如何将资源主体https://management.azure.net添加到Azure默认目录？解决调用Azure REST API时的AADSTS500011错误

I’ve run into this exact error before, so let’s clear up the confusion first: you don’t need to "install" the https://management.azure.net resource principal into your tenant. This is a core Microsoft-managed service that’s available to all Azure tenants by default. The error is almost always due to either an incorrect tenant ID in your config, or missing permissions/admin consent on your CDTester app registration.

Let’s walk through the fixes step by step:

1. Confirm Your Tenant ID is Correct #

The error mentions "sent your authentication request to the wrong tenant"—this is a red flag. Double-check that cfg.LoginTenantId is the GUID of your Azure AD tenant (not a domain name like yourcompany.onmicrosoft.com):

• In the Azure Portal, go to Azure Active Directory → Properties → Copy the "Tenant ID" (it’s a 36-character GUID).
• Or use Azure CLI to get your active tenant ID:

  az account show --query tenantId -o tsv
  

If you used a domain name instead of the GUID, that’s probably why the auth request is targeting the wrong tenant.

2. Fix Your Confidential Client Setup (Best for Service-to-Service Calls) #

Your initial confidential client code is actually correct, but you missed a critical step: granting admin consent to the app’s permissions. Here’s how to fix it:

1. Go to your CDTester app registration in the Azure Portal → API Permissions.
2. Click Add a permission → Select Azure Service Management from the list of Microsoft APIs.
3. Choose Application permissions (since this is a service principal, not a user-facing app) → The only available permission here maps directly to the .default scope you’re using in code.
4. Click Add permissions, then click Grant admin consent for [Your Tenant Name]—this is mandatory for service principals, as they can’t consent to permissions on their own.
5. Wait 5-10 minutes for permissions to propagate, then re-run your confidential client code.

3. Fix Interactive Authentication (If You Need User Context) #

If you still want to use interactive auth, here’s what to adjust:

1. In your CDTester app registration → API Permissions → Add Delegated permissions for Azure Service Management → Select user_impersonation.
2. Either grant admin consent for the tenant, or have your global admin user consent when prompted during login.
3. Ensure you’re using the correct scope in code:

   var authResult = await app
     .AcquireTokenInteractive(new[] { "https://management.azure.net/user_impersonation" })
     .ExecuteAsync();
   

Also, confirm the global admin account you’re logging in with is part of the tenant matching cfg.LoginTenantId—sometimes admins have access to multiple tenants, so make sure you select the right one during login.

4. Validate the Service Principal with Azure CLI #

To rule out code issues, test your service principal directly with Azure CLI:

az login --service-principal -u <CDTester Application ID> -p <CDTester Application Secret> --tenant <Your Tenant ID>

If this login succeeds, run az account list—if it returns your subscription details, then authentication and permissions are working, and the issue is likely a typo in your code’s configuration.

Key Takeaways #

• The https://management.azure.net resource is pre-installed in all Azure tenants—no need to manually add it.
• Admin consent is required for service principals to use application permissions.
• Always use the tenant GUID (not domain name) in your auth configuration.

内容的提问来源于stack exchange，提问作者Modern Ronin