AADSTS500208: The domain is not a valid login domain for the account type.

Question

Hi,

I have MS Entra External ID preview tenant created. However, I noticed that I cannot authenticate successfully with the local account. Below I provide more details. I would be grateful for help/hints.

Describe the bug
When I try to login with corporate account or standard customer account (for instance using email from minutemailbox) I have below error displayed after authentication is completed:

There was an error trying to log you in: 'AADSTS500208: The domain is not a valid login domain for the account type.

To Reproduce
Steps to reproduce the behavior:

1. Open sign in page.
2. Create new account using using standard email like the one from minutemailbox service. Any account can be used, error is the same.
3. Try to authenticate with new account.
4. See error

Expected behavior
User should be authenticated successfully and tokens should be issued to the application.

My test tenant ID: 17444b8d-b055-4b48-8797-2c12f5b9b416

Few weeks ago I was able to successfully authenticate.

Thank you.

Answer 1

Good morning everyone,

I got my scenario working on Friday, thanks to this thread.

• Azure SWA set up in our main Entra ID Tenant.
• App Registration for the SWA created in our new Entra External ID/Customer Tenant.
• Using a temp email address to create an account at login time.

Previously, I had to amend the new user in the portal and assign them an admin role before the user could proceed to the app after signing in.

On Friday, with below staticwebapp.config.json, I was able to register a new user account and sign-in to the app without any manual tweaking of the user account.

{
    "routes": [
        {
            "route": "/src/index.html",
            "allowedRoles": [
                "anonymous"
            ]
        },
        {
            "route": "/logout",
            "redirect": "/.auth/logout?post_logout_redirect_uri=/logout_complete.html"
        },
        {
            "route": "/me",
            "redirect": "/.auth/me"
        },
        {
            "route": "/authOnly*",
            "allowedRoles": [
                "authenticated"
            ],
            "headers": {
                "Content-Type": "application/javascript"
            }
        }
    ],
    "responseOverrides": {
        "401": {
            "statusCode": 302,
            "redirect": "/.auth/login/aad?post_login_redirect_uri=.referrer"
        }
    },
    "trailingSlash": "auto",
    "platform": {
        "apiRuntime": "dotnet-isolated:8.0"
    },
    "auth": {
        "identityProviders": {
            "azureActiveDirectory": {
                "userDetailsClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
                "registration": {
                    "openIdIssuer": "https://TenantID.ciamlogin.com/TenantID/v2.0",
                    "clientIdSettingName": "CLIENT_ID",
                    "clientSecretSettingName": "CLIENT_NAME"
                }
            }
        }
    }
}

Regards, Paul.

Answer 2

I have confirmation from Microsoft that the issue is fixed in all tenants. Documentation and samples were also updated. I can confirm that I do not face the issue anymore.