1

Referring to this Q&A: OneDrive External Sharing Does not ask for access code?

External sharing works as described, but afterwards there is no guest user created in the tenant and for every subsequent share instead of asking for a verification code the external user is propmpted to sign, only to receive the following error:

"AADSTS90072: User account 'xxxxxx' from identity provider 'live.com' does not exist in tenant 'xxxxx' and cannot access the application '00000003-0000-0ff1-ce00-000000000000'(Office 365 SharePoint Online) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account"

What could be the cause? This happens with recipients that have MS consumer accounts.

0

According to the error message,which means that the external account that the user signs in with doesn't exist on the tenant that they signed into; so the user can't satisfy the MFA requirements for the tenant. This error also might occur if the users are synced, but there is a mismatch in the ImmutableID (sourceAnchor) attribute between Active Directory and Azure AD. The account must be added as an external user in the tenant first. Sign out and sign in with a different Azure AD user account.

For more details, you can refer to this article: Azure AD Authentication and authorization error codes.

If you have configured MFA for external users, try to manually add the guest user in Azure AD then compare the result.

2
  • Adding the user manually as a guest results in a blank page with the error "403 forbidden". I would expect external sharing from OneDrive to work without any user having to register in any way and simply using Email code verification to access the shared files/folders. Is there a way to solve this issues or do you have any pointers on which of our configuration could be the cause of this? Even if adding the users manually as guests would work, it isn't practicable to add every external user as a guest when someone in the organisation wants to share something with an outside entity. Apr 20 at 10:17
  • Does your tenant set up MFA for external user in conditional access?Refer to the similar blog:cloudsecuritea.com/2020/01/…
    – Julie_MSFT
    Apr 21 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.