microsoft365.client_id must not be empty when microsoft365 i

Error message

microsoft365.client_id must not be empty when microsoft365 is enabled

What it means

With [microsoft365] enabled, client_id must be present, trimmed, and non-empty; the check runs immediately after the tenant_id check in the first M365 validation block. The value should be the Application (client) ID GUID of the Azure app registration. Only non-emptiness is enforced here — a malformed but non-empty GUID fails later at auth time, not in config validation.

Source

Thrown at crates/zeroclaw-config/src/schema.rs:21704

            let tenant = self
                .microsoft365
                .tenant_id
                .as_deref()
                .map(str::trim)
                .filter(|s| !s.is_empty());
            if tenant.is_none() {
                anyhow::bail!(
                    "microsoft365.tenant_id must not be empty when microsoft365 is enabled"
                );
            }
            let client = self
                .microsoft365
                .client_id
                .as_deref()
                .map(str::trim)
                .filter(|s| !s.is_empty());
            if client.is_none() {
                anyhow::bail!(
                    "microsoft365.client_id must not be empty when microsoft365 is enabled"
                );
            }
            let flow = self.microsoft365.auth_flow.trim();
            if flow != "client_credentials" && flow != "device_code" {
                anyhow::bail!(
                    "microsoft365.auth_flow must be 'client_credentials' or 'device_code'"
                );
            }
            if flow == "client_credentials"
                && self
                    .microsoft365
                    .client_secret
                    .as_deref()
                    .is_none_or(|s| s.trim().is_empty())
            {
                anyhow::bail!(
                    "microsoft365.client_secret must not be empty when auth_flow is 'client_credentials'"

View on GitHub (pinned to 88bb9c8533)

Solutions

Set microsoft365.client_id to the app registration's Application (client) ID GUID (Azure portal > App registrations > your app > Overview)
Trim accidental whitespace when pasting
If not ready, set microsoft365.enabled = false
auth_flow is validated next — set it in the same edit to avoid a third run

Example fix

# before
[microsoft365]
enabled = true
tenant_id = "11111111-2222-3333-4444-555555555555"
# client_id missing

# after
[microsoft365]
enabled = true
tenant_id = "11111111-2222-3333-4444-555555555555"
client_id = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

Defensive patterns

Strategy: validation

Validate before calling

fn m365_client_precheck(m: &zeroclaw_config::Microsoft365Config) -> Result<(), String> {
    if !m.enabled { return Ok(()); }
    if m.client_id.as_deref().map(str::trim).is_none_or(str::is_empty) {
        return Err("microsoft365.client_id must not be empty when microsoft365 is enabled".into());
    }
    Ok(())
}

Type guard

fn m365_client_ready(m: &zeroclaw_config::Microsoft365Config) -> bool {
    !m.enabled || m.client_id.as_deref().map(str::trim).is_some_and(|s| !s.is_empty())
}

Try / catch

if let Err(err) = config.validate() {
    if err.to_string().contains("microsoft365.client_id") {
        // fill client_id (Application (client) ID GUID) or disable the section
    }
}

Prevention

Store tenant_id, client_id, and auth_flow together — they are validated as a set
Template the whole [microsoft365] block from the app registration record
Assert non-empty GUIDs in CI config checks, not just at startup

When it happens

Trigger: Set `microsoft365.enabled = true` with client_id omitted, empty, or whitespace-only (tenant_id already passing).

Common situations: Registering the app but never copying the client ID into config; rotating to a new app registration and clearing the old value; multi-tenant setups pasting the wrong app's ID or leaving it blank.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/edcbbbbced365d06. Report an issue: GitHub.