title: Powrshell Set-AIPAuthentication returns "error":"invalid_client"
body: <p>I have strictly followed the Application Registration for AIP Scanner detailed on the following link.</p>
  <p><a href="https://docs.microsoft.com/en-us/azure/information-protection/rms-client/client-admin-guide-powershell#how-to-label-files-non-interactively-for-azure-information-protection" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/information-protection/rms-client/client-admin-guide-powershell#how-to-label-files-non-interactively-for-azure-information-protection</a></p>
  <p>But every time i ran the following command I get an Authentication Error.</p>
  <pre><code>    Set-AIPAuthentication -WebAppId &quot;xxxxxx-xxxx-xxxx-xxxx-xxxxxx&quot; -WebAppKey &quot;xxxxx/xxx/xxxx&quot; -NativeAppId &quot;xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx&quot;
      Set-AIPAuthentication : Unable to authenticate and setup Microsoft Azure Information Protection
      At line:1 char:1
      + Set-AIPAuthentication -WebAppId &quot;eb10438f-d9bb-4cb1-946a-007223bcaaf4 ...
      + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          + CategoryInfo          : AuthenticationError: (:) [Set-AIPAuthentication], PowershellException
          + FullyQualifiedErrorId : Microsoft.InformationProtection.Powershell.AIP.Commandlets.SetAIPAuthenticationCmdLet
  </code></pre>
  <p>On Fiddler I can see the following response when Authenticating against Azure AD</p>
  <pre><code>{
    &quot;error&quot;: &quot;invalid_client&quot;,
    &quot;error_description&quot;: &quot;AADSTS7000218: The request body must contain the following parameter: client_assertion or client_secret.\r\nTrace ID: 9859831a-e097-41df-933e-ead751464601\r\nCorrelation ID: 671215c0-0656-44bb-a4a9-fd1f4353fd37\r\nTimestamp: 2020-11-10 14:35:53Z&quot;,
    &quot;error_codes&quot;: [
      7000218
    ],
    &quot;timestamp&quot;: &quot;2020-11-10 14:35:53Z&quot;,
    &quot;trace_id&quot;: &quot;9859831a-e097-41df-933e-ead751464601&quot;,
    &quot;correlation_id&quot;: &quot;671215c0-0656-44bb-a4a9-fd1f4353fd37&quot;,
    &quot;error_uri&quot;: &quot;https://login.microsoftonline.com/error?code=7000218&quot;,
    &quot;claims&quot;: &quot;{\&quot;access_token\&quot;:{\&quot;capolids\&quot;:{\&quot;essential\&quot;:true,\&quot;values\&quot;:[\&quot;2016b1b4-bae5-44f2-abea-01dd12217771\&quot;]}}}&quot;
  }
  </code></pre>
  <p>Which step on this guide I missed? and how do I troubleshoot it on Azure side? I can guarantee after 100 tests that WebAppID, WebAppKey and NativeAppId are ok. As far I can see it, I am not able to go further the first step on this OAUTH On-behalf flow.</p>