We have an app to consume SharePoint data that authenticates users using OAuth2 and App Registration in Azure AD. The app is multi-tenant as it should be available for multiple customers. Everything works great except one thing: when an external (guest) user from customer's tenant tries to sign in to the app, he receives the error stating AADSTS50020: User account 'X' from identity provider 'live.com' does not exist in tenant 'Dev_Tenant' and cannot access the application '<guid>' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

Dev_Tenant here is a tenant where the app was registered in Azure AD - tenant of the vendor that implemented the app.

But the user tries to access another tenant (Customer_Tenant) and he is added to the Customer_Tenant's Azure AD as external user.

Non-external users works fine for any tenant. But it looks like external users can sign in to such an app only if they're added as external users to the "initial" Dev_Tenant Azure AD, where the app was initially registered. Does anyone know about such limitations or issues?

Some additional details:

We're using OAuth2 v1 for the authentication.

During the signing in process the app redirects user to the common login url: Redirect(string.Format("https://login.microsoftonline.com/common/oauth2/authorize?resource=https%3A%2F%2F{0}&client_id={1}&response_type=code&state={2}", tenantUrl, WebConfigurationManager.AppSettings["AzureADClientId"], state));

After the code is requested, our app is requesting access_token using https://login.microsoftonline.com/common/oauth2/token url.

For external users the process fails on login part.

Again, everything works perfectly for internal users.

Thanks in advance for the help!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.