{"record":{"id":"865588038bd9db7c","repo":"gravitational/teleport","slug":"authentication-was-successful-but-application-does","errorCode":null,"errorMessage":"authentication was successful but application does not have necessary permissions","messagePattern":"authentication was successful but application does not have necessary permissions","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/msgraph/creds.go","lineNumber":40,"sourceCode":"\t\"context\"\n\t\"errors\"\n\t\"net/http\"\n\t\"slices\"\n\n\t\"github.com/gravitational/trace\"\n)\n\nvar (\n\t// ErrTenantNotFound is returned by [Client.VerifyCredentials] when getting a token fails due to\n\t// the tenant not being found. It might also point to the subscription no longer being active.\n\tErrTenantNotFound = errors.New(\"tenant not found\")\n\t// ErrInvalidCredentials is returned by [Client.VerifyCredentials] when getting a token fails due\n\t// to an invalid client ID or secret.\n\tErrInvalidCredentials = errors.New(\"invalid Graph API credentials\")\n\t// ErrClientUnauthorized is returned by [Client.VerifyCredentials] in a situation where the app\n\t// either doesn't have the permission required to access certain resources or the permission\n\t// hasn't been grated by the administrator yet.\n\tErrClientUnauthorized = errors.New(\"authentication was successful but application does not have necessary permissions\")\n)\n\n// IsCredentialsError determines whether err is one of the special errors returned by\n// [Client.VerifyCredentials].\nfunc IsCredentialsError(err error) bool {\n\treturn errors.Is(err, ErrTenantNotFound) ||\n\t\terrors.Is(err, ErrInvalidCredentials) ||\n\t\terrors.Is(err, ErrClientUnauthorized)\n}\n\n// VerifyCredentials expects getResourcesFunc to call a method on [Client]. It then inspects the\n// returned error to check for Graph or token errors related to credentials being insufficient in\n// some way.\nfunc (c *Client) VerifyCredentials(ctx context.Context, getResourcesFunc func(ctx context.Context, client *Client) error) error {\n\terr := getResourcesFunc(ctx, c)\n\n\tgraphError := &GraphError{}\n\tisGraphError := errors.As(err, &graphError)","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/msgraph/creds.go#L22-L58","documentation":"Exported sentinel ErrClientUnauthorized returned by msgraph Client.VerifyCredentials when token acquisition succeeded but the Graph API call comes back 401: the application lacks the required app permissions/consent for the requested resources.","triggerScenarios":"Thrown at lib/msgraph/creds.go:40 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Grant the application the needed Microsoft Graph delegated/application permissions in Azure","Have an admin complete admin consent for the permissions","Verify the correct API permissions were requested for the integration"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}