IDX10214: Audience validation failed.

8.x shortens the text to "IDX10214: Audience validation failed. See https://aka.ms/identitymodel/app-context-switches"; 6.x and 7.x (checked on 6.36.0 and 7.7.1) list the token's audiences and the configured values. ASP.NET Core sends `error_description="The audience '…' is invalid"`.

Microsoft.IdentityModel.Tokens (.NET) — SecurityTokenInvalidAudienceException

What it means

The token's `aud` does not match `ValidAudience` / `ValidAudiences` (or, with `Audience` set on `JwtBearerOptions`, that value). The signature was fine; the token was issued for another recipient. In Microsoft Entra ID the classic mismatch is between the API's App ID URI (`api://…`, used in v1 tokens) and its client ID GUID (used in v2 tokens).

Why it happens

• App ID URI vs client ID

  common

  Entra ID puts the client ID into `aud` when the API's manifest requests v2.0 tokens (`requestedAccessTokenVersion: 2`, called `accessTokenAcceptedVersion` in the older manifest format), and the App ID URI for v1.0 tokens. An API configured with only one of the two rejects the other.

• The client requested a token for another API

  common

  Scopes decide the audience. A client asking for `User.Read` gets a Microsoft Graph token (`aud` = `https://graph.microsoft.com` or `00000003-0000-0000-c000-000000000000`), which your API must reject.

• Forwarding an ID token or a Graph token

  occasional

  Front ends sometimes send the ID token (audience = the client app) or the Graph token they already hold. Neither is meant for your API.

How to fix it

1. 1.

   List your API's identifiers explicitly

   Accept the client ID and the App ID URI of your API if both token versions are in use — nothing else.

   options.TokenValidationParameters = new TokenValidationParameters
   {
       ValidIssuer = "https://login.microsoftonline.com/<tenant-id>/v2.0",
       // Entra ID v2 tokens carry the client ID; v1 tokens the App ID URI. Accept exactly your API's identifiers.
       ValidAudiences = ["00000000-0000-0000-0000-000000000000", "api://orders"],
   };

2. 2.

   Request a scope of your API

   Tokens for `api://orders/Orders.Read` carry your API as audience. Expose a scope in the app registration and have clients request it.

   // Client: request a scope of YOUR API, not Microsoft Graph, so aud is your API.
   var result = await app.AcquireTokenSilent(new[] { "api://orders/Orders.Read" }, account).ExecuteAsync();

← Browse the full signature error database