AADSTS90072 User Account Does Not Exist in Tenant

Question

Our application utilizes Microsoft Entra as for authorization. Our application also allows clients to use their own Entra IDP for authentication, which invites their user to our tenant as an external user. Normally, when users accept an invitation, the identity shows as ExternalAzureAD. We are having one client with a single user showing up as MicrosoftAccount. They are able to authenticate into our website, but not through our office add-ins. I ran some network tracing and I see that the user is getting routed through login.live.com as opposed to login.microsoftonline.com as a normal account would do. We believe there is some misconfiguration with the user which is flagging it as a MicrosoftAccount instead of an ExternalAzureAD account causing this issue. The authentication has a signInAudience value of AzureADMyOrg, which indicates only users from the client's organization should be able to access and not personal accounts. What I am not understanding is what could be flagging the user's account as a MicrosoftAccount vs ExternalAzureAD account when it has been set up with the same domain as all of the other users. Any advice on what to review in the client's Entra configurations when reconnecting with them?

Answer 1

Hi @John Miller

Thanks for reaching out to Microsoft Q&A.

Usually, this behavior is presented because the Microsoft Account was created with a corporate domain as email address, this is not possible anymore now but used to be very common in the past.

When inviting users, B2B redemption process verifies if the account you are inviting is a personal account, and if it is, Entra create the guest account as a MSA account:

https://learn.microsoft.com/en-us/entra/external-id/redemption-experience#invitation-redemption-flow

In this case, I believe your options are to allow MSA accounts to login to your application, or invite the user with a different account.

Thanks,

Fabio