Azure app authentication with Sandbox account returns "unauthorized_client: The client does not exist or is not enabled for consumers." error

Question

I have a registered Azure app that is working in Microsoft production API. I've created a sandbox test account (according to this instruction) and I'm trying to receive an OAuth token. According to the instruction I've changed the login endpoint and result link is

https://login.windows-ppe.net/consumers/oauth2/v2.0/authorize?client_id=4abdfe32-XXXX-XXXX-XXXX-510dd884cd81&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fads.microsoft.com%2Fmsads.manage&state=12345

The problem is when I'm opening this link and trying to login with the created Sandbox account ([email protected]) it shows me unauthorized_client error:

We're unable to complete your request

unauthorized_client: The client does not exist or is not enabled for consumers. If you are the application developer, configure a new application through the App Registrations in the Azure Portal at https://go.microsoft.com/fwlink/?linkid=2083908.

Supported account type for this application is any Azure AD and personal.

Any ideas what is wrong or what I've missed in my connection with Sanbox account (this happens with Sandbox account only)?

Answer 1

Initially, I too got same error when I used registered application Client ID and ran below login endpoint in browser:

https://login.windows-ppe.net/consumers/oauth2/v2.0/authorize?client_id=0f949c66-6790-xxxxxxxxxxx&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fads.microsoft.com%2Fmsads.manage&state=12345

As mentioned in this MS Document,

To authenticate in the sandbox environment you don't need to register an application. Just use the public "Tutorial Sample App" client ID i.e., 4c0b021c-00c3-4508-838f-d3127e8167ff.

To resolve the error, make use of below login endpoint by replacing ClientID and redirect URI values to authenticate with sandbox account like this:

https://login.windows-ppe.net/consumers/oauth2/v2.0/authorize?client_id=4c0b021c-00c3-4508-838f-d3127e8167ff&response_type=code&redirect_uri=https://login.windows-ppe.net/common/oauth2/nativeclient&response_mode=query&scope=openid%20profile%20https://api.ads.microsoft.com/msads.manage%20offline_access&state=12345

When I logged in with sandbox test account, I got consent screen with permissions:

After accepting the above consent, I got code value in address bar successfully like this: