This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 18%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBF%3C/text%3E%3C/svg%3E)
Hello,
We have been troubleshooting this for a while now. We created a policy in our Exchange admin center to be able to send encrypted email with specific syntax in the subject line. This has been working for year. For compliance reasons we needed to implement multiple conditional access polices in our Azure tenant. Now when an end user creates an email with an attachment with the specific syntax to encrypt the recipient tries to open the attachment and a Microsoft MFA prompt comes up asking them to login using their account and then they receive this error.
AADSTS90072: User account 'xyz' from identity provider 'https://sts.windows.net/4bfbe7-1f35-4adb-9afa-22cf6d34a9f8/' does not exist in tenant 'ABC.' and cannot access the application 'd359d6-52b3-4102-aeff-aad2292ab01c'(Microsoft Office) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account
We don't want to have to give external domain access to our tenant but want them to be able to open the email attachment. Any thoughts where this configuration change needs to be made allow?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 20%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMH%3C/text%3E%3C/svg%3E)
It has been a while since the last update. Do you need any other help?
If so, please feel free to contact us! In addition, if the answer is helpful to you, you can also choose to mark it as an answer!
Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.
It's been a while since the last update. Do you need more help from me? If so, please feel free to contact me.
In addition, if the following answer is helpful to you, you can mark it as an Answer, which will help the community. Thank you for your understanding.
You have to share some details on how your CA policies are configured. Generally speaking, you should be able to work around the issue by adding and exception, either for the RMS service, or for any external users. It's up to you to decide which method works best, and you can find detailed instructions in this article: https://office365itpros.com/2024/02/12/conditional-access-mfa-email/