Error "AADSTS7000229" during ODM Teams Discovery (4381429)

When running the Discovery of Teams task against the Source Tenant, the operation fails. The migration logs display the following error:

Unexpected error occurred: A configuration issue is preventing authentication - check the error message from the server for details. Original exception: AADSTS7000229: The client application 5e65ffd9-9538-437b-957c-1111098b3d3c is missing service principal in the tenant {Source_Tenant_ID}.

Log Details:

• Trace ID: {Trace_ID}

• Correlation ID: {Correlation_ID}

• Timestamp: {Timestamp}

The migration tool (Client ID: 5e65ffd9-9538-437b-957c-1111098b3d3c) requires a specific Service Principal capability to perform the discovery (e.g., SharePoint - Minimal, Teams - Read, etc.).

The error occurs because the tenant currently has a different Service Principal scope consented (e.g., SharePoint - Full), or the specific principal required for the current task is missing. Azure AD rejects the authentication because it cannot find the exact Service Principal required to fulfill the specific token request.

To resolve this, you must identify which specific Service Principal is missing, remove the conflicting application from Azure, and grant the correct consent via the ODM Console.

Step 1: Identify the Required Service Principal

Use the Admin Consent URL to visualize exactly what the application is requesting.

1. Construct the URL by replacing {Source_Tenant_ID} with the Tenant ID found in the error log:

   Plaintext

   https://login.microsoftonline.com/{Source_Tenant_ID}/adminconsent?client_id=5e65ffd9-9538-437b-957c-1111098b3d3c
   

2. Open this URL in a private/incognito browser and sign in with the Source Tenant Admin account.

3. Do not click Accept yet.

4. Look at the permissions prompt. Note the title/header of the application permissions being requested (e.g., "SharePoint - Minimal", "Teams - Basic", etc.).

5. Compare this with what you believe is currently installed. This confirms the mismatch.

Step 2: Clean up Azure Enterprise Applications

To ensure a clean re-granting of permissions, remove the conflicting entry from the Azure Portal.

1. Log in to the Microsoft Entra ID (Azure AD) Portal for the Source Tenant.

2. Navigate to Enterprise Applications.

3. Search for the Application ID: 5e65ffd9-9538-437b-957c-1111098b3d3c.

4. If an application entry exists (e.g., one with the "wrong" permission set), click it.

5. Go to Properties and click Delete to remove this Service Principal instance from the tenant.

Step 3: Grant Correct Consent in ODM

Now that the conflict is removed from Azure, you must grant the correct consent through the migration platform to ensure ODM and Azure are in sync.

1. Log in to the On Demand Migration (ODM) Console.

2. Navigate to the Tenants dashboard.

3. Select the Source Tenant.

4. Locate the consent section (e.g., Migration, SharePoint, or Teams module).

5. Edit/Update Consent:

   • If an old consent is listed, remove/revoke it.

   • Select Grant Consent.

   • Crucial: Choose the specific consent option that matches the requirement identified in Step 1 (e.g., select SharePoint - Minimal instead of SharePoint - Full).

6. Complete the Admin Consent flow by clicking Accept.

Step 4: Verification

1. Return to the migration project.

2. Restart the Discovery of Teams job.

3. The task will now successfully authenticate using the newly created, correct Service Principal.