Authentication issue – “Selected user account does not exist in tenant…” despite allowing all account types

Question

Hello,

We are experiencing an authentication issue with our application configured in Entra ID. Despite the fact that our application is set to accept all account types (Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)), certain users are receiving the following error message upon sign-in:

“Selected user account does not exist in tenant ‘REDACTEED’ and cannot access the application ‘REDACTED’ in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.”

We have verified the following:

• The app registration is properly configured to accept all supported account types.
• Redirect URIs and permissions are configured correctly.

Could you please advise why this message appears and whether there might be a configuration or caching issue on the Entra ID side?

Thank you in advance for your help.

Answer 1

Hello @Łukasz Boruń,

Thanks for using Q and A forum.

This situation typically arises when the app registration is set to a single-tenant account type, which prevents users from other directories or identity providers from signing in.

To resolve this issue, you should ensure that your app registration supports multiple account types.

You can do this by checking the signInAudience setting in the app registration manifest in the Azure portal. It should be set to one of the following values: AzureADandPersonalMicrosoftAccount, AzureADMultipleOrgs, or PersonalMicrosoftAccount. If it is not, you will need to recreate the app registration with the correct account type selected.

Additionally, if the application is intended to allow users from other organizations to sign in, ensure that you are using the correct sign-in URL. For multitenant applications, the URL should be https://login.microsoftonline.com/organizations. If you are using a tenant-specific URL, users from other organizations will not be able to access the application unless they are added as guests in the tenant.

Lastly, if the application is configured to allow personal accounts, ensure that the sign-in URL is set to https://login.microsoftonline.com/common.

---

If the Answer is helpful, please click Accept Answer and Up-Vote 👍, so that this can be beneficial to other community members.