auth: { clientId: ClientId, authority: `https://${TenantId}.ciamlogin.com/${TenantId}/v2.0`, instance: `https://${TenantId}.ciamlogin.com/${TenantId}/v2.0`, tenantId: TenantId, callbackPath: "http://localhost:3000", clientSecret: 'xxxxxxxxxxxxxxxxxxxxx', redirectUri: "http://localhost:3000" } This is my configuration to authenticate from react app and i configured two applications for react and my web API both are connected and scopes are defined when i accessing pi://<backen-api-id>/ToDoList.Read its giving AADSTS500207: The account type can't be used for the resource you're trying to access. when i changing application type to single tenant or trying with empty scope it is working fine what was the issue ?

Hi @Shashika Edirisingha Thank you for posting this in Microsoft Q&A. I understand you are encountering an authentication issue with React when using the application type as multi-tenant in external tenants. AADSTS500207: The account type can't be used for the resource you're trying to access. when i changing application type to single tenant or trying with empty scope it is working fine what was the issue? As of today, accessing API of workforce tenant from external tenant (CIAM User) is not supported. Meanwhile, we suggested a workaround for this issue: use an external ID for Workforce tenants, which allows for B2B collaboration. This would be the same as the External ID in External tenants (CIAM), but the users will be hosted in the same production tenant as guest users. However considering the feature to be new, we are open for feedback and request you to post this as an idea on our feedback forum so that it could be visible to the service engineering team. Similar issue discussed earlier in Microsoft Q&A platform: https://learn.microsoft.com/en-us/answers/questions/1665201/how-to-give-external-customer-accounts-in-a-entra User shared an idea on our feedback forum https://feedback.azure.com/d365community/idea/a02a5bb4-4b13-ef11-9899-6045bd824b24 Appreciate if you could upvote and comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature. Hope this helps. Do let us know if you any further queries. Thanks, Navya. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Authentication issu with react

Accepted answer

Navya 12,570 Reputation points Microsoft Vendor

2024-08-08T02:23:08.2933333+00:00

Hi @Shashika Edirisingha

Thank you for posting this in Microsoft Q&A.

I understand you are encountering an authentication issue with React when using the application type as multi-tenant in external tenants.

AADSTS500207: The account type can't be used for the resource you're trying to access. when i changing application type to single tenant or trying with empty scope it is working fine what was the issue?

As of today, accessing API of workforce tenant from external tenant (CIAM User) is not supported.
Meanwhile, we suggested a workaround for this issue: use an external ID for Workforce tenants, which allows for B2B collaboration. This would be the same as the External ID in External tenants (CIAM), but the users will be hosted in the same production tenant as guest users.

However considering the feature to be new, we are open for feedback and request you to post this as an idea on our feedback forum so that it could be visible to the service engineering team.

Similar issue discussed earlier in Microsoft Q&A platform: https://learn.microsoft.com/en-us/answers/questions/1665201/how-to-give-external-customer-accounts-in-a-entra

User shared an idea on our feedback forum https://feedback.azure.com/d365community/idea/a02a5bb4-4b13-ef11-9899-6045bd824b24 Appreciate if you could upvote and comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Please sign in to rate this answer.
Shashika Edirisingha 45 Reputation points

2024-08-08T02:33:36.67+00:00

Currently I'm using entra external id for the users and try allow them to login via react application with the scoping to back end application scopes (for application roles) this is giving this AADSTS500207: The account type can't be used for the resource you're trying to access. error. According to your answer for now we can't grant permission to external tenant user's to access the back end application scope when they authenticating from a front end application if I'm wrong please correct me and is there any other solution for this to handle this scenario.

Also I tried with

https://login.microsoftonline.com/common/

this as the authority url this was successfully issues me the token but the thing is when i using this we can't use the personal accounts and says to use work or school accounts,

this https://learn.microsoft.com/en-us/answers/questions/1792222/aadsts500207-the-account-type-cant-be-used-for-the is very same to my issue and there is no answer for that.

waiting for your valuable response

Navya 12,570 Reputation points Microsoft Vendor

2024-08-08T03:17:09.1466667+00:00

Hi @Shashika Edirisingha

Thank you for following up on this.

The authority URLhttps://login.microsoftonline.com/commonfor applications processing accounts in any organizational directory (any Microsoft Entra directory) and personal Microsoft accounts (such as Skype, Xbox) that serves across all Microsoft Entra tenants, acting as a central hub that handles requests.

CIAM/Entra external id application only supports applications configured for single tenant applications. Both backend and front applications must be registered as single tenant and the authority URL should be like https://<tenant_id>.ciamlogin.com/<tenant_id>/v2.0

Hope this helps. Do let us know if you any further queries.

Shashika Edirisingha 45 Reputation points

2024-08-08T04:33:37.1566667+00:00

yes in my configurations i configured both applications to be in same tenant and after that i added two users one is or my gmail and one is for my work account which in in another tenant for my back end and front end both application selected multi tenant option not the personal type. when i login from front end with the scope of api://<backen-api-id>/ToDoList.Read like this it is returning AADSTS500207: The account type can't be used for the resource you're trying to access. both users are in member user type. When i removing this scope and try to login with empty scope it is login successfully with claiming only for front end application. I configured user flow also and registered front end application as a trusted application in backend as well those all things correctly configured and this is working fine when i change application types to accept uses only in this azure directory. this issue is only for multi tenant option.

When i checking the documentation examples it also mentioned to select azure accounts only in this directory option there is no any example with multi tenants option since couple of days I'm trying to solve this.

Navya 12,570 Reputation points Microsoft Vendor

2024-08-08T05:50:43.9533333+00:00

Hi @Shashika Edirisingha

Currently, CIAM/Entra External tenant application registration is only supported for single-tenant configurations (Always use Accounts in this organizational directory only), not supported in multi-tenant options. For more information about supported features in external tenants: https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers

Appreciate if you could share the feedback on our feedback channel https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789 Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

Hope this helps. Do let us know if you any further queries.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Authentication issu with react

0 additional answers

Your answer