Azure Active Directory Multi Tenant App Lacks Service Principal For New Tenant Error

Question

Hi When i try to onboard new tenant i am getting below error. "AADSTS650052: The app is trying to access a service '---'(prod-app) that your organization '--**-*******' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal.

Answer 1

Within the article that you referenced - Azure AD Multi-tenant Apps: API Chains and Cyclic Dependencies, the author ran into the same error message you did. However, they were able to resolve their issue a little further down, as seen in the screenshot below. The author also describes in their conclusion that: "based on my experiments, Azure AD does not traverse API chains to gather the permissions required for consent. It only checks the direct dependencies of the client. So make sure that your client requires access to all the APIs in the chain. And then also ensure the client is a known client application of all the APIs. The APIs in the chain should still require access to the APIs they need to use. But they do not need to be known clients of them."

More info: https://learn.microsoft.com/en-us/answers/questions/258491/aadsts650052-the-app-needs-access-to-a-service-amp.html