What causes AADSTS165004?

Inner exception was stripped or truncated by the calling client (Power BI Service, ADF, Databricks connector) before it reached the user. Malformed or unexpected request payload to the /token or /authorize endpoint that Entra ID couldn't categorize under a specific AADSTS code. Conditional Access or session-level policy evaluation failure where the underlying reason is logged server-side only. Custom claims provider, token augmentation extension, or B2C custom policy throwing an unhandled runtime error. Transient Entra ID service issue where the specific sub-error wasn't surfaced to the response

How do I fix AADSTS165004?

Capture the full exception message and correlation ID from the failing client — in Power BI Service go to Settings → Refresh history → Show details; in ADF check the pipeline activity output JSON; the real AADSTS code lives there. Look up the Entra ID sign-in logs in the Azure portal (Entra ID → Sign-in logs) and filter on the correlation ID — the server-side entry contains the actual failure reason that 165004 is masking. If a custom policy, claims provider, or token augmentation extension is in use, check its runtime logs (App Insights / Function logs) for the exception that bubbled up as 165004. Retry the operation once — if 165004 disappears without code changes it was a transient Entra ID runtime issue and no action is needed. If the inner exception points to a specific AADSTS code (e.g. 50105, 700016, 90072), follow the troubleshooting for that code instead — 165004 itself is not actionable

Low severityauthentication

Power BI Error:
AADSTS165004

What does this error mean?

Generic Azure AD/Entra ID error wrapper — the real failure is in the inner exception, not in 165004 itself.

Common causes

1Inner exception was stripped or truncated by the calling client (Power BI Service, ADF, Databricks connector) before it reached the user
2Malformed or unexpected request payload to the /token or /authorize endpoint that Entra ID couldn't categorize under a specific AADSTS code
3Conditional Access or session-level policy evaluation failure where the underlying reason is logged server-side only
4Custom claims provider, token augmentation extension, or B2C custom policy throwing an unhandled runtime error
5Transient Entra ID service issue where the specific sub-error wasn't surfaced to the response

How to fix it

1Capture the full exception message and correlation ID from the failing client — in Power BI Service go to Settings → Refresh history → Show details; in ADF check the pipeline activity output JSON; the real AADSTS code lives there
2Look up the Entra ID sign-in logs in the Azure portal (Entra ID → Sign-in logs) and filter on the correlation ID — the server-side entry contains the actual failure reason that 165004 is masking
3If a custom policy, claims provider, or token augmentation extension is in use, check its runtime logs (App Insights / Function logs) for the exception that bubbled up as 165004
4Retry the operation once — if 165004 disappears without code changes it was a transient Entra ID runtime issue and no action is needed
5If the inner exception points to a specific AADSTS code (e.g. 50105, 700016, 90072), follow the troubleshooting for that code instead — 165004 itself is not actionable

Frequently asked questions

What does AADSTS165004 mean?

Actual message content is runtime specific. Please see ret

How do I fix this error?

Check your application registration, token configuration, and user permissions in the Azure portal. Review Conditional Access policies if the error is policy-related.

Source · learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes