AADSTS7000218 — "The request body must contain the following parameter: 'client_assertion' or 'client_secret'." The token endpoint expected the app to authenticate itself (as a confidential client) but the request carried no secret or assertion. This typically hits public-client flows — device code, ROPC, native-app refresh — when the app registration is not flagged to allow public client flows.
AADSTS7000218
Request must contain client_assertion or client_secret
What it means
Common causes
The app registration's 'Allow public client flows' setting is No while the app uses device code flow, ROPC or other public-client grants.
A confidential-client flow genuinely missing the secret/assertion in the POST body (wrong parameter name, empty config value).
The wrong app registration is used — a web-app registration for what is actually a native/CLI client.
How to fix it
For public clients: Entra admin center > App registrations > (app) > Authentication > Advanced settings > Allow public client flows > Yes.
For confidential clients: include
client_secret(URL-encoded) or aclient_assertionJWT in the token request body — not in the query string.Review the registration type: interactive CLIs and desktop apps should use a public client registration with the appropriate redirect URIs, not a web platform config with secrets baked in.