CODEWITHSUNDEEP
azureactive-directorypassport-azure-ad
Ernie
Ernie

Reputation: 1000

Single Sign on with personal Microsoft account doesn't work in registered app in Azure

We registered an app in Azure with our corporate account. We've set it as a web-app type, and set the signInAudience to AzureADandPersonalMicrosoftAccount

It works when we sign into our web-app with a corporate account, but when we use a personal microsoft account with hotmail address, we get the following message:

AADSTS50020: User account '*********@hotmail.com' from identity provider 'live.com' does not exist in tenant '*********' and cannot access the application '******'(***-api) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

We double checked all settings and they look valid. We've ran out of ideas Here's a version of our manifest:

{
    "id": "**********",
    "acceptMappedClaims": null,
    "accessTokenAcceptedVersion": 2,
    "addIns": [],
    "allowPublicClient": null,
    "appId": "*********",
    "appRoles": [],
    "oauth2AllowUrlPathMatching": false,
    "createdDateTime": "2020-08-04T14:32:25Z",
    "groupMembershipClaims": "None",
    "identifierUris": [
        "https://***.company.be"
    ],
    "informationalUrls": {
        "termsOfService": "https://www.company.be/legals/gebruiksvoorwaarden",
        "support": null,
        "privacy": "https://www.company.be/legals/privacy",
        "marketing": null
    },
    "keyCredentials": [],
    "knownClientApplications": [],
    "logoUrl": "https://secure.aadcdn.microsoftonline-p.com/...",
    "logoutUrl": null,
    "name": "***-api",
    "oauth2AllowIdTokenImplicitFlow": true,
    "oauth2AllowImplicitFlow": false,
    "oauth2Permissions": [],
    "oauth2RequirePostResponse": false,
    "optionalClaims": {
        "idToken": [
            {
                "name": "email",
                "source": null,
                "essential": false,
                "additionalProperties": []
            },
            {
                "name": "family_name",
                "source": null,
                "essential": false,
                "additionalProperties": []
            },
            {
                "name": "given_name",
                "source": null,
                "essential": false,
                "additionalProperties": []
            }
        ],
        "accessToken": [],
        "saml2Token": []
    },
    "orgRestrictions": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [
        {
            "customKeyIdentifier": null,
            "endDate": "2299-12-30T23:00:00Z",
            "keyId": "**********",
            "startDate": "2020-08-04T14:47:56.759Z",
            "value": null,
            "createdOn": "2020-08-04T14:47:58.647043Z",
            "hint": "gIh",
            "displayName": "*****-api clientSecret"
        }
    ],
    "preAuthorizedApplications": [],
    "publisherDomain": "company.be",
    "replyUrlsWithType": [
        {
            "url": "http://localhost:3000/link/microsoft/callback",
            "type": "Web"
        },
        {
            "url": "https://api.copmpany.be/link/microsoft/callback",
            "type": "Web"
        },
        {
            "url": "https://api.copmpany.be/auth/microsoft/callback",
            "type": "Web"
        },
        {
            "url": "https://api.staging.copmpany.be/link/microsoft/callback",
            "type": "Web"
        },
        {
            "url": "https://api.staging.copmpany.be/auth/microsoft/callback",
            "type": "Web"
        },
        {
            "url": "http://localhost:3000/auth/microsoft/callback",
            "type": "Web"
        }
    ],
    "requiredResourceAccess": [
        {
            "resourceAppId": "***",
            "resourceAccess": [
                {
                    "id": "****",
                    "type": "Scope"
                },
                {
                    "id": "***",
                    "type": "Scope"
                },
                {
                    "id": "***",
                    "type": "Scope"
                },
                {
                    "id": "***",
                    "type": "Scope"
                },
                {
                    "id": "***",
                    "type": "Scope"
                }
            ]
        }
    ],
    "samlMetadataUrl": null,
    "signInUrl": "https://www.company.be",
    "signInAudience": "AzureADandPersonalMicrosoftAccount",
    "tags": [
        "webApp",
        "notApiConsumer"
    ],
    "tokenEncryptionKeyId": null,
    "verifiedPublisher": {
        "displayName": null,
        "verifiedPublisherId": null,
        "addedDateTime": null
    }
}

Upvotes: 3

Views: 1824

Answers (4)

Yigit Yuksel
Yigit Yuksel

Reputation: 1170

Sign in option AzureADandPersonalMicrosoftAccount only works with v2.0. Hence, the authority URL should be this:

https://login.microsoftonline.com/common/v2.0

In addition to that, for multitenant applications, ValidateIssuer option should be disabled. You can do that in this way:

auth.AddOpenIdConnect(authScheme, displayName, options =>
{
   options.TokenValidationParameters.ValidateIssuer = false;
)};

Upvotes: 2

Dhivya G - MSFT Identity
Dhivya G - MSFT Identity

Reputation: 268

In addition to Sarthak's answer if your business scenario doesn't need to access your tenant's resource like call MS Graph API for your tenant, You could change your authority Uri to common endpoint which supports MSA without inviting into tenant. Please refer the documentation on for the authority endpoints. Depending upon your business scenario, choose your solution.

Upvotes: 2

Sarthak Vijayvergiya
Sarthak Vijayvergiya

Reputation: 91

From your manifest file I can see that your app is already registered as multi-tenant, so no need to change any settings there.

The user should be invited before we sign or connect with our azure active directory as an external user, follow the below steps:

  1. Visit here https://portal.azure.com/#blade/Microsoft_AAD_IAM/UsersManagementMenuBlade/MsGraphUsers
  2. Invite as a guest user
  3. Then the invited user will get an invitation, accept that first.
  4. Retry to access the web app.
  5. Definitely it would work.

Upvotes: 0

azMantas
azMantas

Reputation: 232

The app should be registered as multi-tenant for this to work.

Upvotes: -1

Related Questions