Mintplex-Labs/anything-llm · error

Tenant ID is required for organization-only authentication.

Error message

Tenant ID is required for organization-only authentication.

What it means

The 400 reply from POST /admin/agent-skills/outlook/auth-url when the resolved authType is AUTH_TYPES.organization but no tenantId was supplied. Organization-only auth builds the Microsoft authority URL from the specific tenant, so a tenant id is mandatory; for 'common' auth it is optional. authType defaults to common when the value is not one of the known AUTH_TYPES.

Source

Thrown at server/endpoints/utils/outlookAgentUtils.js:42

    async (request, response) => {
      try {
        const { clientId, tenantId, clientSecret, authType } = reqBody(request);

        if (!clientId || !clientSecret) {
          return response.status(400).json({
            success: false,
            error: "Client ID and Client Secret are required.",
          });
        }

        const outlookLib = require("../../utils/agents/aibitat/plugins/outlook/lib");
        const { AUTH_TYPES } = outlookLib;
        const validAuthType = Object.values(AUTH_TYPES).includes(authType)
          ? authType
          : AUTH_TYPES.common;

        if (validAuthType === AUTH_TYPES.organization && !tenantId) {
          return response.status(400).json({
            success: false,
            error:
              "Tenant ID is required for organization-only authentication.",
          });
        }

        const existingConfig = await outlookLib.OutlookBridge.getConfig();
        const configUpdate = {
          ...existingConfig,
          clientId: clientId.trim(),
          tenantId: tenantId?.trim() || "",
          authType: validAuthType,
        };

        if (!/^\*+$/.test(clientSecret))
          configUpdate.clientSecret = clientSecret.trim();

        // If auth type changed, clear tokens as they won't work with different authority

View on GitHub (pinned to 3aec848f28)

Solutions

1. Include {"tenantId": "<azure tenant guid>"} in the auth-url request when authType is 'organization'.
2. Find the tenant id in Azure portal - Microsoft Entra ID > Overview > Tenant ID.
3. If you actually want consumer/personal accounts too, send authType 'common' (or omit it) so tenantId is not required.

Example fix

// before
{ "clientId": "...", "clientSecret": "...", "authType": "organization" }

// after
{ "clientId": "...", "clientSecret": "...", "authType": "organization", "tenantId": "<tenant-guid>" }

const AUTH_TYPES = { common: "common", organization: "organizations" };
function validateOutlookAuthBody(body) {
  if (!body.clientId?.trim() || !body.clientSecret?.trim()) throw new Error("Client ID and Client Secret are required.");
  const authType = Object.values(AUTH_TYPES).includes(body.authType) ? body.authType : AUTH_TYPES.common;
  if (authType === AUTH_TYPES.organization && !body.tenantId?.trim()) throw new Error("Tenant ID is required for organization-only authentication.");
  return { ...body, authType };
}

const needsTenantId = (authType) => authType === "organizations";

When it happens

Trigger: POST /admin/agent-skills/outlook/auth-url with {"authType": "organization"} (and valid clientId/clientSecret) but no tenantId, an empty tenantId, or a tenantId key mismatch (tenant_id).

Common situations: Admin switches the app to single-tenant in Azure but forgets the tenant field in the integration; copying the tenant GUID with quotes that trim to empty; using the tenant name where the GUID is expected downstream.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Client ID and Client Secret are required.
• ${result.error}
• ${e.message}
• data.message || "Error creating slash command preset."
• data.message || "Could not update slash command preset."

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/1143ea6216a34258. Report an issue: GitHub.