AADSTS650052 The app needs access to a service (https://aks-aad-server.azure.com) that your organization
xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx has not subscribed to or enabled.
Contact your IT Admin to review the configuration of your service
subscriptions
To resolve the above error, please check the below workarounds
While registering the application in Azure AD, check the supported
account type you have selected
If you selected “single tenant” you can’t login to your application
from different tenant
To access your application from different tenant update supported
account type to “multi-tenant”
To know how to do that in detail refer this link:
https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant#update-registration-to-be-multi-tenant
After registering the application, navigate to Exposing an API
and set App ID URI and Add required scopes such as read, user
impersonation etc.
Add Client ID of your Application to knownClientApplications
parameter in the Manifest
Your admin needs to accept the consent prompt to access this application use the below URL by updating the ClientID parameter with your application client-id
https://login.microsoftonline.com/common/oauth2/authorize?client_id=1a8e25b8-xxxx-xxxx-xxxx-xxxxxxxxxxxx&prompt=admin_consent&response_type=code
When your admin granted those permission, you can login to your
application successfully
Reference :
https://learn.microsoft.com/en-us/answers/questions/28697/invalid-client-aadsts650052-the-app-needs-access-t.html
User.Read
scope which redirects me to aks-aad-server.azure.com, I fixed this after azure support helps me.