# Error: 400 invalid_request (Microsoft 365)

Source: https://catalystgroup.gg/docs/email-delivery/error-400-invalid-request/
Updated: 2026-10-19 · By Duane Garner

Microsoft refused the token request because a value in it is missing or wrong, usually the Tenant ID or the Application (Client) ID.

This article is for sites using the **365 / Outlook** mailer where sending fails because Microsoft answered the token request with HTTP 400 and `invalid_request`.

 

> **The error as you see it:** `Microsoft 365 token request failed: invalid_request` (often followed by a code such as `AADSTS90002`, `AADSTS900023` or `AADSTS900144` and a short reason)
>  
> Shown by the **365 / Outlook** mailer, in the failed-send banner, in **Tools → Debug Events** and in the **Email Log**.

 

## What this error means

 

The plugin signs in to Microsoft Entra ID with the app's credentials to get an access token, then uses the token to send through Microsoft Graph. `invalid_request` with status 400 means Microsoft could not process the sign-in request at all, because something in it is missing or does not make sense. No email was attempted. The AADSTS code after it tells you which value is at fault:

 

| Code | What it points to |
| --- | --- |
| AADSTS90002 | The tenant in Tenant ID does not exist. |
| AADSTS900023 | Tenant ID is neither a valid ID nor a valid domain. |
| AADSTS900144 | A required value, usually the client ID, is empty. |

 

## Common causes

 
- **A typo in Tenant ID**, or a value copied from the wrong field (for example the Object ID or the subscription ID).
- **A domain in Tenant ID that is not part of your tenant**, or that was removed from it.
- **An empty or mistyped Application (Client) ID**, sometimes with a stray space or line break from copying.
- **Constants in wp-config.php** that override the settings page with outdated values.

 

## How to fix

 
1. Read the full code
  Open **CRM-NG SMTP → Tools → Debug Events** and find the newest **Email Sending Errors** entry. Note the AADSTS code.
2. Open your app registration
  Go to `https://entra.microsoft.com/`, then **Identity → Applications → App registrations**, and open the app you made for this site.
3. Copy the IDs
  On **Overview**, copy **Directory (tenant) ID** and **Application (client) ID**. Use the copy buttons beside them rather than selecting the text by hand.
4. Check the secret too
  Under **Certificates & secrets**, make sure the secret you use is listed and not expired. If you are unsure, create a new client secret and copy its **Value** (not the Secret ID) straight away.
5. Update CRM-NG SMTP
  In **CRM-NG SMTP → Settings → General**, with **365 / Outlook** selected, paste **Tenant ID** and **Application (Client) ID**. If you made a new secret, use **Remove Client Secret** and paste the new value into **Client Secret**. Press **Save Settings**.
6. Check for constants
  If a field cannot be edited, it is set by a `CRMNG_SMTP_*` constant in `wp-config.php`. Correct it there.
7. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test**, fill in **Send To** and press **Send Email**.

 

## Verify it worked

 

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." and a copy sits in the From Email mailbox's **Sent Items**.

 

## Notes

 
- If the error instead says `invalid_client`, the client secret is wrong or expired. The most common slip is pasting the Secret ID instead of the secret's **Value**; the plugin's own hint reads "Use the secret Value (not the Secret ID)."
- `AADSTS50194` has its own article: [AADSTS50194: single-tenant application](https://catalystgroup.gg/docs/email-delivery/error-aadsts50194-single-tenant/).

 

## Related

 
- [Microsoft 365 / Outlook](https://catalystgroup.gg/docs/email-delivery/mailer-microsoft-365/)
- [Error: AADSTS50194: single-tenant application (Microsoft 365)](https://catalystgroup.gg/docs/email-delivery/error-aadsts50194-single-tenant/)
- [Error: InvalidAuthenticationToken: token expired (Microsoft 365)](https://catalystgroup.gg/docs/email-delivery/error-invalid-authentication-token/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)