The client has requested access to a resource which is not listed in the requested permissions in the client's application registration.

[shiva731]

Describe the bug

invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)

Related command

az logout
az login --tenant "05d75c05-fa1a-42e7-9cf1-eb416c396f2d" --scope "api://ingestion.pensieve/.default"

Errors

invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)

Issue script & Debug output

invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)

Expected behavior

invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)

Environment Summary

(.venv) s.shindigeri@MMDH4K6W2F5YH scm-central-gitops % az --version
azure-cli 2.81.0 *

core 2.81.0 *
telemetry 1.1.0

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/homebrew/Cellar/azure-cli/2.81.0/libexec/bin/python'
Config directory '/Users/s.shindigeri/.azure'
Extensions directory '/Users/s.shindigeri/.azure/cliextensions'

Python (Darwin) 3.13.11 (main, Dec 5 2025, 16:06:33) [Clang 17.0.0 (clang-1700.4.4.1)]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

invalid_client: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: 04b07795-8ddb-461a-bbee-02f9e1bf7b46(Microsoft Azure CLI). Resource value from request: api://ingestion.pensieve. Resource app ID: 242092bf-f250-404c-8db8-c6742842d9a1. List of valid resources from app registration: . Trace ID: a4123e99-7804-43ec-bc12-19f752001000 Correlation ID: a200ff84-77e6-4d70-9555-fd64eec05bd2 Timestamp: 2026-08-13 07:44:09Z. ($error_uri)

[azure-client-tools-bot-prd]

Hi shivashankar shindigeri (@shiva731),

2.81.0 is not the latest Azure CLI(2.89.1).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[azure-client-tools-agent]

Hi Yong Zhang (@yonzhan), thanks for the report. Before we can investigate, could you help clarify a few things:

• Expected behavior: What did you expect az login --tenant "05d75c05-..." --scope "api://ingestion.pensieve/.default" to do? The current 'Expected behavior' section just repeats the error text, so it's not clear what the desired outcome is.
• Is api://ingestion.pensieve a custom/first-party API you registered yourself, or is it expected to work out of the box with the public Azure CLI client app (04b07795-8ddb-461a-bbee-02f9e1bf7b46)? AADSTS650057 typically means the target resource's app registration hasn't exposed/granted that scope to the Azure CLI client app ID, which is usually an app registration/tenant configuration issue rather than a CLI bug.
• If this is a custom resource, has an admin added the Azure CLI app as an authorized client application for api://ingestion.pensieve and consented to the requested scope?
• Does az login --scope <resource>/.default work for other resources in the same tenant, or only this one fails?

I'll pick this up automatically once you reply.

---

Posted by agent-assist (autonomous bug-fix pipeline).

[azure-client-tools-agent]

Hi shivashankar shindigeri (@shiva731), just following up on the questions above since we haven't heard back:

• Expected behavior: What did you expect az login --tenant "05d75c05-fa1a-42e7-9cf1-eb416c396f2d" --scope "api://ingestion.pensieve/.default" to do? The 'Expected behavior' section currently just repeats the error text, so it's unclear what outcome you were hoping for.
• Is api://ingestion.pensieve a custom/first-party API you registered yourself, or is it expected to work out of the box with the public Azure CLI app registration (04b07795-8ddb-461a-bbee-02f9e1bf7b46)?
• Have you tried upgrading to the latest Azure CLI (2.89.1) as suggested, and does the issue still occur?

If we don't hear back, we may not be able to make further progress on this issue. Thanks!

---

Posted by agent-assist (autonomous bug-fix pipeline).