# Keycloak + Entra Id Request to endpoint HTTPStatusCode 400

**URL:** <https://forum.keycloak.org/t/keycloak-entra-id-request-to-endpoint-httpstatuscode-400/31356>\
**Category:** Miscellanaeous\
**Created:** [May 5, 2026, 6:51am UTC](https://forum.keycloak.org/t/keycloak-entra-id-request-to-endpoint-httpstatuscode-400/31356 "2026-05-05T06:51:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hermanthotan](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/hermanthotan/32/12568_2.png) [@hermanthotan](https://forum.keycloak.org/u/hermanthotan)\
**Post date:** [May 5, 2026, 6:51am UTC](https://forum.keycloak.org/t/keycloak-entra-id-request-to-endpoint-httpstatuscode-400/31356/1 "2026-05-05T06:51:04Z")

</div>

I have web app configure Keycloak with EntraID, when login with the email address is success but from the network it capture HttpStatusCode 400  
https://{domain}/identity/realms/cwos-stg-entraid/broker/Azure/endpoint?code=xxxxxx  
Payload consist of code, state & session\_state

Any guide how to debug this error

---

<div class="post-metadata">

**Author:** ![danilopiazza](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/danilopiazza/32/11639_2.png) [@danilopiazza](https://forum.keycloak.org/u/danilopiazza)\
**Post date:** [May 5, 2026, 3:12pm UTC](https://forum.keycloak.org/t/keycloak-entra-id-request-to-endpoint-httpstatuscode-400/31356/2 "2026-05-05T15:12:03Z")

</div>

If you are using OpenID Connect, you can switch on the “Store Tokens” and “Stored Tokens Readable” in your Identity Provider configuration, and then invoke the [Keycloak API to retrieve external IdP tokens](https://www.keycloak.org/docs/latest/server_admin/index.html#retrieving-external-idp-tokens).

This allows you to retrieve the token issued by EntraID, and inspect its claims; this, in turn, may provide some help with debugging.