AADSTS65005
MisconfiguredApplication
What Microsoft says
The app required resource access list doesn't contain apps discoverable by the resource, or the client app has requested access to resource, which wasn't specified in its required resource access list or Graph service returned bad request or resource not found. If the app supports SAML, you might have configured the app with the wrong Identifier (Entity). To learn more, see the troubleshooting article for error AADSTS650056.
How to fix it
Microsoft doesn't publish a specific fix for this code beyond the description above. This site groups it under saml single sign-on, based on that description, so start with the steps below.
How to investigate
- Capture the SAMLRequest from the browser and decode it with the SAML decoder.
- Compare the Identifier, Reply URL and requested authentication context with the Enterprise App's SAML settings.
- Check the signing certificate is active and matches what the app expects.
- Search the sign-in logs for the request ID or correlation ID from the troubleshooting details on the error page.
Tools that help
The description is quoted from Microsoft's error code reference. The grouping and investigation steps are this site's guidance.