# Logstash authenticating Error inAAD

**URL:** <https://discuss.elastic.co/t/logstash-authenticating-error-inaad/376627>\
**Category:** Logstash\
**Created:** [April 1, 2025, 9:37am UTC](https://discuss.elastic.co/t/logstash-authenticating-error-inaad/376627 "2025-04-01T09:37:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![LUMAL](https://avatars.discourse-cdn.com/v4/letter/l/7c8e57/32.png) [@LUMAL](https://discuss.elastic.co/u/LUMAL)\
**Post date:** [April 1, 2025, 9:37am UTC](https://discuss.elastic.co/t/logstash-authenticating-error-inaad/376627/1 "2025-04-01T09:37:56Z")

</div>

I´m using Logstash to ingest information in Auxiliary logs and Sentinel the problem I have is that I´m receiving a \*Error while authenticating with AAD [Excon::Error::BadRequest: '400', Response: '{"error":"unauthorized\_client","error\_description":"AADSTS700016: Application with identifier 'XXXXXXX' was not found in the directory.  
I have reviewed the AAD and it seems the App Id of the application sent by Logstash to Entra ID is not valid. Do you know how I can solve this issue? Is there any configuration to review?