comment)

Powered by issue-sentinel