Azure Active Directory - User account doesn't exist in tenant and cannot access application

Question

Azure Active Directory - User account doesn't exist in tenant and cannot access application

Jacob Zhang 26

I am trying to setup OAuth with Azure Active Directory with next-auth.js, and I have registered a multi-tenant application and have the correct credentials and use the /common endpoint. I can sign in through the account I registered the app under, but when I try signing in with a different outlook account, it throws this error:
AADSTS50020: User account 'user@harsh.com .com' from identity provider 'live.com' does not exist in tenant 'Default Directory' and cannot access the application '<id>' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

I'm not sure what other configurations I should do. Do I need to be a verified publisher? I actually don't think I have an azure account tied with this outlook account since it won't let me create one :(

Thanks!

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-08-24T06:09:14.51+00:00

Hi @Jacob Zhang ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "[Accept the answer][1]" for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

.
Jacob Zhang 26 Reputation points

2022-08-24T17:49:31.243+00:00

My question still remains. I'm not trying to invite users into my tenant, but rather, simply accept all users regardless of whether they're in my tenant or not. I'm pretty sure I've configured my settings correctly to allow multi-tenant, but it doesn't seem to work. Please refer to the discussion below for what Mohammed and I have been talking about.

Accepted answer

1 additional answer

Your answer

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-08-24T06:09:14.51+00:00

Hi @Jacob Zhang ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "[Accept the answer][1]" for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

.
Jacob Zhang 26 Reputation points

2022-08-24T17:49:31.243+00:00

My question still remains. I'm not trying to invite users into my tenant, but rather, simply accept all users regardless of whether they're in my tenant or not. I'm pretty sure I've configured my settings correctly to allow multi-tenant, but it doesn't seem to work. Please refer to the discussion below for what Mohammed and I have been talking about.

Answer 1

Shweta Mathur 30,296 Microsoft Employee Moderator

Hi @Jacob Zhang ,

Thanks for reaching out.

I understand you are trying to authenticate using external user account, outlook.com to your registered application and getting the error "AADSTS50020: User account 'user@harsh.com .com' from identity provider 'live.com' does not exist in tenant 'Default Directory".

As mentioned by @ MohammedAltamashKhan-3285, you need to invite that outlook account as guest user in your organization to access the application.

Azure AD allow you to access External Identities by invite the users as guest users to collaborate with your organization. A invitation and redemption process allow external users to use their own credentials to access your company's resources.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

Also as you mentioned, you don't want to invite users and allow all the users to access your application, then you need to add self service sign up user flow where user need to sign up for an application which create users as guest users to access the application.

Hope this will help.

Thanks,
Shweta

Jacob Zhang 26 Reputation points

2022-08-29T17:53:04.867+00:00

Thanks! This is what I was looking for! Though this can be mistaken as creating an entirely new email account and not a new account under the app, it does the job.
Jacob Zhang 26 Reputation points

2022-08-31T23:53:16.877+00:00

Following up on your solution of self-service sign up, is it possible to skip this step of registering? I find the flow to be a little bit extra, since they have to re-enter their information when I they have it already on their accounts.

Moreover, when logging in, if the user isn't registered, it'll throw an error with a link to "create an account" (register), but can I automatically register a user if they aren't already part of my tenant?

Answer 2

Mohammed Altamash Mohammed Suleman Khan 2,331

Hi @Jacob Zhang

From the error its seem like the account doesn't exist in your tenant , you may need to invite that outlook account as guest user and assign permission over that application.

For your reference : https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/error-code-aadsts50020-user-account-identity-provider-does-not-exist

Regards

--please don't forget to Accept as answer if the reply is helpful--

Jacob Zhang 26 Reputation points

2022-08-18T05:19:39.977+00:00

Thanks for letting me know of this method. But is it possible to do multi-tenant without manually inviting users? Even though this is for a personal project, I'd like to be able to have any user with an outlook account sign in.

Thanks for the suggestion though!
Mohammed Altamash Mohammed Suleman Khan 2,331 Reputation points

2022-08-18T05:36:38.9+00:00

Hi @Jacob Zhang

In your second line when you say " but when I try signing in with a different outlook account, it throws this error: "

1) Can i ask you why you use different outlook account ? Of course Azure AD wont recognize other outlook account and that error is expected. ( Just for curiosity im asking)
2) For a moment lets say you want to use other outlook account to access your app registered on single tenant then have you tried this setting , this should resolve your issue
you need to mention the third value i.e

PersonalMicrosoftaccount

from below image :

Follow the step and let me know if that works for you. &
--please don't forget to upvote and Accept as answer if the reply is helpful--
Jacob Zhang 26 Reputation points

2022-08-18T06:09:30.35+00:00

My personal project is basically a forum with oauth sign ins (with outlook, gmail, other email services that next-auth.js offers). So for oauth using outlook, I need Azure's active directory (see here: https://next-auth.js.org/providers/azure-ad).

As for the app's current setting, it is set to multi-tenant with the manifest value as "signInAudience": "AzureADMultipleOrgs". I also tried changing it to AzureADandPersonalMicrosoftAccount with "accessTokenAcceptedVersion": 2 for multi-tenant with orgs & personal accounts, but I got the same error.

Share via

Azure Active Directory - User account doesn't exist in tenant and cannot access application

1 additional answer

Your answer