I want my app to behave like Slack. (Teams Online Meet)

Question

I want my app to behave like Slack. (Teams Online Meet)

flow dev1 31

Hello,
I’m have question about Azure login.
I have create an app through Azure Portal - Azure Active Directory.
However, users from other organizations cannot access to my application.

Is there anyway users from other organizations can directly access my application just by logging in to their account? Just like Slack?
The only way we can give an access is we manually add it as my tenant's guest.

Thank you for your time.

Accepted answer

0 additional answers

Your answer

Answer 1

CarlZhao-MSFT 46,376

Hi @flow dev1

Of course, you just need to change your application to multi-tenant application and then change /tenant id to /common when users from other organizations log in.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

flow dev1 31 Reputation points

2022-05-12T09:57:48.7+00:00

It is set up as multi-tenant. However
There is an error saying that it does not belong to this app's tenant. Slack is available to all users.

Translation is not smooth using a translator.

I am attaching an error message as well.

----------

AADSTS50020: User account '******@kyowon.co.kr' from identity provider 'https://sts.windows.net/6aba328a-b414-4a52-bf31-46f3e35e8b39/' does not exist in tenant 'Madrascheck' and cannot access the application '9adf41af-3031-41a0-aaad-eeba5a7a35ab'(flow) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

Request Id: c05e7479-682e-4ae6-b8f2-a9ea6977a900
Correlation Id: 4b3d5ed6-cc4f-47de-925d-fbfb00377d20
Timestamp: 2022-05-12T09:34:16Z
Message: AADSTS50020: User account '******@kyowon.co.kr' from identity provider 'https://sts.windows.net/6aba328a-b414-4a52-bf31-46f3e35e8b39/' does not exist in tenant 'Madrascheck' and cannot access the application '9adf41af-3031-41a0-aaad-eeba5a7a35ab'(flow) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
CarlZhao-MSFT 46,376 Reputation points

2022-05-12T10:02:01.05+00:00

Hi @flow dev1 Did you change /tenant id to /common?
CarlZhao-MSFT 46,376 Reputation points

2022-05-12T10:16:48.567+00:00
Hi @flow dev1 Your login URL must use the /common endpoint because users from other organizations are not in your tenant, so you cannot log in using the /tenant id endpoint.

https://login.microsoftonline.com/common
flow dev1 31 Reputation points

2022-05-12T12:05:58.633+00:00

It seems that we are one step closer to solving the problem. thank you.

But I faced another problem.

Thanks to your help, I was able to get an Access Token.

However, when I tried to open an online meeting with the issued Access Token, a problem arose.

{"error":{"code":"Forbidden","message":"","innerError":{"request-id":"3913d119-9fa1-4ddd-a295-1519278f7bc0","date":"2022 -05-12T11:58:22","client-request-id":"3913d119-9fa1-4ddd-a295-1519278f7bc0"}}}

This error does not occur when creating an Online Meeting with an account that is within the Tenant, it only happens to people outside your organization.

Maybe I need to change the app settings?
CarlZhao-MSFT 46,376 Reputation points

2022-05-13T01:48:57.337+00:00

Hi @flow dev1 It looks like your token doesn't have permission, can you use https://jwt.ms/ to parse your access token and share a screenshot?
CarlZhao-MSFT 46,376 Reputation points

2022-05-16T01:41:41.5+00:00

Hi @flow dev1

Is there anything else I can help with regarding this issue?

You can comment us at any time and we will continue to follow up.

Thanks,
Carl Zhao
flow dev1 31 Reputation points

2022-05-16T07:28:24.343+00:00

Hi @CarlZhao-MSFT

I didn't see the [More comments] button and thought there was no reply.

Anyway, I disassembled the token and got the result like the picture above.

I noticed that the "scp" value has no scope related to online meetings.

However, when I receive a token, I receive the "SCOPE" value as 'https://graph.microsoft.com/.default'.

Tokens issued with this value are not a problem when opening an online meeting from an account belonging to my organization.

However, if an account that is not part of my organization opens an online meeting, I get a Forbbiden error. Without other detailed messages.

Thanks
CarlZhao-MSFT 46,376 Reputation points

2022-05-16T07:37:41.567+00:00

From the parsed token, you are missing the OnlineMeetings.ReadWrite delegated permission. When requesting a token you can set the scope to: scope=OnlineMeetings.ReadWrite.

CarlZhao-MSFT 46,376

Hi @flow dev1

Code endpoint:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?  
client_id={client_id}  
&response_type=code  
&redirect_uri={redirect_uri}  
&response_mode=query  
&scope=OnlineMeetings.ReadWrite  
&state=12345

Token endpoint:

CarlZhao-MSFT 46,376 Reputation points

2022-05-16T08:36:14.857+00:00

Hi @flow dev1 , has the issue been solved?
flow dev1 31 Reputation points

2022-05-16T09:07:52.003+00:00

Hi @CarlZhao-MSFT

I put "OnlineMeetings.ReadWrite" in the parameter "scope" as shown in the picture above.

DAB :: {
scope: 'OnlineMeetings.ReadWrite'
}

But from the result

body {
scope: 'Mail.Read offline_access User.Read'
}
comes the result.

Is there any logic to forcibly change this? Or is it my mistake?
CarlZhao-MSFT 46,376 Reputation points

2022-05-16T09:17:30.92+00:00

Hi @flow dev1

When you get the code, the browser will pop up a page asking you to consent to the OnlineMeetings.ReadWrite permission, have you accepted?
flow dev1 31 Reputation points

2022-05-16T09:58:55.71+00:00

thank you so much @CarlZhao-MSFT

I was able to solve it thanks to you
CarlZhao-MSFT 46,376 Reputation points

2022-05-16T10:40:40.41+00:00

Hi @flow dev1 , glad to know your issue has been resolved :)

--please don't forget to upvote and Accept as answer if the reply is helpful--
CarlZhao-MSFT 46,376 Reputation points

2022-05-18T02:48:57.467+00:00

Hi @flow dev1 ,

Have a good day!

If my answer is helpful to you, you can accept it as the standard answer, it will help more members who encounter similar problems.

Thanks,
Carl Zhao

Share via

I want my app to behave like Slack. (Teams Online Meet)

0 additional answers

Your answer