AADSTS650057: The Client Has Requested Access to a Resource Which Is Not Listed (Fix)

On 10/09/2026 I ran Connect-PnPOnline -Interactive with a freshly registered Entra ID app, signed in, and the Please login for PnP PowerShell window answered with AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client’s application registration.

The message looks scary, but its IDs tell you exactly what’s missing. Here’s how I decoded it and fixed the app in the Microsoft Entra admin center, with screenshots from my own tenant.

Quick answer: Your app has no permission for the API it asked for. In Entra ID > App registrations > your app > API permissions > Add a permission, add the API named by the error’s Resource app ID (for PnP PowerShell: Office 365 SharePoint Online > Delegated > AllSites.*), select Grant admin consent, and sign in again.

What the full AADSTS650057 message says

My command was the standard interactive sign-in:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Marketing" `
    -ClientId "00000000-0000-0000-0000-000000000000" -Interactive

Here’s the error with my tenant details swapped for contoso:

AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed
in the requested permissions in the client's application registration.
Client app ID: <your app's client ID>.
Resource value from request: https://contoso.sharepoint.com.
Resource app ID: 00000003-0000-0ff1-ce00-000000000000.
List of valid resources from app registration: 00000003-0000-0000-c000-000000000000.

Each field points to part of the fix:

• Client app ID is the Application (client) ID of the app that asked for a token. In PnP PowerShell, that’s your -ClientId value. This is the app registration you’ll edit.
• Resource value from request is the API the app wanted. PnP sends your SharePoint URL.
• Resource app ID is that API as a GUID. 00000003-0000-0ff1-ce00-000000000000 is Office 365 SharePoint Online.
• List of valid resources from app registration shows the APIs the app is configured for. Mine had only 00000003-0000-0000-c000-000000000000, which is Microsoft Graph.

So my PnP PowerShell app had Graph’s default User.Read and nothing for SharePoint. The Resource app ID must appear in the valid list. If you haven’t built the app yet, my guide to connecting to SharePoint Online using PowerShell covers the full setup.

Common resource app IDs in the AADSTS650057 message

Microsoft’s APIs use the same app IDs in every tenant, so you can match the Resource app ID against this table to see which API to add:

Resource app ID	API to add	Where you’ll see it
00000003-0000-0ff1-ce00-000000000000	Office 365 SharePoint Online	PnP PowerShell, SharePoint REST and CSOM scripts
00000003-0000-0000-c000-000000000000	Microsoft Graph	Graph PowerShell and most custom apps
00000002-0000-0ff1-ce00-000000000000	Office 365 Exchange Online	Exchange Online PowerShell app-only scripts
00000007-0000-0000-c000-000000000000	Dataverse	Power Apps and Dynamics 365 data scripts
00000009-0000-0000-c000-000000000000	Power BI	Power BI REST API scripts
00000002-0000-0000-c000-000000000000	Windows Azure Active Directory (legacy Azure AD Graph)	Older apps; Microsoft Graph replaces it

For your own web API, the resource value is its Application ID URI, such as api:// followed by the API’s app ID. Add that API to the client app the same way.

How to fix AADSTS650057 for PnP PowerShell

Adding the permission needs ownership of the app (or an admin role). Granting consent needs Cloud Application Administrator, Application Administrator, or Privileged Role Administrator.

Step 1. Sign in to the Microsoft Entra admin center, go to Entra ID > App registrations > All applications, and open the app whose Application (client) ID matches the Client app ID in the error.

Step 2. Under Manage, select API permissions. The configured list here is the error’s list of valid resources. Select + Add a permission.

Step 3. Open APIs my organization uses, search for Office 365 SharePoint Online, and select it.

Step 4. Choose Delegated permissions, because -Interactive and -DeviceLogin act as the signed-in user. Expand AllSites and check what your scripts need.

Pick the least privilege that works: AllSites.Read for reports, AllSites.Write for scripts that create, update and delete list items, AllSites.Manage to create lists, and AllSites.FullControl for permission changes.

Step 5 (unattended scripts only). Application permissions such as Sites.FullControl.All serve certificate-based app-only connections and don’t help -Interactive. Sites.Selected limits such scripts to specific sites.

Step 6. Select Add permissions, then Grant admin consent for <your tenant> and confirm. Every row should show Granted for your tenant.

Want proof the API is on the list? Open the app’s Manifest. The requiredResourceAccess array should now hold the SharePoint resource app ID next to Graph:

"requiredResourceAccess": [
  { "resourceAppId": "00000003-0000-0000-c000-000000000000", "resourceAccess": [ ... ] },
  { "resourceAppId": "00000003-0000-0ff1-ce00-000000000000", "resourceAccess": [ ... ] }
]

Reconnect with a fresh token

A token PnP already holds won’t pick up the new permission. Close PowerShell, or clear the saved login if you used -PersistLogin, then sign in again:

$siteUrl  = "https://contoso.sharepoint.com/sites/Marketing"
$clientId = "00000000-0000-0000-0000-000000000000"   # Application (client) ID from the error

# Only if you connected with -PersistLogin earlier: drop the saved token
Disconnect-PnPOnline -ClearPersistedLogin

# Fresh sign-in, so the new token carries the SharePoint permissions
Connect-PnPOnline -Url $siteUrl -ClientId $clientId -Interactive -ForceAuthentication
Get-PnPWeb | Select-Object Title, Url

When Get-PnPWeb returns the site title, AADSTS650057 is gone. A good next test is getting all SharePoint Online sites with PnP PowerShell, which needs the admin center URL.

AADSTS650057 in other tools and apps

Entra ID raises this error for any client that asks for a token to an API missing from its app registration, so the same read-the-IDs fix works elsewhere:

• Other PnP cmdlets. Cmdlets that call Microsoft Graph need Graph permissions on the same app.
• Exchange Online PowerShell app-only. Microsoft’s setup adds Office 365 Exchange Online to the app’s requiredResourceAccess. Skip that step and you’ll see this error.
• Your own MSAL app or script. A request for https://contoso.sharepoint.com/.default asks for the permissions listed in the app registration, whether you call the SharePoint REST API or a custom API. Add the API first.
• A vendor’s multi-tenant app. Only the app’s owner can add the missing API. Send the vendor the full message; after they update their registration, your admin consents again.

Still getting AADSTS650057? Check these mistakes

• You edited the wrong app. Compare the Client app ID in the error with the app’s Application (client) ID, not its Object ID. An old ENTRAID_APP_ID environment variable can point PnP at another app.
• The token is cached. Run Disconnect-PnPOnline -ClearPersistedLogin or open a new PowerShell window.
• Wrong tenant. You fixed the app in a test tenant but connected to production. Check the Directory (tenant) ID on the app’s Overview page.
• Permission added but not consented. AADSTS650057 disappears, but you get a Need admin approval prompt or AADSTS65001 instead. Grant admin consent (step 6).

AADSTS650057 is often confused with its neighbors. Microsoft’s reference separates them like this:

Error	What it means	Fix
AADSTS650057	The requested API isn’t in the app’s permission list.	Add the API under API permissions.
AADSTS650056	Misconfigured app: no permissions for the API, no admin consent, or a wrong client ID.	Add the permission, consent, check the ID.
AADSTS65001	The user or admin hasn’t consented to the app.	Grant admin consent.
AADSTS500011	The resource wasn’t found in the tenant.	Check the tenant and resource URL.
AADSTS650052	Your organization hasn’t subscribed to or enabled the service.	Ask your admin to check service subscriptions.

For any code, https://login.microsoftonline.com/error?code=650057 shows Microsoft’s current wording (swap in your number).

A different sign-in failure, AADSTS500113: No reply address is registered for the application, means the app has no redirect URI yet. Here’s how to fix the AADSTS500113 no reply address error in the same app registration.

Prevent AADSTS650057: let PnP register the app

On a new tenant, I let PnP PowerShell create the app with the redirect URI and SharePoint and Graph delegated permissions already in place. You need a current module for this, so install or update PnP PowerShell first:

Register-PnPEntraIDAppForInteractiveLogin -ApplicationName "PnP PowerShell" -Tenant contoso.onmicrosoft.com

# Optional: skip -ClientId in every script (add this line to your PowerShell profile)
$env:ENTRAID_APP_ID = "00000000-0000-0000-0000-000000000000"

With ENTRAID_APP_ID set, Connect-PnPOnline -Url <site> -Interactive works without -ClientId. From there, try my PnP PowerShell scripts for SharePoint developers or browse the SharePoint PowerShell tutorials.

Once PnP PowerShell connects again, these guides make good next steps:

• How to Get All Lists and Libraries from a SharePoint Online Site Using PnP PowerShell
• How to Upload Files to a SharePoint Document Library Using PnP PowerShell
• How to Create a Site in SharePoint Online Using PnP PowerShell
• Exception calling ExecuteQuery with 0 argument(s): Unable to connect to the remote server error in PowerShell SharePoint Online

Frequently Asked Questions