Official documentation checked October 14, 2026.
AADSTS700016 means Microsoft Entra ID could not find the requested application in the directory or tenant used by the authentication request. When it appears while opening Copilot, the first task is to identify that application and tenant—not to create an enterprise application using a supposed universal Copilot ID.
Several products and integrations use the Copilot name. A failure in a custom connector, organizational chat or another application can involve different identities. Preserve the actual error details before changing anything.
Understand what the error does and does not prove
Microsoft’s authentication error reference lists an incorrect application identifier, a request sent to the wrong tenant, and an application not installed or consented to in that tenant as possible causes of AADSTS700016.
The code alone does not establish that a Copilot license is missing, that Conditional Access should be disabled, or that a Microsoft enterprise application was deleted. Those explanations need separate evidence.
Capture the application identifier, tenant or directory named in the message, timestamp, request ID and correlation ID if shown. Send those details privately to the responsible administrator. Do not share passwords, session cookies, access tokens or client secrets in a screenshot or support post.
Check the account and sign-in event
- Confirm which Copilot experience you intended to open and whether it requires your work or school account. Use the organization’s approved entry point rather than an old migration bookmark.
- Check the selected account and organization. If several accounts are active, test in a separate browser profile or private window with only the intended account. This tests account selection; it does not repair tenant configuration.
- Ask an authorized administrator to open Entra ID > Monitoring & health > Sign-in logs.
- Filter to the affected user and approximate failure time. Open the failed event and compare its code, application, resource, tenant and failure details with the original message.
Microsoft documents Reports Reader as the least-privileged role for accessing these activity logs. Users can also review their own sign-ins. Follow the official sign-in troubleshooting workflow.
If the recorded error differs from the reported code, troubleshoot the recorded failure. Repeated retries or clearing all browser data can obscure the original problem without fixing an incorrect application identifier.
Inspect the application before choosing a repair
In the Microsoft Entra admin center, an authorized application administrator can open Entra ID > Enterprise apps > All applications. Choose an application-type filter that includes Microsoft applications, then search using the identifier from the failure. A name-only search for “Copilot” is insufficient. Microsoft explains these application viewing options.
Keep the identifiers distinct: an application/client ID identifies an application, while the service principal’s object ID identifies its local directory object. The application and service-principal model explains the difference.
- Wrong tenant or client ID in an owned integration: have its owner correct the configuration against the approved registration.
- App not yet installed or consented to: use the verified publisher’s documented deployment and consent process after reviewing the requested permissions.
- Known app recently deleted: verify the deletion record and eligible recovery path before restoring the specific object.
Microsoft provides a soft-deleted enterprise application recovery procedure. Creating a new principal is not equivalent to restoring all prior configuration, and no hard-coded “Copilot AppId” from an unrelated article should be used.
Retest and escalate without bypassing security
After an approved correction, repeat the same sign-in using the same intended account and record the new result. Verify both successful authentication and access to the intended product; licensing or application authorization may still require separate checks.
If a Microsoft-managed application remains unresolved, submit the app and tenant identifiers, correlation ID, time, affected user scope and recent change history to Microsoft support through an approved channel. Do not grant tenant-wide consent or exclude an application from Conditional Access just to see whether the banner disappears. Those changes affect security and are not an evidence-based repair for this error code.