title: Azure AD exception - AADSTS50105 - "The signed in user is not assigned to a role for the application"
body: <p>I'm setting up authentication with Azure AD for an ASP.NET Web API 2 REST API.  I'd like all clients to be able to use a username &amp; password to authenticate with the REST API.  I've setup Azure AD (full steps below, but essentially - created a directory, added a user, added an application, added roles to application in manifest, assigned user to application).   However, when I try to test via a Console Application (full code at bottom), I get the exception:</p>
  
  <p>An unhandled exception of type '<code>Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException</code>' occurred in Microsoft.IdentityModel.Clients.ActiveDirectory.dll</p>
  
  <p>Additional information: AADSTS50105: The signed in user 'test@azureadwebapitest.onmicrosoft.com' is not assigned to a role for the application '8ed6bbe9-dce7-4bed-83af-aa5472ac4eef'.</p>
  
  <p><a href="https://i.stack.imgur.com/qIfMd.png"><img src="https://i.stack.imgur.com/qIfMd.png" alt="enter image description here"></a></p>
  
  <p>I'm guessing something needs to be tweaked in the Manifest, but I don't know.  </p>
  
  <p>Here is the code:</p>
  
  <pre><code>using Microsoft.IdentityModel.Clients.ActiveDirectory;
  using System;
  
  namespace WebApiClientTest
  {
      class Program
      {
          static void Main(string[] args)
          {
              const string authorityUri = "https://login.microsoftonline.com/azureadwebapitest.onmicrosoft.com/";
              const string resource = "https://azureadwebapitest.onmicrosoft.com/test";
              const string clientId = "8ed6bbe9-dce7-4bed-83af-aa5472ac4eef";
              const string userId = "test@azureadwebapitest.onmicrosoft.com";
              const string password = "[REMOVED for StackOverflow post]";
  
              UserCredential credentials = new UserCredential(userId, password);
              AuthenticationContext context = new AuthenticationContext(authorityUri);
              var authresult = context.AcquireToken(resource, clientId, credentials);
              Console.WriteLine("Access token: {0}", authresult.AccessToken);
              Console.ReadLine();
          }
      }
  }
  </code></pre>
  
  <p>Full repro steps below:</p>
  
  <p><strong>1. Create new Azure AD Directory:</strong></p>
  
  <p><a href="https://i.stack.imgur.com/NXGOz.png"><img src="https://i.stack.imgur.com/NXGOz.png" alt="enter image description here"></a></p>
  
  <p><strong>2. Add new Application:</strong></p>
  
  <p><a href="https://i.stack.imgur.com/HnqNy.png"><img src="https://i.stack.imgur.com/HnqNy.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/kOWVo.png"><img src="https://i.stack.imgur.com/kOWVo.png" alt="enter image description here"></a></p>
  
  <p><strong>3. Set "User assignment required to access app" to "YES".  Set "Read directory data" application permissions.  Copy client ID. Save:</strong></p>
  
  <p><a href="https://i.stack.imgur.com/BENsL.png"><img src="https://i.stack.imgur.com/BENsL.png" alt="enter image description here"></a></p>
  
  <p><strong>4. Download manifest.  Edit manifest and add two roles.  Upload manifest:</strong></p>
  
  <p><a href="https://i.stack.imgur.com/LiBuY.png"><img src="https://i.stack.imgur.com/LiBuY.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/tPzL6.png"><img src="https://i.stack.imgur.com/tPzL6.png" alt="enter image description here"></a></p>
  
  <p><strong>5. Go back to directory from step 1 and Add User</strong></p>
  
  <p><a href="https://i.stack.imgur.com/v5NR0.png"><img src="https://i.stack.imgur.com/v5NR0.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/ZrT55.png"><img src="https://i.stack.imgur.com/ZrT55.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/qohOv.png"><img src="https://i.stack.imgur.com/qohOv.png" alt="enter image description here"></a></p>
  
  <p><strong>6. Open new browser to <a href="https://account.activedirectory.windowsazure.com/">https://account.activedirectory.windowsazure.com/</a> and sign in as user.  Change password.  Notice no applications available:</strong></p>
  
  <p><a href="https://i.stack.imgur.com/BMGsB.png"><img src="https://i.stack.imgur.com/BMGsB.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/DdPIT.png"><img src="https://i.stack.imgur.com/DdPIT.png" alt="enter image description here"></a></p>
  
  <p><strong>7. Go back to Classic Portal.  Assign the user to the generalclient role in Application.  Notice the user is now assigned to the application</strong></p>
  
  <p><a href="https://i.stack.imgur.com/PsLme.png"><img src="https://i.stack.imgur.com/PsLme.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/dmiRK.png"><img src="https://i.stack.imgur.com/dmiRK.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/UnoxT.png"><img src="https://i.stack.imgur.com/UnoxT.png" alt="enter image description here"></a></p>
  
  <p><strong>8. Go back to user account portal and refresh. You might have to refresh a few times or click around.  Notice the application is now shown</strong></p>
  
  <p><a href="https://i.stack.imgur.com/TyPcr.png"><img src="https://i.stack.imgur.com/TyPcr.png" alt="enter image description here"></a></p>
  
  <ol start="9">
  <li><p>It seems at this point, setup should be complete.</p></li>
  <li><p>Create a new console application.</p></li>
  <li><p>Install the Nuget package "Microsoft.IdentityModel.Clients.ActiveDirectory"</p></li>
  <li><p>Copy the code into the console application (top of post), insert your password into the "password" string, and Start Debugging:</p></li>
  </ol>
  
  <p><strong>Result:</strong></p>
  
  <p>An unhandled exception of type '<code>Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException</code>' occurred in Microsoft.IdentityModel.Clients.ActiveDirectory.dll</p>
  
  <p>Additional information: AADSTS50105: The signed in user 'test@azureadwebapitest.onmicrosoft.com' is not assigned to a role for the application '8ed6bbe9-dce7-4bed-83af-aa5472ac4eef'.</p>
  
  <p><strong>Expected Result:</strong></p>
  
  <p>The access token is written to the console output.</p>