IDX10205: Issuer validation failed. Issuer: 'https://sts.windows.net/

The text continues with "Did not match: validationParameters.ValidIssuer: '…' or validationParameters.ValidIssuers: '…' or validationParameters.ConfigurationManager.CurrentConfiguration.Issuer: '…'". ASP.NET Core sends `error_description="The issuer '…' is invalid"`.

Microsoft.IdentityModel.Tokens (.NET) — SecurityTokenInvalidIssuerException

What it means

The token's `iss` is not equal to `ValidIssuer`, any entry of `ValidIssuers`, or the issuer from the downloaded OpenID configuration. The message prints the token's issuer and every value it was compared with. In Microsoft Entra ID the textbook case is a v1.0 token (`https://sts.windows.net/<tenant>/`) checked against the v2.0 issuer (`https://login.microsoftonline.com/<tenant>/v2.0`) or vice versa.

Why it happens

• Entra ID v1.0 token, v2.0 issuer (or the reverse)

  common

  The token version is decided by the API's app registration (`requestedAccessTokenVersion`), not by the endpoint the client used. An API that expects v2.0 receives v1.0 tokens until the manifest says otherwise.

• A token from another tenant

  common

  Multi-tenant apps receive tokens whose issuer contains the user's tenant ID. A single `ValidIssuer` accepts only one tenant; multi-tenant APIs need an issuer validator that checks the tenant against an allow-list.

• Spelling difference

  occasional

  Exact string comparison: trailing slash, upper-case host, `/v2.0` suffix, B2C policy path. Copy the value from the discovery document.

How to fix it

1. 1.

   Fix the token version at the source

   Setting `requestedAccessTokenVersion` to 2 in the API's manifest makes Entra ID issue v2.0 tokens with the `login.microsoftonline.com/…/v2.0` issuer.

   // App registration manifest of the API: issue v2.0 access tokens
   {
     "api": { "requestedAccessTokenVersion": 2 }
   }

2. 2.

   Accept both issuers during a migration

   List both forms of your own tenant's issuer — never accept arbitrary issuers to make the error go away.

   options.TokenValidationParameters = new TokenValidationParameters
   {
       ValidIssuers =
       [
           $"https://login.microsoftonline.com/{tenantId}/v2.0",
           $"https://sts.windows.net/{tenantId}/", // only while v1.0 tokens are still in circulation
       ],
   };

← Browse the full signature error database