Unable to locate client ID in Microsoft Entra admin center

Search the exact client ID under Entra ID → Enterprise applications → All applications first, because the app registration may be owned by another directory while only its local service principal exists in the directory currently selected.

1. Search the local service principal

1. In the Microsoft Entra admin center, switch to the directory used by the account that currently signs into the app.
2. Go to Entra ID → Enterprise applications → All applications.
3. Set Application Type to All Applications.
4. Set Application ID starts with to the complete 8c6... client ID, and select Apply.

Enterprise applications are service principals—the local representations of applications used in that tenant. App registrations are application objects and exist only in their home tenant.^1^ The portal’s default filters can otherwise hide Microsoft applications or other application types.^2^

2. Query both object types by client ID

Since the previous portal-based solution did not locate it, query Microsoft Graph directly. Replace the placeholder with the complete GUID:

Connect-MgGraph -Scopes "Application.Read.All"

$clientId = "8c6xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Get-MgApplication -Filter "appId eq '$clientId'" |
    Format-List Id,DisplayName,AppId,SignInAudience,PublisherDomain

Get-MgServicePrincipal -Filter "appId eq '$clientId'" |
    Format-List Id,DisplayName,AppId,AppOwnerOrganizationId,ServicePrincipalType

Get-MgApplication supports filtering on AppId; Application.Read.All is one of its documented delegated permissions.^3^ Microsoft also documents filtering service principals with Get-MgServicePrincipal -Filter "appId eq '{AppId}'".^1^

Interpret the results as follows:

• Application object found: the selected directory contains the app registration—open App registrations and search for that client ID.
• Only service principal found: the app is used in the selected directory but its registration is owned elsewhere. AppOwnerOrganizationId provides the home-organization clue. Switch to that directory if your account has access.
• Neither found: the selected directory has neither the registration nor a local service principal. Repeat the query after switching through every directory accessible to the account that originally created the app. A comparable case was resolved by switching to the directory where the application had actually been registered.^4^
• Authorization or consent error: this is a permissions problem, not evidence that the objects do not exist. Have an administrator grant an appropriate directory-read permission or run the lookup.

Do not use an ID token’s tid claim as proof of the app registration’s home tenant. It identifies the token issuer/user tenant; for a multitenant application, that can be a tenant containing only a local service principal. Likewise, do not log or share access, refresh, or ID tokens.

If it remains undiscoverable

The toolkit constructor expects the registered client ID supplied by your application; it does not establish that the ID belongs to a toolkit-owned OneDrive registration.^5^ If no accessible directory contains the application object, the registration may belong to an old organizational directory or account to which access has been lost.

Because the current ID still works, avoid replacing it immediately. First record its current scopes, supported account types, redirect URI, and observed sign-in behavior. If ownership cannot be recovered, create a new registration under a directory you control, configure the required account types and desktop redirect URI, then update and test the WinUI application before retiring the old ID.^6^

References

1. Application and service principal objects in Microsoft Entra ID
2. Quickstart: View enterprise applications
3. Get-MgApplication-Description
4. How to figure out account email for app given client id in entra ID? - Microsoft Q&A
5. MsalProvider Constructors-Definition
6. Quickstart: Sign in users and call Microsoft Graph in a Universal Windows Platform app