question

BasimKadhim-1280 avatar image
0 Votes"
BasimKadhim-1280 asked amanpreetsingh-msft commented

Trying to administer B2C tenant results in "User authorization failed. You must have access to "

I originally created the tenant, but now it does not show up as a tenant for me to switch to, though it does show up under the subscription that it is assigned to in my primary tenant. The co-administrator of mine that does have access to the tenant has confirmed that I'm listed as a Global Administrator, but I still can't seem to access the B2C tenant to administer users. Why would this be?

azure-ad-b2c
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

amanpreetsingh-msft avatar image
0 Votes"
amanpreetsingh-msft answered amanpreetsingh-msft commented

@KellyH-3558 Thank you for your time on call today.


As discusses, the problematic user accounts were added as consumer accounts by signing up using federated Azure Active Directory. These accounts are not supposed to be used for Administration purpose. The signed-up accounts should be used only to provide access to the application federated with B2C directory.


For administration purpose, user accounts should be added as members directly using Azure AD > New User option or by adding them as guests using Azure AD > New Guest User option.


Issue resolved by removing the signed-up user accounts and adding them as guest accounts to the B2C directory.




Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.


· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for your assistance. Using the "New User" mechanism did not appear to work, but adding our users as "guests" did, so our problem is now resolved.

0 Votes 0 ·

@BasimKadhim-1280 When you select New User option, you need to choose Create User option for it to work and not Create Azure AD B2C user. The Create Azure AD B2C user creates consumer based identity which is similar to signing-up for a new account.

0 Votes 0 ·
amanpreetsingh-msft avatar image
0 Votes"
amanpreetsingh-msft answered KellyH-3558 commented

Hello @BasimKadhim-1280


Could you please confirm if you are able to access B2C directory using below method:


Type portal.azure.com in in-private or incognito browser session, which will redirect you to https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id.....


Now replace organizations in the URL with your B2C tenant name. E.g. https://login.microsoftonline.com/yourB2Ctenant.onicrosoft.com/oauth2/v2.0/authorize?client_id.....


Now try to login with your account and see if you are able to access the directory or not.


Alternatively, you can try signing-in to B2C directory via powershell connect-azuread -TenantId yourB2Ctenant.onicrosoft.com


This will confirm if this is a UI issue or permissions issue.


Also make sure you are looking under all directories when you try to switch directory as highlighted below:


9739-untitled.png




Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.



untitled.png (18.1 KiB)
· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I tried your suggestion, but the behavior is the same as Basim reported. The dialog to select the directory does not show the B2C AD tenant. When I log into the Azure portal, and navigate to the B2C tenant and click the Azure AD B2C Settings option it redirects me into the B2C tenant to administer it. Unfortunately, it gives me an error "You do not have any Azure subscriptions in the aa27ab1a-b995-4428-8ada-c5fb60a06c78 directory. Click here to switch to another directory."

This was previously working, as Basim was the one that created and configured it initially.

0 Votes 0 ·

Please share your B2C tenant name.

0 Votes 0 ·

The B2C tenant name is reportsnowb2c.

0 Votes 0 ·
Show more comments