{"record":{"id":"673c920acb7b57c6","repo":"gravitational/teleport","slug":"tenant-not-found","errorCode":null,"errorMessage":"tenant not found","messagePattern":"tenant not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/msgraph/creds.go","lineNumber":33,"sourceCode":"// along with this program.  If not, see <http://www.gnu.org/licenses/>.\n\n// VerifyCredentials checks if the credentials supplied to the client can be used to authenticate to\n// the Graph API and if they're authorized to get specific resources.\npackage msgraph\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"net/http\"\n\t\"slices\"\n\n\t\"github.com/gravitational/trace\"\n)\n\nvar (\n\t// ErrTenantNotFound is returned by [Client.VerifyCredentials] when getting a token fails due to\n\t// the tenant not being found. It might also point to the subscription no longer being active.\n\tErrTenantNotFound = errors.New(\"tenant not found\")\n\t// ErrInvalidCredentials is returned by [Client.VerifyCredentials] when getting a token fails due\n\t// to an invalid client ID or secret.\n\tErrInvalidCredentials = errors.New(\"invalid Graph API credentials\")\n\t// ErrClientUnauthorized is returned by [Client.VerifyCredentials] in a situation where the app\n\t// either doesn't have the permission required to access certain resources or the permission\n\t// hasn't been grated by the administrator yet.\n\tErrClientUnauthorized = errors.New(\"authentication was successful but application does not have necessary permissions\")\n)\n\n// IsCredentialsError determines whether err is one of the special errors returned by\n// [Client.VerifyCredentials].\nfunc IsCredentialsError(err error) bool {\n\treturn errors.Is(err, ErrTenantNotFound) ||\n\t\terrors.Is(err, ErrInvalidCredentials) ||\n\t\terrors.Is(err, ErrClientUnauthorized)\n}\n\n// VerifyCredentials expects getResourcesFunc to call a method on [Client]. It then inspects the","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/msgraph/creds.go#L15-L51","documentation":"Exported sentinel ErrTenantNotFound returned by msgraph Client.VerifyCredentials when Azure AD token issuance fails with a tenant-not-found diagnostic code: the configured tenant ID does not exist or the associated subscription is no longer active.","triggerScenarios":"Thrown at lib/msgraph/creds.go:33 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the tenant ID in the integration credentials is correct","Confirm the Azure subscription/tenant is still active","Recreate the Azure OIDC integration with valid tenant credentials"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}