gravitational/teleport · error

authentication was successful but application does not have

Error message

authentication was successful but application does not have necessary permissions

What it means

Exported sentinel ErrClientUnauthorized returned by msgraph Client.VerifyCredentials when token acquisition succeeded but the Graph API call comes back 401: the application lacks the required app permissions/consent for the requested resources.

Source

Thrown at lib/msgraph/creds.go:40

	"context"
	"errors"
	"net/http"
	"slices"

	"github.com/gravitational/trace"
)

var (
	// ErrTenantNotFound is returned by [Client.VerifyCredentials] when getting a token fails due to
	// the tenant not being found. It might also point to the subscription no longer being active.
	ErrTenantNotFound = errors.New("tenant not found")
	// ErrInvalidCredentials is returned by [Client.VerifyCredentials] when getting a token fails due
	// to an invalid client ID or secret.
	ErrInvalidCredentials = errors.New("invalid Graph API credentials")
	// ErrClientUnauthorized is returned by [Client.VerifyCredentials] in a situation where the app
	// either doesn't have the permission required to access certain resources or the permission
	// hasn't been grated by the administrator yet.
	ErrClientUnauthorized = errors.New("authentication was successful but application does not have necessary permissions")
)

// IsCredentialsError determines whether err is one of the special errors returned by
// [Client.VerifyCredentials].
func IsCredentialsError(err error) bool {
	return errors.Is(err, ErrTenantNotFound) ||
		errors.Is(err, ErrInvalidCredentials) ||
		errors.Is(err, ErrClientUnauthorized)
}

// VerifyCredentials expects getResourcesFunc to call a method on [Client]. It then inspects the
// returned error to check for Graph or token errors related to credentials being insufficient in
// some way.
func (c *Client) VerifyCredentials(ctx context.Context, getResourcesFunc func(ctx context.Context, client *Client) error) error {
	err := getResourcesFunc(ctx, c)

	graphError := &GraphError{}
	isGraphError := errors.As(err, &graphError)

View on GitHub (pinned to 1283425b60)

Solutions

1. Grant the application the needed Microsoft Graph delegated/application permissions in Azure
2. Have an admin complete admin consent for the permissions
3. Verify the correct API permissions were requested for the integration

When it happens

Trigger: Thrown at lib/msgraph/creds.go:40 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/865588038bd9db7c. Report an issue: GitHub.