AADSTS500208: The domain is not a valid login domain for the account type.

Daniel Krzyczkowski 476 MVP

Hi,

I have MS Entra External ID preview tenant created. However, I noticed that I cannot authenticate successfully with the local account. Below I provide more details. I would be grateful for help/hints.

Describe the bug
When I try to login with corporate account or standard customer account (for instance using email from minutemailbox) I have below error displayed after authentication is completed:

There was an error trying to log you in: 'AADSTS500208: The domain is not a valid login domain for the account type.

To Reproduce
Steps to reproduce the behavior:

Open sign in page.
Create new account using using standard email like the one from minutemailbox service. Any account can be used, error is the same.
Try to authenticate with new account.
See error

Expected behavior
User should be authenticated successfully and tokens should be issued to the application.

My test tenant ID: 17444b8d-b055-4b48-8797-2c12f5b9b416

Few weeks ago I was able to successfully authenticate.

Thank you.

Matthew Keys 25 Reputation points

2023-09-15T16:37:56.71+00:00
EDIT: Oops, I see now there were comments on the answers below that I had missed that cover most of what I put here, but I'll leave it anyway in case there's anything useful

I'm having the same issue as the OP. The demo that sends you to jwt.ms appears to work, but when using it in my SPA using the MSAL library, I receive the AADSTS500208 error. Here are a few things I've tried and their results:

Environment Setup:

Create a new tenant for customers

Create a user flow with default options

Create a application

Configure my MSAL SPA with the clientId from step 3 and attempted with authorities below:

Using login.microsoftonline.com/{tenantId}, I am only able to log in with accounts that have the Global Administrator role. I tried signing in with invited AD accounts (guest and member), local, and social accounts. If the user does not have the role, it returns the originally mentioned error: "AADSTS500208: The domain is not a valid login domain for the account type."

Using {tenantName}.ciamlogin.com, I was unable to test the roles because it didn't prompt for AD accounts, so I tried this with local users and it gets a different error: "AADSTS500207: The account type can't be used for the resource you're trying to access."

13 answers

Daniel Krzyczkowski 476 Reputation points MVP

2024-02-09T06:51:40.95+00:00

Hi everyone, I would like to provide update on this thread as I was working together with Microsoft team and MVP Rory Braybrook to find the root cause of this issue.

First of all, here is the answer I got from the person from Microsoft:

Looking deeper this is a pretty generic error code - there are many ways you might end up miscoding the login domain such that you end up here. We have two fixes we'll be working on this quarter to help avoid this - fixing the issue Rory brought up where you get shown Entra ID configured samples in the App Registration pages and also updating the endpoints shown in the App Registration page which still point to login.onmicrosoft.com.

One more important thing is that samples were wrongly configured. You can read Rory's post here:
https://medium.com/the-new-control-plane/using-entra-external-id-ciam-with-the-msal-samples-86e6de6a8f20

One of the important things is the correct format for the authorize endpoint: https://<TENANT_ID>.ciamlogin.com/<TENANT_ID>/oauth2/v2.0/authorize

If you configure the sample with all above recommendations and you still face the issue it means that probably one of the issues mentioned by the person from Microsoft is happening in your preview tenant. The team is working to fix all potential issues this quarter.

I hope this will help you.
Please sign in to rate this answer.

3 people found this answer helpful.
Josh Christensen 15 Reputation points

2024-04-22T16:38:21.03+00:00

The recommended solution does not work. When changed to use it, I get the error "There was an issue looking up your account" when attempting to sign in via my microssoft account.

Niklas Eicker 0 Reputation points

2024-06-03T15:21:11.7966667+00:00

Hi @Daniel Krzyczkowski
thank you for the update. Do you have any follow-up information if all the issues were addressed in Q1?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Kentaro Inomata 26 Reputation points

2023-12-02T14:10:10.55+00:00

Maybe you should set "https://<tenant-subdomain>.ciamlogin.com/<tenant-id>/v2.0" for Issuer URL.
OpenID Configuration endpoint is "https://<tenant-subdomain>.ciamlogin.com/<tenant-id>/v2.0/.well-known/openid-configuration"

see: https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad?tabs=customer-tenant
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Martin Dreßler 30 Reputation points

2023-12-06T16:26:50.13+00:00

When using "https://<tenant-subdomain>.ciamlogin.com/<tenant-id>/v2.0/.well-known/openid-configuration" the login works, but the returned openid-configuration is not OpenIdConnect compliant and fails validation.

Sadly https://<tenant-subdomain>.ciamlogin.com/<tenant-id>/v2.0/.well-known/openid-configuration returns a configuration containing "issuer":"https://login.microsoftonline.com/<tenant-id>/v2.0"

The OIDC spec for the discovery endpoint https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidationstates clearly:

The issuer value returned MUST be identical to the Issuer URL that was directly used to retrieve the configuration information. This MUST also be identical to the iss Claim value in ID Tokens issued from this Issuer.

Is there any fix on the way for this?
Please sign in to rate this answer.

1 person found this answer helpful.
Gunther Lochstampfer 0 Reputation points

2024-01-09T16:36:47.5233333+00:00

The solution is to use tenant-id instead of tenant-name:
https://<tenant-id>.ciamlogin.com/<tenant-id>/v2.0/.well-known/openid-configuration
The issuer url is now identical to the issuer value
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Fabio Andrade 1,585 Reputation points Microsoft Employee

2023-08-29T21:35:52.85+00:00

Hi @Daniel Krzyczkowski

Assuming that you have an application registered on Tenant 17444b8d-b055-4b48-8797-2c12f5b9b416, you'd need to sign in using a user account that exists on the same Tenant or invite an external user as a Guest.

If you create a new account on your Azure AD tenant (test@yourdomain.onmicrosoft.com) would you get the same error?

Thanks.
Please sign in to rate this answer.
Daniel Krzyczkowski 476 Reputation points MVP

2023-08-30T05:26:56.07+00:00

Hi @Fabio Andrade ,

Thank you for your response.
The issue is that I cannot sign up and sign in with any customer account.
Please see example below. I use minute-mailbox temporary email for tests.
When I am trying to register the user, I got error returned from the Azure AD External ID. Please see the flow below:

After redirection to the application I have this error:

There was an error trying to log you in: 'AADSTS500208: The domain is not a valid login domain for the account type. Trace ID: f4bd095b-edee-4bc5-b9a6-0efc2a074400 Correlation ID: 1bd2a3d7-7b33-4a43-be38-1de86116bf48 Timestamp: 2023-08-30 05:17:14

However, I see that account was created successfully under Users tab:

When I try to sign in with the same account above, I also have the same error:

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Shweta Mathur 29,746 Reputation points Microsoft Employee

2023-09-01T11:32:25.4366667+00:00

Hi @Daniel Krzyczkowski ,

Thanks for reaching out.

I tried to sign up and sign into External Id preview using minuteinbox account as well from other personal accounts and able to create the account successfully without any error.

I can understand that Microsoft Entra External Id is in preview and there might be chances that intermittent issues are coming.

Could you please confirm that are you still facing the issues?

Also, could you please confirm which application you are running to run the user flow?

Thanks,

Shweta
Please sign in to rate this answer.
Daniel Krzyczkowski 476 Reputation points MVP

2023-09-02T16:36:13.56+00:00

Hi @Shweta Mathur

Thank you for your response.

Unfortunately, issue remains. I also created new, separate tenant and issue is exactly the same (both tenants have Azure subscription connected).

When it comes to application - this is Blazor WebAssembly SPA application.

When I use https://login.microsoftonline.com/17444b8d-b055-4b48-8797-2c12f5b9b416/ as authority value in app configuration, below error is displayed:

There was an error trying to log you in: 'AADSTS500208: The domain is not a valid login domain for the account type.

When I change authority to be:

https://techmindfactorycustomers.ciamlogin.com

There is error displayed that configuration cannot be retrieved from well-known endpoint. When you open below endpoint you can see the that other error is displayed.

https://techmindfactorycustomers.ciamlogin.com/v2.0/.well-known/openid-configuration

Tenant 'v2.0' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant.

I have active subscription connected.

Shweta Mathur 29,746 Reputation points Microsoft Employee

2023-09-04T09:14:37.9466667+00:00

Hi Daniel Krzyczkowski •

Thanks for the update.

This is the known issue as mentioned here.

https://learn.microsoft.com/en-us/azure/active-directory/external-identities/customers/troubleshooting-known-issues#error-when-running-a-web-api

Could you please try to update accessTokenAcceptedVersion property from null to 2 in manifest and confirm.

Thanks,

Shweta

Daniel Krzyczkowski 476 Reputation points MVP

2023-09-05T04:53:09.1+00:00

Hi @Shweta Mathur

Thank you for this suggestion. Unfortunately it still does not work.

I can see that well-known endpoint does not work:

https://techmindfactorycustomers.ciamlogin.com/v2.0/.well-known/openid-configuration

It is independent from the concrete application. I should get OpenID configuration but got this error:

Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant.

When I call:

https://techmindfactorycustomers.ciamlogin.com/common/discovery/keys

I got this error:

Unspecific Tenant is not supported in this domain

With below address I am able to get OpenID configuration:

https://login.microsoftonline.com/17444b8d-b055-4b48-8797-2c12f5b9b416/v2.0/.well-known/openid-configuration

However, when using above for the authority value in the app (https://login.microsoftonline.com/17444b8d-b055-4b48-8797-2c12f5b9b416/) I have this error and cannot login:

The domain is not a valid login domain for the account type.

It looks like there is some bigger problem with the service.

Shweta Mathur 29,746 Reputation points Microsoft Employee

2023-09-06T11:45:41.2066667+00:00

Daniel Krzyczkowski •

The well-known endpoint would be https://techmindfactorycustomers.ciamlogin.com/techmindfactorycustomers.onmicrosoft.com/v2.0/.well-known/openid-configuration

We have found some users with the same issue and our product team is looking into it.

As a work around, this issue is getting resolved by adding any admin role to CIAM user.

I will update you regarding this issue.

Daniel Krzyczkowski 476 Reputation points MVP

2023-09-06T16:28:46.35+00:00

@Shweta Mathur

Thank you so much for the confirmation. I will wait for updates then.

Daniel Krzyczkowski 476 Reputation points MVP

2023-09-14T17:30:28.3+00:00

Hi @Shweta Mathur

I would like to ask if you have any updates about this issue?

Thank you.

Shweta Mathur 29,746 Reputation points Microsoft Employee

2023-09-15T07:54:14.1866667+00:00

Daniel Krzyczkowski,

This is a known issue now and our product team is working on this to fix.

I can repro the error at my end too and keeping an eye on this issue too.

Will let you know once will hear from team.

Thanks for your time and patience.

Daniel Krzyczkowski 476 Reputation points MVP

2023-09-15T08:18:33.7166667+00:00

Hi @Shweta Mathur,

Thank you, I will wait for the updates.

Daniel Krzyczkowski 476 Reputation points MVP

2023-10-07T09:50:32.09+00:00

Hi @Shweta Mathur,

I hope you are doing well. I wanted to ask id there are any updates on this? I think this is quite important bug. Did team manage to solve it?
Please let me know if you have any updates.

Thank you.

Olli-Pekka Heinisuo 45 Reputation points

2023-10-09T06:18:11.6533333+00:00

We are waiting for a fix as well. Any news? There are a few critical bugs like this one that make the whole product unusable at the moment.

Walid Wahba 5 Reputation points

2023-10-09T23:12:18.5933333+00:00

We're also having the same issue.
Agreed, this bug is making the whole solution useless.

Olli-Pekka Heinisuo 45 Reputation points

2023-10-16T07:01:33.4066667+00:00

@Shweta Mathur Any updates?

Shweta Mathur 29,746 Reputation points Microsoft Employee

2023-10-16T08:28:13.2166667+00:00

Hi Daniel Krzyczkowski, Olli-Pekka Heinisuo,

Apologies for late response. I was checking with product team for the updates.

We are able to find the issue which seems to be device URL is not returning properly. We are working on to update the documentation for now as workaround and working on fix as well.

Thanks for your time and patience.

Matthew Keys 25 Reputation points

2023-10-31T15:05:07.42+00:00

Hi @Shweta Mathur ,

Any update on this? Either the solution or how to work around it?

Thanks

Jason Braatz 0 Reputation points

2023-10-31T18:43:29.8733333+00:00

Just in case this is useful, I was having the same issue testing the React SPA, and resolved it by:

Using the https://*.ciamlogin.com endpoint for my external Entra tenant as the authority in authconfig.js. When I was doing my testing of this I ended up using an onmicrosoft.com URI as that was the only thing I could get to do anything, but my resource at MS said I need to use the ciamlogin.com endpoint.

Requesting that our network security team un-block ciamlogin.com. That domain apparently made it on Chrome's "malicious domain" list for a little while a few months ago, and from there onto multiple other security solution's block lists.

If you can't get to https://$whatever.ciamlogin.com in a browser then you might be running into the same thing I was, and if that doesn't work nothing else will.

Hope that helps!

Jan 11 Reputation points MVP

2023-11-05T21:56:25.3066667+00:00

@Shweta Mathur any updates? With a broken sign up experience, half of the feature set of Entra Id for Customers is currently broken...

Shreyal Gelani 5 Reputation points

2023-11-07T05:19:24.41+00:00

@Shweta Mathur Just wondering if you can give us an approx. timeframe when this will be fixed?

Seb S 0 Reputation points

2023-12-05T15:01:27.1833333+00:00

@Shweta Mathur are there any updates on this?
Any customer account with a domain name other than the tenant domain name is getting:
AADSTS500208: The domain is not a valid login domain for the account type.

Is there a workaround for this yet?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.