AADSTS16000 – Account from live.com cannot access Microsoft Services tenant application

Question

AADSTS16000 – Account from live.com cannot access Microsoft Services tenant application

Ken Micheni 0

Hello,

I am the tenant admin for the Microsoft Services Azure AD tenant. When I attempt to sign in to the Azure Portal or assigned applications, I receive the following error:

Code

interaction_required: AADSTS16000: User account '{EUII Hidden}' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application 'c44b4083-3bb0-49c1-b47d-974e53cbdf3c' (Azure Portal) in that tenant. 
The account needs to be added as an external user in the tenant first. 
Sign out and sign in again with a different Azure Active Directory user account. 
Trace ID: ca8c00c4-ea66-45ed-851e-7329b2d91300 
Correlation ID: 719883ec-23e8-4919-9ec7-15088ef6530f 
Timestamp: 2026-03-19 18:09:43Z

Steps I’ve already tried:

Added my account as internal (Member) in the tenant.

Verified Global Administrator role assignment.

Attempted to clear cached sessions and re-login.

Still blocked with “You do not have access to view services” in the portal.

Questions:

How can I correctly configure access when the tenant admin account is a live.com identity?

Is it required to create a native Azure AD organizational account instead of using a personal MSA?

If guest access is the only option for live.com, how can I elevate permissions so I can manage subscriptions and services?

Any guidance on resolving this mismatch between tenant ownership and account type would be appreciated.Title:

AADSTS16000 – Account from live.com cannot access Microsoft Services tenant application

Body: Hello,

I am the tenant admin for the Microsoft Services Azure AD tenant. When I attempt to sign in to the Azure Portal or assigned applications, I receive the following error:

Code

interaction_required: AADSTS16000: User account '{EUII Hidden}' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application 'c44b4083-3bb0-49c1-b47d-974e53cbdf3c' (Azure Portal) in that tenant. 
The account needs to be added as an external user in the tenant first. 
Sign out and sign in again with a different Azure Active Directory user account. 
Trace ID: ca8c00c4-ea66-45ed-851e-7329b2d91300 
Correlation ID: 719883ec-23e8-4919-9ec7-15088ef6530f 
Timestamp: 2026-03-19 18:09:43Z

Steps I’ve already tried:

Added my account as internal (Member) in the tenant.

Verified Global Administrator role assignment.

Attempted to clear cached sessions and re-login.

Still blocked with “You do not have access to view services” in the portal.

Questions:

How can I correctly configure access when the tenant admin account is a live.com identity?

Is it required to create a native Azure AD organizational account instead of using a personal MSA?

If guest access is the only option for live.com, how can I elevate permissions so I can manage subscriptions and services?

Any guidance on resolving this mismatch between tenant ownership and account type would be appreciated.

Rukmini 35,485 Reputation points Microsoft External Staff Moderator

2026-03-19T19:22:35.06+00:00
Hello Ken Micheni

Based on your description, it appears that you have created a Microsoft personal account, not an Azure work or school account. This is why you’re encountering errors when trying to access the Azure Portal.

Issue: When users try to login to Azure portal using their personal Microsoft Account (Outlook, Hotmail..) they are getting AADSTS160021 or AADSTS16000 or AADSTS50020 errors.

Reason: When signing in to the Azure portal with a personal Microsoft account, you are automatically connected to the Microsoft Services tenant (Tenant ID: f8cdef31-a31e-4b4a-93e4-5f571e91255a).

You can verify this by navigating to Microsoft Entra ID > Overview, where you’ll see this Tenant ID.

This default tenant does not have a directory associated with it, which you can confirm by going to the Settings blade. As a result, you cannot perform administrative actions such as:

Creating users or groups

Registering enterprise applications

Managing resources

In short, it’s a system tenant with restricted capabilities, and administrative access is not granted by default.

Solution: To fully utilize the Azure portal, you need to create your own tenant instead of relying on the Microsoft Services tenant.

Follow these steps:

Open an in-private/incognito browser window (to avoid automatic sign-in via SSO).

Navigate to https://azure.microsoft.com/en-us/free/ to sign up for a free Azure account.

During the setup, you’ll be prompted to create a new directory (tenant). Once completed, you will become the Global Administrator of this new tenant, giving you full access to manage Azure resources.

Let me know if you need help with the sign-up process or configuring your new tenant.

If you already have an existing tenant and still unable login, please share your email address over private message which used to login into Azure Portal.
Rukmini 35,485 Reputation points Microsoft External Staff Moderator

2026-03-20T18:24:01.78+00:00

Hello Ken Micheni Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Ken Micheni 0 Reputation points

2026-03-21T16:38:36.75+00:00

Hello new Rukmini. The issue was on restoring earlier directory /tenant .I created a new tenant/dires ctory but the problem persisted .As a result i've created a Support case as directed .Thank you so much
Rukmini 35,485 Reputation points Microsoft External Staff Moderator

2026-03-23T16:27:41.24+00:00

Hello Ken Micheni,

Lets continue over private messages!

1 answer

Your answer

Rukmini 35,485 Reputation points Microsoft External Staff Moderator

2026-03-20T18:24:01.78+00:00

Hello Ken Micheni Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Ken Micheni 0 Reputation points

2026-03-21T16:38:36.75+00:00

Hello new Rukmini. The issue was on restoring earlier directory /tenant .I created a new tenant/dires ctory but the problem persisted .As a result i've created a Support case as directed .Thank you so much
Rukmini 35,485 Reputation points Microsoft External Staff Moderator

2026-03-23T16:27:41.24+00:00

Hello Ken Micheni,

Lets continue over private messages!

Answer 1

The live.com account is a personal Microsoft account (MSA), not an organizational Microsoft Entra ID account. The error indicates that this MSA does not exist as a user in the Microsoft Services tenant, so it cannot access the Azure Portal application for that tenant.

From the provided context, MSAs can be used as external identities via OpenID Connect in an external tenant, but they are not native organizational accounts. For tenant administration and Azure Portal access, an organizational account in the tenant is required.

Based on the context:

A Microsoft account (live.com) can be configured as an external identity provider for customer/external tenants using OpenID Connect. This allows users to sign in to applications with their MSA, but this is explicitly for external customer scenarios and not for B2B guest users or core tenant administration.
The note in the MSA federation article states that this feature is available only for users who sign up with a Microsoft account (MSA) and is not available for B2B guest users invited to the tenant.

Given that, the implications for the scenario are:

A live.com MSA cannot function as a native organizational admin account for the Microsoft Services tenant.
To administer the tenant and access the Azure Portal for that tenant, a native Entra ID organizational account in that tenant is required.
Adding the MSA as a guest/external user does not convert it into a full organizational admin identity for tenant-level management.

Therefore, to resolve the mismatch:

Create or use a native organizational account in the Microsoft Services tenant (for example, a user with an @<tenantname>.onmicrosoft.com or verified custom domain) and assign it the Global Administrator role.
Use that organizational account to sign in to the Azure Portal for the Microsoft Services tenant and manage subscriptions and services.
The live.com account can be used as an external identity for customer-facing apps if configured via OpenID Connect, but not as the primary tenant admin identity.

This aligns with the documented pattern where MSAs are used via OIDC as external identities in customer tenants, while tenant administration is performed by organizational accounts in Entra ID.

References:

Add Microsoft account (live.com) as an OpenID Connect identity provider

Share via

AADSTS16000 – Account from live.com cannot access Microsoft Services tenant application

1 answer

Your answer