Paste cryptic Microsoft 365 error codes or logs (like 0x80070005) to get instant human-readable translations, root causes, and fixes.
Loading Decoder Engine...
How the decoder works, and what it knows
The box above does not call any service. It scans whatever you paste — a hex code such as 0x80070005, an AADSTS number, an HTTP status, or a whole PowerShell or Power Automate run log — against the 22 entries listed on this page and shows the matching cards. Every entry is an error hit in a real production tenant, written up with what the message actually means, the root cause behind it, and the fix that worked. 0 of them link to the matching Microsoft Learn article so you can confirm the current guidance.
The catalogue is deliberately small. It is not a dump of every code Microsoft publishes; it is the short list that accounts for most support tickets on a SharePoint and Power Platform estate — throttling, expired or mis-scoped tokens, the list view threshold, locked files, consent errors, and the Power Automate conversion failures that only surface at runtime. If your error is not here, paste the exact sentence from the message rather than the surrounding log; the decoder matches on code, keyword and title, and the one-line error text is usually the strongest signal.
Jump to a service
SharePoint errors
429Too Many Requests (Throttling)
SharePoint has received too many requests from your account or tenant in a short period.
Root cause. You hit the SharePoint Online API usage limits. This often happens during bulk migrations, poorly optimized Power Automate loops, or aggressive SPFx API calls.
How to fix it
Implement exponential backoff in your code (wait and retry).
If using Power Automate, check the flow for "Apply to each" loops without concurrency control.
Batch your REST API requests where possible.
0x80070005Access Denied
You do not have the required permissions to perform the requested operation on the SharePoint resource.
Root cause. The user account or App Principal executing the request lacks Read, Write, or Full Control permissions on the specific Item, List, or Web.
How to fix it
Verify the user permissions using the SharePoint "Check Permissions" ribbon button.
If using an App-Only token, ensure the Azure AD app has Sites.ReadWrite.All or the specific site scopes.
Check if the item has unique permissions (broken inheritance).
ItemConflictSave Conflict
Your changes conflict with those made concurrently by another user (or workflow).
Root cause. You tried to update a SharePoint list item (via UI, REST, or Power Automate) but the item was modified by someone else since you first loaded it.
How to fix it
In code, fetch the latest item metadata and ETag before submitting the HTTP PATCH request.
In Power Automate, add a delay or retry policy, as another flow might be simultaneously updating the same item.
ListViewThresholdExceededThe attempted operation is prohibited because it exceeds the list view threshold
A query touched more than 5,000 items in a single list or library and was refused.
Root cause. The 5,000 limit is on items SCANNED, not items returned, so a filter matching three rows still fails if it has to read 20,000 to find them. The limit exists to protect the SQL layer from lock escalation and cannot be raised in SharePoint Online.
How to fix it
Add an index on the column being filtered or sorted, then re-run the query.
Index the column BEFORE the list passes 5,000 items — SharePoint may refuse to create an index on a list already over the limit, in which case filter to a smaller subset first.
In PnP PowerShell use Get-PnPListItem -PageSize so items are fetched in chunks.
In Power Automate, set pagination on the Get items action rather than raising Top Count.
Reconsider the structure: folders, or separate lists per year, keep any single view under the threshold.
423Locked — the file is checked out or being processed
A write to a file was rejected because SharePoint holds a lock on it.
Root cause. Either a user has it checked out, a co-authoring session is open, or SharePoint itself holds a short-lived lock after an upload while it indexes or runs a policy. Automation that uploads and immediately updates metadata hits the third case constantly.
How to fix it
Retry with a short backoff — service-held locks usually clear within seconds.
Check for an explicit checkout and use Set-PnPFileCheckedIn if appropriate.
Separate upload from metadata update rather than doing both in one tight sequence.
For libraries with required columns, expect the file to be locked as Checked Out until those columns are populated.
SPLoaderErrorWeb part fails to load after deployment
The web part shows a loading error on the page while working perfectly in the local workbench.
Root cause. The bundle cannot be fetched from where the manifest says it lives. Either the assets were never uploaded to the CDN or app catalogue path, the tenant CDN is disabled, or the solution was packaged without --ship so the manifest points at localhost.
How to fix it
Build with the ship flag so the manifest references the deployed asset location, not localhost.
Confirm the Office 365 CDN is enabled if the solution expects it (Get-SPOTenantCdnEnabled).
Check the browser network tab for the failing request — a 404 names the exact path being tried.
Re-deploy the package to the app catalogue and re-approve it; an updated bundle with an unchanged version number can be served stale.
Never change the component id to force a refresh — existing pages reference the old id and will render nothing.
Power Automate errors
ActionBranchingConditionNotSatisfiedAction Branching Condition Not Satisfied
Your flow execution skipped an action because the condition preceding it evaluated to false.
Root cause. This is usually an expected behavior indicating a "Condition" action (If Yes / If No) routed the flow away from the action you were looking at.
How to fix it
Check the run history of the flow.
Look at the immediately preceding Condition action to see why it evaluated to false.
Verify the data types in your condition (e.g., comparing a string "10" to an integer 10 will fail).
InvalidTemplateCannot Convert Primitive Value
The template validation failed: "Cannot convert a primitive value to the expected type 'Object'".
Root cause. You passed a simple string or number to an action input that requires a JSON object or array.
How to fix it
Check if you are passing a JSON string instead of an actual JSON object. Use the json() expression to parse it.
Ensure the dynamic content you selected is an Object, not a String property.
502Bad Gateway
The flow action failed with a 502 Bad Gateway error.
Root cause. The target service (e.g., SharePoint, SQL Server, custom API) took too long to respond, or the connector infrastructure experienced a temporary hiccup.
How to fix it
This is often transient. Configure a Retry Policy in the action settings (Settings > Retry Policy).
If querying a database or large SharePoint list, ensure the query is indexed and optimized so it returns faster.
RequestEntityTooLargeThe request entity is too large
An action tried to pass more data than the connector or the flow engine allows.
Root cause. File content moving through a flow counts against message size limits, and those limits are lower than most people expect. Reading a large file into a variable, or passing file content between several actions, multiplies the payload each time.
How to fix it
Avoid loading file content into variables; pass references and let the connector stream where possible.
For large SharePoint or OneDrive files, use chunked upload rather than a single content action.
Trim the payload with a Select action before passing collections between actions.
Split the work: one flow per file, triggered per item, rather than one flow handling a whole batch.
PaginationDisabledGet items returns only 100 rows
A flow silently processes only the first page of a list and reports success.
Root cause. The SharePoint Get items action defaults to a small page and does not warn when more rows exist. Raising Top Count alone does not help beyond the connector default — pagination has to be switched on in the action settings.
How to fix it
Open the action settings and enable Pagination, then set a threshold above your expected row count.
Remember the list view threshold still applies: filter on an indexed column for large lists.
Filter server-side with a Filter Query rather than retrieving everything and filtering in the flow.
Log the count of returned rows during testing so a truncated result is visible rather than silent.
A blue underline appears under a formula with a delegation warning.
Root cause. The formula contains a function (like Search() or complex Filters) that the data source (like SharePoint) cannot process on the server side. Power Apps will only download the first 500 records (by default) and process the formula locally.
How to fix it
Rewrite the Filter() to use delegable operators like "=" or "StartsWith()".
For SharePoint, avoid the "in", "Not", and complex logical operator groupings when dealing with large lists.
If the dataset is relatively small, you can increase the data row limit to 2000 in App settings.
Network ErrorNetwork error when using Patch function
Network error when using Patch function: "The requested operation is invalid".
Root cause. You are attempting to Patch a record but providing an invalid data structure, missing a required field, or providing a text value to a Lookup/Choice column without the correct object format.
How to fix it
For Choice columns, supply the structured record: { Value: "My Choice", '@odata.type': "#Microsoft.Azure.Connectors.SharePoint.SPListExpandedReference" }.
For Lookup columns, provide the Id and Value.
Ensure all required fields in the data source are included if creating a new record.
InvalidColumnNameThe specified column does not exist in Power Apps
A formula references a SharePoint column that Power Apps cannot see.
Root cause. Power Apps caches the list schema when the data source is added. Columns created or renamed afterwards are not visible until the data source is refreshed, and Power Apps uses display names where SharePoint uses internal names, so a rename breaks the link in both directions.
How to fix it
Refresh the data source from the Data pane after any column change.
Republish the app — refreshing in the studio does not update a published version.
Avoid renaming SharePoint columns once an app depends on them; add a new column instead.
For lookup and choice columns, reference the .Value property rather than the column directly.
Graph API errors
itemNotFoundItem Not Found
The resource could not be found.
Root cause. The ID provided for the user, group, site, list, or item does not exist, or the authenticated app does not have permission to see that it exists.
How to fix it
Double-check the resource ID in your Graph URL.
If you are absolutely sure the ID is correct, you likely have a permission scope issue. Graph returns 404 instead of 403 for some resources to prevent enumeration attacks.
Ensure your Azure AD app has the correct Application permissions (e.g., User.Read.All).
InvalidAuthenticationToken401 — Access token is empty, malformed or expired
Graph rejected the bearer token before looking at what you asked for.
Root cause. The token is missing, expired, sent without the Bearer prefix, or was issued for a different audience — a token minted for SharePoint or for your own API will not work against graph.microsoft.com even though it looks valid.
How to fix it
Confirm the Authorization header is exactly: Bearer <token>.
Decode the token and check the aud claim is https://graph.microsoft.com (or 00000003-0000-0000-c000-000000000000).
Check the exp claim — tokens are short-lived and need refreshing, not caching for hours.
In SPFx use the AadHttpClient or MSGraphClient so token acquisition is handled for you.
Authorization_RequestDenied403 — Insufficient privileges to complete the operation
The token authenticated fine, but does not carry the scope this call requires.
Root cause. The permission is missing from the app registration, or it was added but never granted admin consent, or the code requests a delegated permission while running app-only. A 403 here is about the app registration, not about the signed-in user.
How to fix it
Check the scp claim (delegated) or roles claim (application) in the decoded token for the permission you expect.
Grant admin consent in Entra ID — added permissions do nothing until consent is granted.
Remember delegated and application permissions are separate lists; an app-only call needs the application version.
After granting consent, acquire a NEW token; the old one does not gain the permission.
429Too Many Requests — Graph throttling
Graph is rate-limiting the application or the tenant.
Root cause. Graph applies per-app, per-tenant and per-resource limits. Tight loops, unbatched per-item calls and parallel workers all provoke it quickly.
How to fix it
Honour the Retry-After response header — it tells you exactly how long to wait.
Combine calls with the JSON batching endpoint (POST /$batch, up to 20 requests per batch).
Use delta queries instead of re-reading whole collections on a schedule.
Request fewer properties with $select so each call is cheaper.
Reduce concurrency rather than increasing it — parallelism makes throttling worse, not better.
Entra ID errors
AADSTS50011Reply URL Mismatch
The reply URL specified in the request does not match the reply URLs configured for the application.
Root cause. The redirect_uri passed by your application (e.g., in MSAL or SPFx) during login does not exactly match any of the Redirect URIs registered in the Azure Portal for that App ID.
How to fix it
Go to the Azure Portal > Microsoft Entra ID > App Registrations > [Your App] > Authentication.
Add the exact URL (including trailing slashes and http/https) your app is running from to the Redirect URIs list.
Wait a few minutes for the change to propagate.
AADSTS65001The user or administrator has not consented to use the application
Sign-in stopped because the requested permissions have never been consented to.
Root cause. The app is requesting a scope that requires consent it does not have. Either no one has consented, or the tenant requires admin consent for all apps and a user-level grant is not enough.
How to fix it
Grant admin consent from the app registration, or send an admin the /adminconsent URL.
Check whether the tenant has disabled user consent — if so, every new scope needs an administrator.
Ensure the scopes you request at runtime match the ones configured on the registration.
For SPFx, approve the corresponding request in the API access page of the SharePoint admin centre.
AADSTS700016Application not found in the directory
The client ID used to authenticate does not exist in the tenant being signed in to.
Root cause. Usually a single-tenant app being used against a different tenant, a client ID copied from the wrong environment, or an app registration that was deleted. It can also mean the service principal was never created in the target tenant for a multi-tenant app.
How to fix it
Verify the client ID against the app registration in the tenant you are signing in to.
Check the authority URL — /common, /organizations and /<tenant-id> behave differently for single-tenant apps.
For a multi-tenant app, have an administrator consent once in the target tenant so the service principal is created.
Confirm the registration still exists and was not soft-deleted.
AADSTS7000215Invalid client secret provided
The client secret sent during token acquisition was rejected.
Root cause. Almost always an expired secret, or the secret ID pasted where the secret VALUE was needed — the portal shows both and only reveals the value once. Trailing whitespace from a copy-paste is a close third.
How to fix it
Check the secret expiry date on the app registration; create a new one if it has lapsed.
Make sure you stored the Value, not the Secret ID.
Trim whitespace, and re-check any secret that passed through a YAML or .env file.
For unattended workloads prefer a certificate, or managed identity where available, over a secret that expires.
Frequently Asked Questions
It translates confusing, hexadecimal, or generic error messages thrown by Microsoft 365 services into clear explanations of what went wrong, the root cause, and step-by-step fixes. No more Googling "0x80070005" or "The remote server returned an error: (403) Forbidden."
The database includes common errors from: SharePoint Online, Power Automate, Power Apps, Microsoft Graph API, Microsoft Entra ID, Exchange Online, and PnP PowerShell.
Yes! Paste the raw text, JSON response, or PowerShell error output. The decoder scans the entire text for known error codes, HTTP status codes, and keywords to find a match. It handles correlation IDs, stack traces, and nested error objects.
Error 0x80070005 is "Access Denied" — the most common SharePoint error. It means the user or app does not have sufficient permissions. Root causes include: broken inheritance, missing API permissions in Azure AD, or the user not being in the correct SharePoint group.
HTTP 429 means "Too Many Requests" — you've hit Microsoft Graph's throttling limit. The response includes a Retry-After header. Implement exponential backoff: wait the specified seconds, then retry. Batch requests using $batch to reduce call volume.
This error occurs when a SharePoint list query tries to return or filter more than 5000 items without an indexed column. Fix: (1) add an index to your filter column, (2) narrow your query with additional filters, or (3) use CAML with RowLimit.
This error means the Form Digest / Request Digest has expired (default: 30 minutes). Get a fresh digest from /_api/contextinfo before making POST/PATCH/DELETE calls. In SPFx, the framework handles this automatically.