What does AADSTS650057 invalid resource mean?

The app asked for a token to an API that isn't in its app registration's API permissions. Microsoft's Entra authentication error codes list shows the full message format with the client and resource IDs.

What's the difference between AADSTS650057 and AADSTS65001?

AADSTS650057 means the API isn't configured on the app at all. AADSTS65001 means the permission is configured, but nobody has consented to it yet.

Which permissions does PnP PowerShell need to connect to SharePoint Online?

Delegated Office 365 SharePoint Online permissions such as AllSites.Read or AllSites.Write for -Interactive sign-ins. The PnP guide to registering an Entra ID application shows both the cmdlet and the manual setup.

AADSTS650057: Resource Not Listed in Requested Permissions

On 10/09/2026 I ran Connect-PnPOnline -Interactive with a freshly registered Entra ID app, signed in, and the Please login for PnP PowerShell window answered with AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client’s application registration.

The message looks scary, but its IDs tell you exactly what’s missing. Here’s how I decoded it and fixed the app in the Microsoft Entra admin center, with screenshots from my own tenant.

Quick answer: Your app has no permission for the API it asked for. In Entra ID > App registrations > your app > API permissions > Add a permission, add the API named by the error’s Resource app ID (for PnP PowerShell: Office 365 SharePoint Online > Delegated > AllSites.*), select Grant admin consent, and sign in again.

Table of Contents:

What the full AADSTS650057 message says

My command was the standard interactive sign-in:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Marketing" `
    -ClientId "00000000-0000-0000-0000-000000000000" -Interactive

Here’s the error with my tenant details swapped for contoso:

AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed
in the requested permissions in the client's application registration.
Client app ID: <your app's client ID>.
Resource value from request: https://contoso.sharepoint.com.
Resource app ID: 00000003-0000-0ff1-ce00-000000000000.
List of valid resources from app registration: 00000003-0000-0000-c000-000000000000.

AADSTS650057 invalid resource error in the Please login for PnP PowerShell sign-in window

Each field points to part of the fix:

Client app ID is the Application (client) ID of the app that asked for a token. In PnP PowerShell, that’s your -ClientId value. This is the app registration you’ll edit.
Resource value from request is the API the app wanted. PnP sends your SharePoint URL.
Resource app ID is that API as a GUID. 00000003-0000-0ff1-ce00-000000000000 is Office 365 SharePoint Online.
List of valid resources from app registration shows the APIs the app is configured for. Mine had only 00000003-0000-0000-c000-000000000000, which is Microsoft Graph.

So my PnP PowerShell app had Graph’s default User.Read and nothing for SharePoint. The Resource app ID must appear in the valid list. If you haven’t built the app yet, my guide to connecting to SharePoint Online using PowerShell covers the full setup.

Common resource app IDs in the AADSTS650057 message

Microsoft’s APIs use the same app IDs in every tenant, so you can match the Resource app ID against this table to see which API to add:

Resource app ID	API to add	Where you’ll see it
`00000003-0000-0ff1-ce00-000000000000`	Office 365 SharePoint Online	PnP PowerShell, SharePoint REST and CSOM scripts
`00000003-0000-0000-c000-000000000000`	Microsoft Graph	Graph PowerShell and most custom apps
`00000002-0000-0ff1-ce00-000000000000`	Office 365 Exchange Online	Exchange Online PowerShell app-only scripts
`00000007-0000-0000-c000-000000000000`	Dataverse	Power Apps and Dynamics 365 data scripts
`00000009-0000-0000-c000-000000000000`	Power BI	Power BI REST API scripts
`00000002-0000-0000-c000-000000000000`	Windows Azure Active Directory (legacy Azure AD Graph)	Older apps; Microsoft Graph replaces it

For your own web API, the resource value is its Application ID URI, such as api:// followed by the API’s app ID. Add that API to the client app the same way.

How to fix AADSTS650057 for PnP PowerShell

Adding the permission needs ownership of the app (or an admin role). Granting consent needs Cloud Application Administrator, Application Administrator, or Privileged Role Administrator.

Step 1. Sign in to the Microsoft Entra admin center, go to Entra ID > App registrations > All applications, and open the app whose Application (client) ID matches the Client app ID in the error.