This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 12%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EY%3C/text%3E%3C/svg%3E)
I created a Cognito userpool and an Azure AD b2c application. I connected Azure AD b2c to Cognito as a OpenID Connect identity provider.
I am able to login successfully with an authorized user configured under my Azure AD. And if I log in with another Azure account from another directory, the page shows a proper message telling me my account does not belong to the Azure AD.
However, if I login with my Microsoft account, I get an 404 error message as below. This issue looks like an Azure issue. Can anyone help me troubleshooting this?
Instead, I was expecting a message like below
This is not Azure error as the error is returned by login.live.com and not by login.microsoftonline.com. If you want to allow signup/signin with Microsoft Account, you would need to add Microsoft Accounts (MSA) IDP to Cognito. You can reference https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-microsoft-account or check if there is any Cognito documentation available to add MSA as IDP.
Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.
Thanks for hopping in to help. I believe I am able to login with an MSA. The goal I am trying to achieve here, is to prevent people sign in with their MSA, but giving them a proper message. I have updated my description above, I am expecting to get a proper message as the second screenshot, instead of an error message in the first screenshot.
One thing to point out is, if I am trying to login with another Azure AD account (that hasn't been assigned to my app), I get the proper message. But if I am trying to login with an MSA, I don't get the proper message. So there is an inconsistency.
@Yongjin ·Since MSAs are federated with Azure AD, you get redirected to login.live.com based on the UPN suffix which is expected. Now the AADSTS errors are thrown by Azure AD only and not by MSA endpoints. You cannot get AADSTS50020 from Login.live.com.
@amanpreetsingh-msft, AADSTS50020 is what I expected. But currently what happened is I'm getting the error in the first screenshot instead of AADSTS50020. Which is not expected, is it?