invalid_target / AADSTS9010010 — Entra rejects the resource parameter
Entra's v2.0 endpoints reject the RFC 8707 resource parameter — and MCP clients send resource on every request, set to the server's protected-resource identifier.
npx mcpcomp entra --within-days 30Reads app-registration credential expiry through @azure/identity and the Graph SDK; --rotate adds a replacement secret with no downtime.
What the error means
AADSTS9010010 is Entra rejecting the resource value. The documented trigger is a client sending resource together with scopes it read from a different metadata document — VS Code does this (microsoft/vscode#321249) — so the pairing is refused before the consent screen.
How to diagnose it
Read the resource value the client will send
MCPComp reports the PRM resource and checks it is an https identifier with no query or fragment, and reports the scopes_supported it found. Entra expects scopes in the api://{application-id}/{scope} form; a mismatch between that form and what a client sends is the fingerprint to look for.
Watch the credential, not only the metadata
Entra deployments also fail when the client secret lapses, with no metadata change at all. mcpcomp entra reads expiry through Microsoft's Graph SDK and can rotate a secret before it does.
Frequently asked questions
Can I stop clients sending resource?
No — the MCP spec requires it. The documented mitigation is on the scope side: publish scopes_supported in the api://{id}/{scope} form Entra expects so the pairing is consistent, and verify against your tenant — our evidence base records the failure, not a confirmed one-line fix.