Received error - "AADSTS399266: Blob grant token received with wrong issuer type."

Narisetti, Bernard 0 Reputation points
2024-09-05T20:42:40.4133333+00:00

I am trying to use the code from this microsoft learn page - https://video2.skills-academy.com/en-us/samples/azure-samples/ms-identity-ciam-javascript-tutorial/ms-identity-ciam-javascript-tutorial-0-call-api-vanillajs/ and configure the Ids. When trying to authenticate and access the API, seeing below error with status code 400.

{

"error": "invalid_request",

"error_description": "AADSTS399266: Blob grant token received with wrong issuer type. Trace ID: 2cd9ffce-cb70-454d-be7f-d8f39dfc0401 Correlation ID: e689aacd-7c78-42e6-93d0-12b70b24620c Timestamp: 2024-09-05 15:49:43Z",

"error_codes": [

    399266

],

"timestamp": "2024-09-05 15:49:43Z",

"trace_id": "2cd9ffce-cb70-454d-be7f-d8f39dfc0401",

"correlation_id": "e689aacd-7c78-42e6-93d0-12b70b24620c"

}

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
804 questions
Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,861 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,585 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. James Hamil 24,571 Reputation points Microsoft Employee
    2024-09-10T18:55:31.82+00:00

    Hi @Narisetti, Bernard , aside from making sure that the tenant ID and subscription ID in your configuration are correct, make sure you are logged in with the correct account using the Azure CLI. You can check this with:

       az account show

    If the account is incorrect, log in with:

       az login --tenant <tenant-id>

    If you are using a service principal for authentication, make sure it has the necessary permissions to access the subscription and tenant.

    You could also try using a different authority URL to get the token. You can set the authority with:

    az cloud set --name AzureCloud

    If the subscription was recently transferred to another tenant, it might take some time for the changes to propagate. Wait for a while and try again later.

    Please let me know if this helps.

    Best,

    James

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.