使用非管理员/Microsoft 帐户登录 Azure AD 时出现错误 AADSTS90093

Question

I've created a ASP.NET MVC web application that is configured to use the O365 Azure AD tenant of my company. I can login to the application with accounts that are Global Administrators in the Azure AD tenant, but login fails for both

• Internal users: O365 accounts that are no Global Administrators in the Azure AD tenant and
• Microsoft Accounts that are registered as Guest accounts.

The error message is:

AADSTS90093: This operation can only be performed by an administrator.

The Azure AD application is a single-tenant one (but changing it to multi-tenant does not solve the issue).

The application manifest is unchanged. How can I solve this and enable the login for both internal and external users?

Update

As far as I can see, the app also does not require any permissions that require admin consent.

Answer 1

The problem was that the application needed to be granted the permissions explicitely by clicking Grant permissions in the app registration settings:

After granting the permissions, users can log into the application without being Global Administrators.