Share via

Title: Azure VPN Gateway Point-to-Site with Entra ID Authentication – Token Acquisition Error

Abdelrhman Goma 75 Reputation points
2025-07-31T14:34:15.6033333+00:00

Screenshot from 2025-07-31 17-31-49.png

I’m setting up an Azure VPN Gateway with Point-to-Site (P2S) configuration to allow private access to our resources. I’ve configured it to use Microsoft Entra ID for authentication.

However, when I try to connect using the Azure VPN Client, the connection fails with the following error:Failure in acquiring Microsoft Entra Token:

Provider Error 3399614468: AADSTS650057: Invalid resource.

The client has requested access to a resource which is not listed in the requested permissions

in the client's application registration.

Client app ID: 632b3df-fb67-4d84-bdcf-b95ad541b5c8 (Azure VPN)

Resource value from request: 7a579821-9890-40f9-a758-c26c12d8cbc2.

Resource app ID: 7a579821-9890-40f9-a758-c26c12d8cbc2.

List of valid resources from app registration:

Trace ID: 6042eee5-2229-4ed5-8ea4-2dd92a751600

Correlation ID: 666f2edf-4944-467f-b832-109644394c36

Timestamp: 2025-07-31T14:12:31Z
What I’ve done so far:

Configured VPN Gateway and created P2S profile

Set authentication type to Microsoft Entra ID

Imported the profile into Azure VPN Client

Ensured users are granted access to the VPN

I suspect the issue is related to API permissions or app registration configuration for the Azure VPN client but I’m not sure how to properly fix it.

Question: How can I resolve this error and successfully connect to the Azure VPN Gateway using Entra ID authentication? Are there specific permissions or resource IDs that need to be configured in the app registration for P2S VPN?

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
Accepted answer
  1. Praveen Bandaru 6,850 Reputation points Microsoft External Staff Moderator
    2025-08-01T03:44:05.4933333+00:00

    Hello Abdelrhman Goma

    I understand that you are facing point-to-site connection issue.
    The error message you're seeing—AADSTS650057: Invalid resource—usually occurs when there's a mismatch between the Audience (resource ID) set in the VPN Gateway configuration and the permissions assigned to the Azure VPN Client app registration in Microsoft Entra ID. This means that the resource, if it exists, hasn't been set up in the tenant. The application should guide the user with steps for installing the app and adding it to Microsoft Entra ID. In development, this often points to a misconfigured test tenant or a typo in the requested scope name.

    Check the reference document: https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#handling-error-codes-in-your-application

    The Azure VPN Client is attempting to access a resource value that isn't covered by the app registration's permissions. This may happen if:

    • A custom app registration is being used with the Azure VPN Client.
    • The Audience value set in the VPN Gateway configuration doesn't match the app registration's resource ID.
    • The app registration lacks the necessary API permissions.

    You can follow the below steps to resolve your issue:

    Microsoft now offers a pre-registered app for the Azure VPN Client, making configuration easier and eliminating the need for manual app registration.

    • App ID (Client ID): 41b23e61-6c1e-4545-b367-cd054e0ed4b4
    • Audience value: Use the same App ID as above

    Please update your VPN Gateway configuration to set this App ID as the Audience. Make sure that the Audience value in the VPN Gateway is the same as the App ID of your custom app.

    Check the below public document:

    https://stackoverflow.com/questions/76409348/how-can-i-troubleshoot-the-aadsts650057-error-when-setting-up-vpn-client-connect

    https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant#enable-authentication

    https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-users-access

    Authorizing the Microsoft-registered Azure VPN Client app allows it to sign in and access user profile information. After that update the VPN gateway configuration

    Once you have updated, please download the VPN client profile again and re-import it into the Azure VPN Client.

    Hope the above answer helps! Please let us know do you have any further queries.

    Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.