The code AADSTS7000215 means that the client secret is wrong.

The code AADSTS7000222 means that the client secret has expired.

The code AADSTS700016 means that Microsoft Entra finds no app with that Client ID in the tenant. Either the Client ID is wrong, or the app is not in the tenant that the Tenant ID names.

For example, with the IDs replaced here by placeholders: "Microsoft Entra rejected the OAuth 2.0 credentials: AADSTS700016: Application with identifier '<client ID>' was not found in the directory '<tenant ID>'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may h..."

With real IDs, the line reaches 300 characters at that point.

The code AADSTS90002 means that Microsoft Entra does not find the tenant. Usually the Tenant ID is wrong. Microsoft also reports this code for a tenant without an active subscription.

For example, with the ID replaced here by a placeholder: "Microsoft Entra rejected the OAuth 2.0 credentials: AADSTS90002: Tenant '<tenant ID>' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant."

Microsoft Entra rejected the request and gave no description, so the message ends with the HTTP status of its answer, such as 400, in parentheses instead of an error code.

Microsoft Entra accepted the request, but its answer did not contain a usable access token.

The message ends with the name of the kind of error in parentheses, for example a timeout. SD Elements makes one request for the token and does not retry it. It allows 30 seconds to connect and 30 seconds for each read.

SD Elements also reports this message when it refuses to send the request. With network restrictions on, SD Elements refuses an address that it blocks, and it refuses to send the request through a proxy. Network restrictions are on by default when SD Elements runs the integration, and off by default on a Remote Integration Agent.

The message continues with the HTTP status in parentheses and the words "Try again later." Microsoft Entra answered with status 429 (too many requests) or with a 5xx server error.

The message continues with the HTTP status in parentheses and the words "which was not followed." Something answered the token request with a redirect. SD Elements does not follow it, because that would send the client secret to another address.

In Test Connection, the reason after "Reason:" is "HTTP Error 401. Explanation returned: Azure DevOps rejected the app’s token. Check that the app is added to the organization with Basic access and to the project’s Contributors group, and that the organization is connected to the app’s Microsoft Entra tenant." Microsoft Entra gave SD Elements a token, and Azure DevOps did not accept it, even after SD Elements asked for a new token and tried again. Microsoft’s codes for this situation are TF400813 and TF401444.

The cause is that the app is not added to the Azure DevOps organization, or that the organization is not connected to the Microsoft Entra tenant that holds the app.

Azure DevOps refuses the request to create a tag. SD Elements always sets a tag on the work items it creates. When the tag is new, the app needs permission to create it, and an app with Stakeholder access does not have that permission.

In Test Connection, the message is "Unable to connect to Azure DevOps with OAuth 2.0 (Microsoft Entra ID). Check the server, Tenant ID, Client ID and Client Secret, and the app’s access to the organization. Reason: HTTP Error 404. Explanation returned:", followed by the start of the HTML of the Azure DevOps "404 - Page not found" page. The HTML is cut short and ends with << truncated >>. A connection that uses Password or Personal Access Token gives the same reason, after its own beginning: "Unable to connect to TFS. Please check server URL, ID, password. Reason:".

Azure DevOps answered that it found nothing at the address. The cause is usually that the organization does not exist: a wrong Context Root with dev.azure.com as the Server, or a wrong <organization>.visualstudio.com address as the Server.

A sync, or Test Connection on a project connection, fails with "Unable to validate project. Check that <collection> is a valid collection, and <project> is a valid project. Reason: HTTP Error 404. Explanation returned: TF200016: The following project does not exist: <project>. Verify that the name of the project is correct and that the project exists on the specified Azure DevOps Server." Here <collection> is the Collection Name (with that field empty, nothing shows where <collection> stands) and <project> is the name in the Azure DevOps (TFS) Project field. Both authentication methods give this message.

Azure DevOps does not find a project with that name.

Each of these messages names one setting that OAuth 2.0 (Microsoft Entra ID) does not accept. SD Elements checks the settings when you save the connection, and again each time Test Connection or a sync starts, because a configuration file, such as the one a Remote Integration Agent uses, does not pass through the form. A run stops before it sends any request.

In the system connector, saving and Test Connection show each message under the setting it names. An empty Server, Azure DevOps (TFS) Tenant ID, Azure DevOps (TFS) Client ID or Azure DevOps (TFS) Client Secret field shows the form’s own required-field message instead, such as "Field Azure DevOps (TFS) Tenant ID is required." The messages in the table appear only after every setting passes those first checks, so a second save can show more of them. A sync, Test Connection on a project connection, and a run from a configuration file show the message on its own, without the "Unable to connect" text. In those cases, if more than one setting is wrong, the messages appear together in one line, separated by a space.