如何允许公开登录我的 Azure 租户中的应用注册？

Question

I'm trying to create an app hosted in Azure that (should) allow public login, as long as you have a Microsoft account. I don't care if it's a business or personal account. You just need to be able to log in. I'm creating a SPA and an API.

So I went to the Azure portal and created an app registration and configured the app reg to allow all users from within, or outside the organization with a valid personal or business Microsoft account.

Now the SPA is an Angular app and I use Damien Bod's OpenId library to log in. When I point the stsServer to my login endpoint ( https://login.microsoftonline.com/{my-tenant-id}/v2.0 ) and log in, all works fine, except when I log in using an account outside the organization (for example my personal account).

I get receive the following error:

AADSTS50020: User account 'xxxx@xxxx.xxx' from identity provider 'https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/' does not exist in tenant 'Default Directory' and cannot access the application 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'(App Name) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

Now the problem is that I simply don't want to add all these users, but allow them access to this app. How can I do that?

Thanks a bunch!

Answer 1

If you want to allow any account to sign in, you can't use your tenant-specific login endpoint. You need to use the "common" endpoint: https://login.microsoftonline.com/common/v2.0 . This allows login with any Azure AD / Personal Microsoft account.