¿Cómo puedo solucionar este error AADSTS50020?

Jorge Bringas Fernandez 1

AADSTS50020: La cuenta de usuario 'gbringashotmail@Karima ben .com' del proveedor de identidades 'live.com' no existe en el inquilino 'Microsoft Services' y no puede acceder a la aplicación '7c5b1c3e-563e-479d-bfac-32cf49d8ba97' (implicit-flow-example-2) en ese inquilino. La cuenta debe agregarse primero como usuario externo en el inquilino. Cierre la sesión y vuelva a iniciar sesión con una cuenta de usuario de Azure Active Directory diferente.

1 answer

AmanpreetSingh-MSFT 56,506 Reputation points

2022-02-07T13:56:31.467+00:00
Hi @Jorge Bringas Fernandez • Thank you for reaching out.

This error occurs when the user trying to sign in to the application is not present in the tenant where you have registered the application. To resolve this error, you have 2 options:

Invite the user as an External/Guest user. Sign in to the Azure portal with a user account that is assigned with Guest Inviter/User Administrator/Global Administrator directory role. Navigate to Azure Active Directory > Users > +New guest user > select Invite user and then add the guest user's information. An email will be sent to the user with a redemption link that the user needs to access to accept the invite.

Allow the user(s) to do a self-service sign-up. If you don't want to invite the user, you can choose to create a user flow and add your application to the user flow as highlighted below. This method is helpful when you don't know the users who will be accessing your application.

Users can then perform the below steps to create their own account and access the application:

The account can then be seen in Azure AD as shown below:

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Jorge Bringas Fernandez 1 Reputation point

2022-02-08T06:53:06.37+00:00

No me es posible ninguna de las 2 soluciones.
Debe haber algún problema con mi cuenta, porque están deshabilitados todos esos botones: "Nuevo usuario", "Nuevo usuario invitado", "Identidades Externas"
Supongo que debo pedir una revisión de la cuenta, pero ¿en dónde?
Gracias!

AmanpreetSingh-MSFT 56,506 Reputation points

2022-02-08T07:42:22.137+00:00

@Jorge Bringas Fernandez · Looks like you are signed in to Azure Portal with a standard user account. The Guest Inviter or User Administrator or Global Administrator directory role must be assigned to the user account you are signed in with. To access "External Identities", you must have the Global Administrator role assigned to your user account. Please check with your tenant administrator to either configure these settings or add you to the required role(s) by navigating to Azure AD > Roles and administrators > Select the role > +Add assignment.

Jorge Bringas Fernandez 1 Reputation point

2022-02-08T08:33:44.07+00:00

Cuando hago clic en "Roles y Administradores", me sale un mensaje: "Sin acceso"
Supongo que si pregunto a "Soporte Técnico" me darán alguna aclaración sobre mi cuenta, ¿no?
Gracias

Jorge Bringas Fernandez 1 Reputation point

2022-02-08T08:46:26.46+00:00

Me comentan de Soporte Técnico que para hacer esto necesito contratar una suscripción.
Pensé que para hacer pruebas bastaba con una cuenta gratuita, pero no.

AmanpreetSingh-MSFT 56,506 Reputation points

2022-02-08T09:55:36.547+00:00

@Jorge Bringas Fernandez • For the above 2 options I provided in my answer, you do not need a subscription. However, to open a support ticket you need a subscription. If you know the person who created the Azure account / Azure AD tenant, you can ask him/her to add you in the global administrator role.

Jorge Bringas Fernandez 1 Reputation point

2022-02-08T12:27:05.107+00:00

Es que precisamente es mi cuenta, está creada por mí... con mi email y mis datos
No entiendo... me da este error

{ "shellProps": { "sessionId": "5699ec33e2a04135804ea3f910fb87c3", "extName": "Microsoft_AAD_IAM", "contentName": "SignInEventsV3Blade", "code": 403 }, "error": { "message": "No tiene acceso a estos datos. Póngase en contacto con el administrador global para obtener acceso.", "code": 403 }}

AmanpreetSingh-MSFT 56,506 Reputation points

2022-02-09T06:46:46.747+00:00

@Jorge Bringas Fernandez • By default, the user who creates the Azure Account has full access to the Azure AD tenant. Please confirm if you are connected to the correct tenant via the Directory+Subscription blade. If you have multiple directories listed there, try to switch to another directory and check if you have access to these options.

Jorge Bringas Fernandez 1 Reputation point

2022-02-09T08:45:20.12+00:00

No tengo nada en ese apartado.
Lo que si veo es un error de autenticación.

AmanpreetSingh-MSFT 56,506 Reputation points

2022-02-10T09:40:25.333+00:00

@Jorge Bringas Fernandez • There should be at least one tenant listed. Could you please confirm how the aplicación '7c5b1c3e-563e-479d-bfac-32cf49d8ba97' (implicit-flow-example-2) was registered and in which tenant it was registered?

Jorge Bringas Fernandez 1 Reputation point

2022-02-11T07:50:23.637+00:00

¿Te refieres a esto?

¿y ahora?

Jorge Bringas Fernandez 1 Reputation point

2022-02-11T07:53:54.94+00:00

Y para crear el registro seguí este tutorial:

https://www.returngis.net/2019/04/ejemplo-de-implicit-flow-de-oauth-2-0/

AmanpreetSingh-MSFT 56,506 Reputation points

2022-02-14T12:21:39.363+00:00

@Jorge Bringas Fernandez • As documented HERE, the tenant ID f8cdef31-a31e-4b4a-93e4-5f571e91255a is the Microsoft Service's AAD tenant ID. This matches with the tenant ID you have highlighted above. As you are not the admin of this tenant, that is why you don't get the option to create new users. Please create a new Azure AD tenant as per the instructions provided in the Quickstart: Create a new tenant in Azure Active Directory document. The account that you use to register the application in the new tenant, will have full rights to register new applications and create new users in the new tenant.

Jorge Bringas Fernandez 1 Reputation point

2022-02-16T10:14:27.023+00:00

No puedo hacer lo que indica ese documento.
El botón de "Crear Inquilino" está deshabilitado.

AmanpreetSingh-MSFT 56,506 Reputation points

2022-02-16T16:51:13.653+00:00

@Jorge Bringas Fernandez · I did some more research on this.

You need to create your own tenant rather than using the Microsoft Services (f8cdef31-a31e-4b4a-93e4-5f571e91255a) tenant. When you create a new tenant, you by default become the Global Administrator of the new tenant and have full access to all the options in that tenant.

To create a new tenant, open in-private/incognito browser window (just to avoid SSO), access https://azure.microsoft.com/en-us/free/ to create a free Azure account.

Alternatively, you can ask the global administrator or any existing Azure AD tenant to invite you as a guest user as mentioned here: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/add-users-administrator#add-guest-users-to-the-directory. Once you are added to an azure tenant and you accept the invite sent to you via email, you can use https://portal.azure.com/#create/Microsoft.AzureActiveDirectory URL to create your own tenant as well.

Jorge Bringas Fernandez 1 Reputation point

2022-03-03T09:50:14.533+00:00

Nada, esto es imposible... he creado ya 3 cuentas y en ninguna de ellas me deja crear nuevos inquilinos.

Me olvido de Microsoft para siempre... ya busco algún otro que no lo ponga tan difícil.
(también resulta imposible ahora añadir aquí otra captura de pantalla)
Sign in to comment

Share via

¿Cómo puedo solucionar este error AADSTS50020?

1 answer