AADSTS90072: User account

Question

AADSTS90072: User account

V M 0

I get the below error when i try to loginto Global Protect VPN.

Earlier i have used VPN for client XXXX. Not i have to login to client ZZZZZ. But its using the client xxxx email address to log into client ZZZZZ network. I have uninstalled the app multiple times , but no use. I can successfullt connect in another laptop(connect to client ZZZZZ, and i never connected to client XXXX fromt his other laptop)

AADSTS90072: User account '******@xxxx.ca' from identity provider 'https://sts.windows.net/f4118c16-85fe-440e-8bf2-573cc8c6b420/' does not exist in tenant 'ZZZZZ' and cannot access the application 'https://gp-zzz.com:443/SAML20/SP'(Palo Alto Networks - GlobalProtect) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account

2 answers

Your answer

Answer 1

Sandeep G-MSFT 21,131 Microsoft Employee Moderator

@V M

Thank you for posting this in Microsoft Q&A.

As I understand you are unable to connect to ZZZZZ using XXXX credentials.

In the above scenario, XXXX account is an external account for ZZZZZ client that you are using. The error indicates that the external account that the user signs in with doesn't exist on the tenant that they signed into.

To fix this issue you will have to add user XXXX as a guest user in ZZZZZ tenant. And also assign XXXX guest user to ZZZZZ application in the tenant.

You can follow below article to add XXX user to ZZZZ tenant as B2B user,

https://learn.microsoft.com/en-us/entra/external-id/add-users-administrator

https://learn.microsoft.com/en-us/entra/external-id/b2b-quickstart-add-guest-users-portal

Let us know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

V M 0 Reputation points

2025-01-17T13:17:16.4866667+00:00

ZZZZZ and XXXXX are two seperate companies. I first connected to XXXXX, I have disconnected from XXXX and now trying to connect to ZZZZZ. But in the last step, its using XXXXX credentials instead of ZZZZZ. ie its still defaulting XXXXX credentials.
Raja Pothuraju 45,750 Reputation points Microsoft External Staff Moderator

2025-02-10T03:16:20.6833333+00:00

Hello @V M,

Thank you for your response.

I would like to check this up offline with you to understand the scenario to see why this kind of behavior is occurring.

We can connect offline and discuss further on this.
V M 0 Reputation points

2025-02-10T19:28:29.6666667+00:00

its been fixed after i refreshed the cache for old iexplorer
Sandeep G-MSFT 21,131 Reputation points Microsoft Employee Moderator

2025-02-11T03:34:23.0166667+00:00

@V M

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "[The question author cannot accept their own answer. They can only accept answers by others] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#why-only-one-accepted-answer)**)", I'll repost your solution in case you'd like to "[Accept] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#accepted-answer-in-a-question-thread)**)" the answer.

Issue: AADSTS90072: User account '******@xxxx.ca' from identity provider 'https://sts.windows.net/f4118c16-85fe-440e-8bf2-573cc8c6b420/' does not exist in tenant 'ZZZZZ' and cannot access the application 'https://gp-zzz.com:443/SAML20/SP'(Palo Alto Networks - GlobalProtect) in that tenant.

Solution: You refreshed the cache for old Internet explorer and the issue got resolved.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Abiola Akinbade 30,480 Volunteer Moderator

Hello V M,

Thanks for your question.

This is most likely due to cached creds on login with global protect.

You will have to try any of the following:

Confirm first that the account still exists on the tenant and it is not a false error
Open your web browser and Clear browsing data, ensuring that cookies and cached images/files are selected.
If your device is connected to multiple accounts, you may need disconnect unnecessary work/school accounts: Go to Accounts > Access work or school and select the account causing conflict and click Disconnect.
Try removing from credential manager. Press Win + R, type control keymgr.dll, nder Windows Credentials, locate any entries related to GlobalProtect or your VPN and remove

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola

V M 0 Reputation points

2025-01-17T13:18:29.63+00:00

Yes i can loginto to client zzzzz from another computer.

I already tried clearing cache. ( i will try this again tomorrow, as i just started work )

for this VPN, there are no school or workaccounts

I could not find anything in Credential manager underglobal protect. it looks like its using microsoft service, is there any micrsoft credential that should be cleared.
V M 0 Reputation points

2025-01-20T15:46:06.9833333+00:00

i had to clear the cache of Internet expolored not edge. Not its resolved.

Share via

AADSTS90072: User account

2 answers

Your answer