Unable to Setup the Automation Task - Start and Stop for Azure VM

Hello Maxime Dousset,

Thank you for reaching out with this detailed information. The error message InvalidAuthenticationTokenTenant provides a very specific and helpful clue, indicating that the authentication token being used is from the wrong Azure Active Directory (AAD) tenant.

Based on the error details, the following troubleshooting steps should help you resolve the issue and successfully set up your automation task.

Solution / Troubleshooting Steps

1. Re-authenticate with the Correct Tenant
   • Edit the connection used by the Power off virtual machine action.
   • Ensure it uses the authority URL matching the subscription’s tenant: https://login.windows.net/5e28ae04-9985-436a-b5bf-2c2314bd2cd2
   • If using an Automation Account, re-import the Run As connection or recreate the connection.
2. Verify Tenant–Subscription Association
   • In Azure Portal → Subscriptions → [Your Subscription] → Properties, check the Directory (Tenant) ID.
   • Make sure your automation resource (Logic App or Automation Account) is in the same directory or granted cross-tenant permissions.
3. Handle Recent Transfers
   • If the subscription was recently transferred, wait 30–60 minutes for propagation, then retry.
4. Use Managed Identity (Preferred)
   • If possible, assign a System-assigned Managed Identity to your Logic App or Automation Account.
   • Grant that identity the Contributor role on the VM’s resource group or subscription.
   • Reconnect the “Power off virtual machine” action using the Managed Identity—this avoids hardcoding tenant tokens.
5. Double-check Role Assignments
   • Finally, ensure the service principal or identity you are using has the necessary permissions.
   • Confirm that it has at least Contributor or Virtual Machine Contributor access on the virtual machine or the resource group where the VM resides.

Documentation & References:

• Troubleshoot “InvalidAuthenticationTokenTenant” error
• Move resources between tenants or subscriptions
• Use managed identity for Logic Apps
• Azure Automation Run As account authentication

If the above steps don’t resolve the issue, could you confirm:

• Whether the subscription was recently moved between tenants?
• Which authentication method your Logic App or Automation Account is currently using?
• Have you tried re-creating or re-authenticating the Azure Resource Manager connection?

This will help narrow down whether it’s a token mismatch or a tenant propagation delay.

I hope these steps help you get your automation task running smoothly. Please let me know if the problem persists, and we can investigate further. Thank you!

I am also getting similar error when creating the automation task to start stop VM. How come I also see same tenant id here . just like the user above. f8cdef31-a31e-4b4a-93e4-5f571e91255a

For my account, I only have one default directory.

"error": { "code": "InvalidAuthenticationTokenTenant", "message": "The 'EvolvedSecurityTokenService' access token is from the wrong issuer 'https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/'. It must match the tenant 'https://sts.windows.net/6294d17c-113e-4df0-9558-9ebe8ee741b8/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/6294d17c-113e-4df0-9558-9ebe8ee741b8' to get the token. Note,Capture.PNG