Cannot authorize (OAuth 2.0) Microsoft Graph, "issue looking up account"

Question

Cannot authorize (OAuth 2.0) Microsoft Graph, "issue looking up account"

Phil 0

When I submit this request, I am prompted to log in and authorize the MS Graph session. Unfortunately when I enter my email I receive this message: "There was an issue looking up your account. Tap Next to try again."

The only alternate sign-in option is using "personal github account" however this doesn't work either. Not to mention this is for work so I cannot use my personal in the first place.

Any and all help is appreciated!

Below: request code (PHP)

$response = Http::get('https://login.microsoftonline.com/' . env('MS_TENANT_ID') . '/oauth2/v2.0/authorize', [ 
	'client_id' => '[client id]',    
	'response_type' => 'code',    
	'redirect_uri' => 'http://localhost:8000/callback',    
	'response_mode' => 'query',    
	'scope' => 'https://graph.microsoft.com/mail.read',    
	'state' => '12345',    
	'code_challenge' => '[example_challenge]',    
	'code_challenge_method' => 'S256',
]);
return $response;

CarlZhao-MSFT 46,406 Reputation points

2023-11-21T06:57:45.7533333+00:00

Do you mean it can't log into a work account?
Phil 0 Reputation points

2023-11-21T13:14:55.18+00:00

Yes, it only says there was an issue looking up the account. I've gone through the MSFT support channels but they redirected me here after a few weeks of back and forth not being able to figure it out.
CarlZhao-MSFT 46,406 Reputation points

2023-11-22T06:28:02.4966667+00:00

What account types does your app support when registering?
Phil 0 Reputation points

2023-11-22T13:46:05.7066667+00:00

It looks like any account type is supported, I went though some support channels previously to set up the permissions and scopes. I believe all these are correct as previously I wouldn't have gotten this far.

Additionally, I'm not sure if this is relevant to this particular issue or question but under 'Implicit grant and hybrid flows" neither Access tokens nor ID tokens are enabled. Will I have to do this in order to complete the OAuth flow?
Carolyne-3676 881 Reputation points

2023-12-18T21:25:34.2333333+00:00
Hi Phil! Did you figure out the issue here.
A couple of things that you might need to double check on your end:

Check and ensure that you are using a valid email address that is registered with your organization's Azure AD tenant. Verify that the user account that you are trying to authenticate is not blocked or disabled.

Check the Azure AD app configuration to ensure that the redirect URI is correct and matches the callback URL in your code.

Ensure no trailing slash in your redirect URI on the app configuration.
Phil 0 Reputation points

2023-12-19T15:52:14.31+00:00
Unfortunately, yes, we are still having issues. Thank you for your response!

I have checked that the email address used has all necessary permissions and is not blocked or disabled. I have also recently added them as an owner of the registered Azure application.

A few things to note which I did not specify but might have some impact on this:

Under the heading "Expose an API" there are no scopes or authorized client applications

When following the documentation this section was not discussed so I missed it but looking now it appears relevant

Under the heading "Manifest"

There is a lot of JSON I don't fully understand but, as implied by the screenshot above, I may need to change supported account types? Right now I'm not using a personal account, nor do we intend to in the future. The only authorized account will be an organizational administrator which is authenticated through our application.

Under the heading "API permissions"

The permissions in the attached image have been added. This was done in accordance with documentation reference and a live support session with a Microsoft technical support agent.

Under the heading "Authentication"

The redirect URI is correct and has since been updated since my original post to use the production URI. This is similarly reflected in my testing script.

Under Implicit grand and hybrid flows neither "token" checkboxes are enabled. I can't recall if this is default behavior or something I changed along the way but that is their current status.

I hope some of this information helps diagnose the issue. I will continue to comb through documentation and may create another app to ensure nothing I personally changed had an effect which I would now need to reverse.

Thanks for your time

Your answer

CarlZhao-MSFT 46,406 Reputation points

2023-11-21T06:57:45.7533333+00:00

Do you mean it can't log into a work account?
Phil 0 Reputation points

2023-11-21T13:14:55.18+00:00

Yes, it only says there was an issue looking up the account. I've gone through the MSFT support channels but they redirected me here after a few weeks of back and forth not being able to figure it out.
CarlZhao-MSFT 46,406 Reputation points

2023-11-22T06:28:02.4966667+00:00

What account types does your app support when registering?
Phil 0 Reputation points

2023-11-22T13:46:05.7066667+00:00

It looks like any account type is supported, I went though some support channels previously to set up the permissions and scopes. I believe all these are correct as previously I wouldn't have gotten this far.

Additionally, I'm not sure if this is relevant to this particular issue or question but under 'Implicit grant and hybrid flows" neither Access tokens nor ID tokens are enabled. Will I have to do this in order to complete the OAuth flow?
Carolyne-3676 881 Reputation points

2023-12-18T21:25:34.2333333+00:00

Hi Phil! Did you figure out the issue here.
A couple of things that you might need to double check on your end:

Check and ensure that you are using a valid email address that is registered with your organization's Azure AD tenant. Verify that the user account that you are trying to authenticate is not blocked or disabled.

Check the Azure AD app configuration to ensure that the redirect URI is correct and matches the callback URL in your code.

Ensure no trailing slash in your redirect URI on the app configuration.
Phil 0 Reputation points

2023-12-19T15:52:14.31+00:00

Unfortunately, yes, we are still having issues. Thank you for your response!

I have checked that the email address used has all necessary permissions and is not blocked or disabled. I have also recently added them as an owner of the registered Azure application.

A few things to note which I did not specify but might have some impact on this:

Under the heading "Expose an API" there are no scopes or authorized client applications

When following the documentation this section was not discussed so I missed it but looking now it appears relevant

Under the heading "Manifest"

There is a lot of JSON I don't fully understand but, as implied by the screenshot above, I may need to change supported account types? Right now I'm not using a personal account, nor do we intend to in the future. The only authorized account will be an organizational administrator which is authenticated through our application.

Under the heading "API permissions"

The permissions in the attached image have been added. This was done in accordance with documentation reference and a live support session with a Microsoft technical support agent.

Under the heading "Authentication"

The redirect URI is correct and has since been updated since my original post to use the production URI. This is similarly reflected in my testing script.

Under Implicit grand and hybrid flows neither "token" checkboxes are enabled. I can't recall if this is default behavior or something I changed along the way but that is their current status.

I hope some of this information helps diagnose the issue. I will continue to comb through documentation and may create another app to ensure nothing I personally changed had an effect which I would now need to reverse.

Thanks for your time

Share via

Cannot authorize (OAuth 2.0) Microsoft Graph, "issue looking up account"

Your answer