Unable to create user - Azure B2C

Question

Unable to create user - Azure B2C

Ulisses Maeda 1

When I Try to create an Azure AD B2C user. I receive a message: Unable to create user Creating user 'user_name'.

Inspecting console log browser I have this information:

{
   "error":{
      "code":"Request_BadRequest",
      "message":"Issuer should match tenants domainName for non federated identity.",
      "innerError":{
         "date":"2021-05-13T16:32:11",
         "request-id":"fcc12b13-d1b1-4447-b0c3-xxxxx",
         "client-request-id":"fcc12b13-d1b1-4447-b0c3-xxxxx"
      }
   }
}

What does it mean? How can I solve this issue?

Regards,
Ulisses Maeda

Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-14T20:00:57.617+00:00

Hi @Ulisses Maeda ,

Thanks for using Microsoft Q&A !!
Which type of user you are trying to create in Azure AD B2C - Work/School, Guest or Consumer user ? Is this happening for user of any specific domain ? This is the common method to create users on B2C ?

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-14T20:17:04.803+00:00

Hi @Saurabh Sharma ,

I'm using the feature "Create Azure AD B2C user" . (Home > Azure AD B2C > Users > "Create Azure AD B2C user").

My tenant is Consumer and I have a active subscription. It's happen in an specific tenant.
Exemple request / response:
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-14T22:50:03.603+00:00

Hi @Ulisses Maeda ,

Are you using multiple sign-in methods while creating the user ?
Also, have checked in the user audit logs for any other errors ?

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-14T23:58:35.07+00:00

Hi @Saurabh Sharma ,

thanks for your question.

I'm just using email as sign-in method.

Yes, I looked for logs but I didn't find anything. The better information that I have are the console logs from browser.

Regards
Maeda
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-20T23:40:38.927+00:00

@Ulisses Maeda
Ok. get it. Is the user you are adding not part of your domain ? I am also trying to check internally on this issue and get back to you.

Thanks
Saurabh
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-25T21:37:23.427+00:00

@Ulisses Maeda We need to have deeper investigation on this issue and your environment and so I suggest you to please open a Support ticket for the same. In case you have a limitation, please send an email to azcommunity@microsoft.com with your subscription id with this Q&A thread link and subject as "Attn: Saurabh' and I will help providing a free support ticket for you.

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-26T12:41:37.777+00:00

Hi @Saurabh Sharma ,

Sorry about my delayed answer. I've opened a case Ticket #2105110040007735 with MS. The 1st level didn't solve the issue anda raised to Product team. They're investigating as well. Do you have privilegies to access this ticket?

thanks again.

Regards,
Maeda
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-26T21:25:53.49+00:00

@Ulisses Maeda Great. yes, I have access to the case details. I could see that you are having some issues with the user's different tenants which support is looking into.
Please let me know if you need anything.

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-27T00:38:03.993+00:00

Hi @Saurabh Sharma ,

I'm really not sure if it's the issue (user's different tenant). It always worked well.
I've tried to create a local user inside a problematic tenant (******@mytenant.onmicrosoft.com)with admin privilegies. With this user I tried to create user (Azure AD B2C user) and I still have the same problem.

If It happen you can contact me to share my screen.

If you have a good idea let me know.

Regards,
Maeda
Dee Bolt 176 Reputation points

2021-05-27T08:01:55.66+00:00

Some of our clients are also having this issue. It seems to be an issue for tenants that were on the private preview of custom domains.
Anyone we've seen enrolled in the public preview for custom domains is unaffected.

Our investigation suggests that it is this API call, on page load, that is fowling the Graph API post when you click submit: https://graph.windows.net/myorganization/domains?api-version=1.6

If your custom domain comes in array 0 of that GET request, it will send graph api the wrong issuer. I.E. it will send yourcustomdomain.com and not tenantname.onmicrosoft.com

If your tenantname.onmicrosoft.com domain comes in array 0 the Graph API post will succeed.

Hopefully this helps give more context for your ticket :)

Best of luck,
Dee
Ulisses Maeda 1 Reputation point

2021-05-28T15:34:05.41+00:00
Hi @Dee Bolt ,

Indeed we have a custom domain. Your explanation can give some light to solve this issue. In the directory "two custom domains":

myorganization.com - status verified - not federated - not primary

myorganization.onmicrosoft.com with status Available - not federated - primary
Both domains have resources referencing them.

I'm using the own AD Screen to create user and investigating the browser request I can see that is using a custom domain (without onmicrosoft.com).

My question: What will happen if I change my custom domain (without onmicrosoft.com) to primary? Could I loose anything? I'd like to make it primary and retry the user creation. What do you think about it?

Regards.
Maeda
Dee Bolt 176 Reputation points

2021-05-28T16:14:24.62+00:00

You won't lose anything @Ulisses Maeda by switching your primary domain, however, it will also not solve the problem unfortunately (we tried this before).

From what we've seen so for this is a coding bug that cannot be fixed by config changes
Ulisses Maeda 1 Reputation point

2021-05-28T18:53:37.483+00:00

hi @Dee Bolt

Thanks for your answer.

I'd like to try a last choice. If I try to remove the custom domain name. Do you believe it could works?

Thanks again,
Maeda

Your answer

Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-14T20:00:57.617+00:00

Hi @Ulisses Maeda ,

Thanks for using Microsoft Q&A !!
Which type of user you are trying to create in Azure AD B2C - Work/School, Guest or Consumer user ? Is this happening for user of any specific domain ? This is the common method to create users on B2C ?

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-14T20:17:04.803+00:00

Hi @Saurabh Sharma ,

I'm using the feature "Create Azure AD B2C user" . (Home > Azure AD B2C > Users > "Create Azure AD B2C user").

My tenant is Consumer and I have a active subscription. It's happen in an specific tenant.
Exemple request / response:
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-14T22:50:03.603+00:00

Hi @Ulisses Maeda ,

Are you using multiple sign-in methods while creating the user ?
Also, have checked in the user audit logs for any other errors ?

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-14T23:58:35.07+00:00

Hi @Saurabh Sharma ,

thanks for your question.

I'm just using email as sign-in method.

Yes, I looked for logs but I didn't find anything. The better information that I have are the console logs from browser.

Regards
Maeda
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-20T23:40:38.927+00:00

@Ulisses Maeda
Ok. get it. Is the user you are adding not part of your domain ? I am also trying to check internally on this issue and get back to you.

Thanks
Saurabh
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-25T21:37:23.427+00:00

@Ulisses Maeda We need to have deeper investigation on this issue and your environment and so I suggest you to please open a Support ticket for the same. In case you have a limitation, please send an email to azcommunity@microsoft.com with your subscription id with this Q&A thread link and subject as "Attn: Saurabh' and I will help providing a free support ticket for you.

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-26T12:41:37.777+00:00

Hi @Saurabh Sharma ,

Sorry about my delayed answer. I've opened a case Ticket #2105110040007735 with MS. The 1st level didn't solve the issue anda raised to Product team. They're investigating as well. Do you have privilegies to access this ticket?

thanks again.

Regards,
Maeda
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2021-05-26T21:25:53.49+00:00

@Ulisses Maeda Great. yes, I have access to the case details. I could see that you are having some issues with the user's different tenants which support is looking into.
Please let me know if you need anything.

Thanks
Saurabh
Ulisses Maeda 1 Reputation point

2021-05-27T00:38:03.993+00:00

Hi @Saurabh Sharma ,

I'm really not sure if it's the issue (user's different tenant). It always worked well.
I've tried to create a local user inside a problematic tenant (******@mytenant.onmicrosoft.com)with admin privilegies. With this user I tried to create user (Azure AD B2C user) and I still have the same problem.

If It happen you can contact me to share my screen.

If you have a good idea let me know.

Regards,
Maeda
Dee Bolt 176 Reputation points

2021-05-27T08:01:55.66+00:00

Some of our clients are also having this issue. It seems to be an issue for tenants that were on the private preview of custom domains.
Anyone we've seen enrolled in the public preview for custom domains is unaffected.

Our investigation suggests that it is this API call, on page load, that is fowling the Graph API post when you click submit: https://graph.windows.net/myorganization/domains?api-version=1.6

If your custom domain comes in array 0 of that GET request, it will send graph api the wrong issuer. I.E. it will send yourcustomdomain.com and not tenantname.onmicrosoft.com

If your tenantname.onmicrosoft.com domain comes in array 0 the Graph API post will succeed.

Hopefully this helps give more context for your ticket :)

Best of luck,
Dee
Ulisses Maeda 1 Reputation point

2021-05-28T15:34:05.41+00:00

Hi @Dee Bolt ,

Indeed we have a custom domain. Your explanation can give some light to solve this issue. In the directory "two custom domains":

myorganization.com - status verified - not federated - not primary

myorganization.onmicrosoft.com with status Available - not federated - primary
Both domains have resources referencing them.

I'm using the own AD Screen to create user and investigating the browser request I can see that is using a custom domain (without onmicrosoft.com).

My question: What will happen if I change my custom domain (without onmicrosoft.com) to primary? Could I loose anything? I'd like to make it primary and retry the user creation. What do you think about it?

Regards.
Maeda
Dee Bolt 176 Reputation points

2021-05-28T16:14:24.62+00:00

You won't lose anything @Ulisses Maeda by switching your primary domain, however, it will also not solve the problem unfortunately (we tried this before).

From what we've seen so for this is a coding bug that cannot be fixed by config changes
Ulisses Maeda 1 Reputation point

2021-05-28T18:53:37.483+00:00

hi @Dee Bolt

Thanks for your answer.

I'd like to try a last choice. If I try to remove the custom domain name. Do you believe it could works?

Thanks again,
Maeda

Share via

Unable to create user - Azure B2C

Your answer