How to fix the message "The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account."?

Question

How to fix the message "The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account."?

MAULIDA NISWATUL ASRI M 0

I tried to login to my university SSO login, then this message appeared, i am using the laptop with my personal microsoft account (outlook.com) and my company's account, is that a problem? then how can I resolve this?

Message: AADSTS50020: User account m******** @(namemycompany).id from identity provider 'https://sts.windows.net/ed6fb366-8322-46f3-915e-c4d037a454a9/' does not exist in tenant 'Universitas Tarumanagara' and cannot access the application '5f478311-7cb4-4ef2-9ff8-e74c5b94289e'(sso_untar) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

Anonymous

2025-03-05T17:40:29.43+00:00

Hello @MAULIDA NISWATUL ASRI M ,

Thank you for reaching out on Microsoft Q&A.

Based on your description, I understand that you're encountering the AADSTS50020 error while trying to log in to your university's SSO system. This error occurs when a guest user from an identity provider (IdP) attempts to access a resource tenant in Microsoft Entra ID but is not recognized. In your case, the university's SSO system only allows access to users who are registered in their Microsoft Entra ID.

From the error message, it looks like you're trying to log in using a Microsoft account associated with your company’s domain, but this account does not exist in the university’s tenant. As a result, Microsoft Entra ID is rejecting the login attempt because your account is not recognized within the university's tenant.

To resolve this, please ensure that you're logging in using your university provided Microsoft account instead of a personal or company account. If you're currently signed in with a different account, kindly sign out and log in again using your university credentials.

Let me know if you need any further assistance.

1 answer

Your answer

Anonymous

2025-03-05T17:40:29.43+00:00

Hello @MAULIDA NISWATUL ASRI M ,

Thank you for reaching out on Microsoft Q&A.

Based on your description, I understand that you're encountering the AADSTS50020 error while trying to log in to your university's SSO system. This error occurs when a guest user from an identity provider (IdP) attempts to access a resource tenant in Microsoft Entra ID but is not recognized. In your case, the university's SSO system only allows access to users who are registered in their Microsoft Entra ID.

From the error message, it looks like you're trying to log in using a Microsoft account associated with your company’s domain, but this account does not exist in the university’s tenant. As a result, Microsoft Entra ID is rejecting the login attempt because your account is not recognized within the university's tenant.

To resolve this, please ensure that you're logging in using your university provided Microsoft account instead of a personal or company account. If you're currently signed in with a different account, kindly sign out and log in again using your university credentials.

Let me know if you need any further assistance.

Answer 1

Hello @MAULIDA NISWATUL ASRI M ,

When you are trying to login to Azure portal using their personal Microsoft Account (Outlook, Hotmail..) they are getting AADSTS160021 or AADSTS16000 or AADSTS50020 errors.

Error AADSTS50020 is thrown when the user not found in the tenant used for authentication. In your case, this error usually occurs when you sign in to Azure Portal using your personal account which is not the part of the tenant or not added as an external/guest user to an Azure AD tenant. Due to this, you by default get connected to the Microsoft Services tenant.

Reason: Whenever you sign in Azure portal using Microsoft Personal Account you by default get connected to the Microsoft Services tenant.

If you are connected to the Microsoft Services tenant as a standard user with restricted access, you cannot perform actions such as creating new users, groups, enterprise applications, and installing Kubernetes. To perform administrative actions, you must have administrative access to the tenant.

Solution: You need to create your own tenant rather than using the Microsoft Services tenant. You get one with an Azure free trial When you create a new tenant, you by default become the Global Administrator of the new tenant and have full access to all the options in that tenant.

In some cases, the user might already have an active session that uses a different personal account than the one that's intended to be used. Or they have a session that uses their organization account although they intended to use a personal guest account (or vice versa). In that scenario, try signing in to the Azure Portal trough a tenant-specific URL using the following format:

https://portal.azure.com/<tenant domain name>

Example:

https://portal.azure.com/constoso.onmicrosoft.com

Additionally, I would like you to check with the trouble shooting steps for the Error: https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts50020-user-account-identity-provider-does-not-exist

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Goutam Pratti 6,170 Reputation points Microsoft External Staff Moderator

2025-03-12T07:05:31.2466667+00:00

Hello @MAULIDA NISWATUL ASRI M ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Goutam Pratti 6,170 Reputation points Microsoft External Staff Moderator

2025-03-13T09:51:05.5466667+00:00

Hello @MAULIDA NISWATUL ASRI M ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

How to fix the message "The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account."?

1 answer

Your answer