Registering Email For Authentication

Question

Request Id: [Moderator note: personal info removed]

Correlation Id: [Moderator note: personal info removed]

Timestamp: 2026-02-17T16:20:40Z

Message: AADSTS50020: User account '[Moderator note: personal info removed]@sonorancitywraps.com' from identity provider '[Moderator note: personal info removed]/' does not exist in tenant 'legacycustomwraps.com' and cannot access the application '[Moderator note: personal info removed]'(My Signins) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account. Moved from: Microsoft 365 and Office | Other

Answer 1

Please note that this forum is a public platform, so we’ve adjusted your question to hide your organization’s domain name. For future posts, kindly avoid sharing any personal or organizational details to help protect your data. 

---

Hello @Legacy Custom Wraps

Welcome to the Microsoft Q&A Community! 

Thank you for contacting us. I reviewed the sign‑in message you received and can confirm that it matches Microsoft Entra ID error AADSTS50020.

Based on the official article Error AADSTS50020 - User account from identity provider does not exist in tenant | Microsoft Learn, this error occurs when a user attempts to access an application or resource in one Microsoft Entra tenant using an account that does not exist in that tenant as either a member or a guest.  

In your scenario, you are signing in with an account from the sonorancitywraps.com organization, while the application “My Sign‑ins” is being accessed within the legacycustomwraps.com tenant. Because your account is not present in the legacycustomwraps.com directory, authorization fails and the sign‑in is blocked. In this case: 

1. The account you are using belongs to a different organization than the tenant that hosts the application you are trying to reach. 
2. The application or tenant does not currently recognize your account as an allowed identity. 
3. Microsoft Entra ID prevents access until the account is added to the target tenant or you sign in with an account that already resides in that tenant.  

Common causes could be: 

1. The user has not been added to the target tenant as a guest or member.  
2. The application is configured for a single‑tenant audience only, which blocks users from other organizations or from personal Microsoft accounts where applicable.  
3. The sign‑in request uses an endpoint or URL that does not match the application’s supported account types, for example using a tenant‑specific endpoint when the app expects the common or organizations endpoint.  
4. The user is signed into a different organization in their browser session, or is attempting to use a personal Microsoft account where an Entra ID organizational account is required.  
5. The application requires explicit user assignment and the user has not been assigned. In some cases, a previously issued guest invitation may need to be re‑redeemed.  

For the end user, please choose among the options below that best matches your access scenario: 

Option 1: Sign in with an account that belongs to the target tenant 

If you have a legacycustomwraps.com organizational account, sign out of your current Microsoft session, then sign back in with your legacycustomwraps.com credentials and access the application again. Using a private or incognito browser window can help ensure a clean sign‑in.  

Option 2: Request a guest invitation to the target tenant 

If you do not have an account in the legacycustomwraps.com tenant, ask an administrator of that tenant to invite your sonorancitywraps.com address as a guest user. After you receive the invitation, open the invitation email, complete the acceptance process, and then sign in again. If prompted, switch your active organization to legacycustomwraps.com before opening the application.  

Option 3: Switch organizations if you are already a guest 

If you have previously been invited as a guest, open your Microsoft account settings, go to your list of organizations, and select legacycustomwraps.com as your active organization before accessing the application. If access still fails, sign out and sign back in to refresh the session.  

For admins, kindly perform the following checks and corrections: 

1/ Confirm that the user exists in the target tenant  Verify in Microsoft Entra Admin Center that the user appears as a member or guest. If not, invite the user as an external guest and ensure the invitation is redeemed successfully. If redemption is stuck, reset the guest redemption status and resend the invitation. 

2/ Review the application’s supported account types 

In App registrations, open the application, review the Supported account types (signInAudience in the manifest), and ensure it aligns with your access needs. If the application must accept users from multiple organizations, configure it as multitenant, or as multitenant plus personal Microsoft accounts if appropriate. Note that changing signInAudience may require re‑registering the application in some cases.  

3/ Use the correct authorization endpoint 

Ensure that your authentication flow uses an endpoint that matches the supported account types. For multitenant applications, use the common or organizations endpoint. For single‑tenant applications, use the tenant‑specific endpoint. Mismatched endpoints will cause sign‑in failures for external users. 

4/ Check user assignment requirements 

If the application is configured to require user assignment, assign the user or a relevant group to the application under Enterprise applications before they attempt to sign in. 

5/ Consider personal versus organizational account restrictions 

Some applications do not support personal Microsoft accounts. If personal accounts are not supported, ensure users sign in with organizational Entra ID accounts or adjust the app audience if personal accounts are intended to be allowed.  

Verification steps: 

1. After making the relevant change, have the user sign out of all Microsoft sessions or open a private browser session. 
2. If a guest invitation was sent, confirm that the user has accepted the invitation and that their user object appears in the legacycustomwraps.com directory. 
3. Confirm that the user’s active organization is set to legacycustomwraps.com at the time of access. 
4. Attempt to access the application again and review the sign‑in logs if the issue persists.  

Please let me know if there are any concerns or you need further assistance. I am happy to clarify! 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The error message you are encountering indicates that the user account ******@sonorancitywraps.com is not recognized in the tenant legacycustomwraps.com. To resolve this issue, the account needs to be added as an external user in the specified tenant. Here are the steps you can take:

1. Add the User as an External User: An administrator of the legacycustomwraps.com tenant needs to invite the user account to join the tenant as an external user. This can typically be done through the Azure portal or Microsoft Entra admin center.
2. Sign Out and Sign In Again: After the user account has been added, the user should sign out and then sign in again using the same account to access the application.

If the user continues to face issues, ensure that the correct identity provider is being used and that the user has the necessary permissions to access the application.

---

References:

• Create and customize a user flow
• Prerequisites