Need support about External user of EntraID

Question

Hi Microsoft support team,

I'm using EntraID trial and I faced with 1 problem.

That is when I register an Enterprise Application, I config Supported Account type to Multiple Tenant.

After that some users used their Microsoft Account to authorized the authentication of my EntraID, then I update the config into Single Tenant but they still can authorize.

I've checked from All Users but I can't find their user on it.
So how can I find their user and how can I block access of them.

Please help me to resolve this problem.

Thanks, Regards

Answer 1

Hello Long Nguyen Thanh,

Thanks for your question.

They might still have active access tokens or refresh tokens. See: Modify the accounts supported by an application

You can view the list of your guest users with the command below

Install-Module AzureAD 
Connect-AzureAD
Get-AzureADUser -Filter "userType eq 'Guest'" -All $true

To remove user from your tenant and block access:

Remove-AzureADUser -ObjectId "TestUser@example.com"

You can also consider conditional access policies to setup policies that can limit in future

Regards,

Abiola

You can mark it 'Accept Answer' and upvote if this helped.

Answer 2

Hi @Long Nguyen Thanh

Thank you for posting this in Microsoft Q&A.

To better understand the issue, please provide more details. How did you say that the user was authenticated after updating the application account type from Multitenant to Single Tenant? Did you notice any sign-in logs in your tenant. Does external user retrieve any access token from multitenant application. If you noticed anything, please share with us and also can you please check that external user will be part of your tenant?

You can check via Microsoft Enterprise Admin Center or use the PowerShell below.

Get-AzureADUser -ObjectId "Navya#EXT#@M365x37.onmicrosoft.com" 

• Single-tenant apps are only available in the tenant they were registered in, also known as their home tenant.
• Multitenant apps are available to users in both their home tenant and other tenants.

Users may encounter an authentication error when attempting to authenticate after changing the application account type from Multitenant to Single Tenant.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.