AADSTS500208: The domain is not a valid login domain for the account type.

Question

Hi,

I have MS Entra External ID preview tenant created. However, I noticed that I cannot authenticate successfully with the local account. Below I provide more details. I would be grateful for help/hints.

Describe the bug
When I try to login with corporate account or standard customer account (for instance using email from minutemailbox) I have below error displayed after authentication is completed:

There was an error trying to log you in: 'AADSTS500208: The domain is not a valid login domain for the account type.

To Reproduce
Steps to reproduce the behavior:

1. Open sign in page.
2. Create new account using using standard email like the one from minutemailbox service. Any account can be used, error is the same.
3. Try to authenticate with new account.
4. See error

Expected behavior
User should be authenticated successfully and tokens should be issued to the application.

My test tenant ID: 17444b8d-b055-4b48-8797-2c12f5b9b416

Few weeks ago I was able to successfully authenticate.

Thank you.

Answer 1

Hi, could we please have an update on this?

Tried all options but end up with the following error when using the following configuration. This is a blazor webassembly app using MSAL.js

---

------Msal configuration:

{  "AzureAdB2C": {    "Authority": "https://9fc5b3ac-e8e6-4099-9e21-xxxxxxxx.ciamlogin.com/9fc5b3ac-e8e6-4099-9e21-xxxxxxxx/",    "ClientId": "77afc723-5c93-459b-8d27-xxxxxxxxx",    "ValidateAuthority": false  }}

---

---Redirect uri for the registered app in azure is: https://localhost:7000

---

------Error: AADSTS650053: The application 'MyApp' asked for scope '77afc723-5c93-459b-8d27-xxxxxxxx' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the app vendor.

Answer 2

Good morning everyone,

I got my scenario working on Friday, thanks to this thread.

• Azure SWA set up in our main Entra ID Tenant.
• App Registration for the SWA created in our new Entra External ID/Customer Tenant.
• Using a temp email address to create an account at login time.

Previously, I had to amend the new user in the portal and assign them an admin role before the user could proceed to the app after signing in.

On Friday, with below staticwebapp.config.json, I was able to register a new user account and sign-in to the app without any manual tweaking of the user account.

{
    "routes": [
        {
            "route": "/src/index.html",
            "allowedRoles": [
                "anonymous"
            ]
        },
        {
            "route": "/logout",
            "redirect": "/.auth/logout?post_logout_redirect_uri=/logout_complete.html"
        },
        {
            "route": "/me",
            "redirect": "/.auth/me"
        },
        {
            "route": "/authOnly*",
            "allowedRoles": [
                "authenticated"
            ],
            "headers": {
                "Content-Type": "application/javascript"
            }
        }
    ],
    "responseOverrides": {
        "401": {
            "statusCode": 302,
            "redirect": "/.auth/login/aad?post_login_redirect_uri=.referrer"
        }
    },
    "trailingSlash": "auto",
    "platform": {
        "apiRuntime": "dotnet-isolated:8.0"
    },
    "auth": {
        "identityProviders": {
            "azureActiveDirectory": {
                "userDetailsClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
                "registration": {
                    "openIdIssuer": "https://TenantID.ciamlogin.com/TenantID/v2.0",
                    "clientIdSettingName": "CLIENT_ID",
                    "clientSecretSettingName": "CLIENT_NAME"
                }
            }
        }
    }
}

Regards, Paul.

Answer 3

I have confirmation from Microsoft that the issue is fixed in all tenants. Documentation and samples were also updated. I can confirm that I do not face the issue anymore.