gravitational/teleport · error

tenant not found

Error message

tenant not found

What it means

Exported sentinel ErrTenantNotFound returned by msgraph Client.VerifyCredentials when Azure AD token issuance fails with a tenant-not-found diagnostic code: the configured tenant ID does not exist or the associated subscription is no longer active.

Source

Thrown at lib/msgraph/creds.go:33

// along with this program.  If not, see <http://www.gnu.org/licenses/>.

// VerifyCredentials checks if the credentials supplied to the client can be used to authenticate to
// the Graph API and if they're authorized to get specific resources.
package msgraph

import (
	"context"
	"errors"
	"net/http"
	"slices"

	"github.com/gravitational/trace"
)

var (
	// ErrTenantNotFound is returned by [Client.VerifyCredentials] when getting a token fails due to
	// the tenant not being found. It might also point to the subscription no longer being active.
	ErrTenantNotFound = errors.New("tenant not found")
	// ErrInvalidCredentials is returned by [Client.VerifyCredentials] when getting a token fails due
	// to an invalid client ID or secret.
	ErrInvalidCredentials = errors.New("invalid Graph API credentials")
	// ErrClientUnauthorized is returned by [Client.VerifyCredentials] in a situation where the app
	// either doesn't have the permission required to access certain resources or the permission
	// hasn't been grated by the administrator yet.
	ErrClientUnauthorized = errors.New("authentication was successful but application does not have necessary permissions")
)

// IsCredentialsError determines whether err is one of the special errors returned by
// [Client.VerifyCredentials].
func IsCredentialsError(err error) bool {
	return errors.Is(err, ErrTenantNotFound) ||
		errors.Is(err, ErrInvalidCredentials) ||
		errors.Is(err, ErrClientUnauthorized)
}

// VerifyCredentials expects getResourcesFunc to call a method on [Client]. It then inspects the

View on GitHub (pinned to 1283425b60)

Solutions

1. Verify the tenant ID in the integration credentials is correct
2. Confirm the Azure subscription/tenant is still active
3. Recreate the Azure OIDC integration with valid tenant credentials

When it happens

Trigger: Thrown at lib/msgraph/creds.go:33 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/673c920acb7b57c6. Report an issue: GitHub.