如何使用Microsoft Azure中的多租户应用程序在客户端的活动目录中注册应用程序？

Question

I have registered a multi-tenant app in my Azure subscription. using this App, I want to create an OAuth flow for my client to be able to give me permissions to create an app in his active directory.

We are using OpenID connect flow to access the Azure AD graph API.

In spite of making our app multi-tenanted via the console, we are getting the following error when the client (xyz@outlook.com) tries to sign in:

User account 'xyz@outlook.com' from identity provider 'live.com' does not exist in tenant 'Default Directory' and cannot access the application 'bf5ca806-xxxx-xxxx-xxx-xxxx' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account

I used the following endpoint to get an access token:

https://login.microsoftonline.com/common/oauth2/authorize?
client_id=xxxxxxxx-xxxx-xxxxx-xxxx-xxxxx
&response_mode=form_post
&response_type=code+id_token
&redirect_uri=http://localhost:8080
&prompt=admin_consent
&nonce=1234
&resource=https://graph.windows.net

Please help me to resolve this error

Answer 1

Unfortunately, you cannot use a guest user to login Azure AD Graph Explorer for now.

I came across the same issue as yours long time ago and I understand it's very important for customers. So, you can post your idea in this User Voice Page and the Azure Team will see it. I will also upvote for it.

But there are other solutions if you don't mind:

Solution 1: Try to use an internal account of that directory which upn ends with .onmicrosoft.com

Solution 2: Try to use other tools to get access token with a guest user(this account also need to be an admin of that directory), such as postman. Then you can use Postman to call Azure AD Graph API. You can refer to this blog to use Azure AD Graph API with Postman.

Hope this helps!