Azure Active Directory 多租户：租户中不存在用户

Question

I'm new to AAD and I'm trying to allow sign-ins for users in tenants outside of my current one (the tenant that I set up AAD with). I have two outlook accounts that I'm testing with. And when I sign in with the other outlook account, I get the error:

"AADSTS50020: User account 'user@outlook.com' from identity provider 'live.com' does not exist in tenant 'Default Directory' and cannot access the application '' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account."

I don't want to invite any users to my tenant, since if there are more users, they'll also have to be invited. I set up the configuration to be multi-tenant (orgs & personal accounts), and my api hits the /common endpoint.

Is there something that I'm missing? Or am I misunderstanding how multi-tenant works? Thanks!

Answer 1

"AADSTS50020: User account 'user@outlook.com' from identity provider 'live.com' does not exist in tenant 'Default Directory' and cannot access the application '' in that tenant

This error will occur whenever a guest user tries to access a resource or application within the resource tenancy, the sign-in process fails and display an error.

To resolve this issue, Go to azure portal -> App registrations-> your App -> Manifest -> check signInAudience -> AzureADandPersonalMicrosoftAccount like below.

• If signInAudience property is missing in your manifest, try to recreate app registration by choosing the appropriate account type.
• If the users sign in into your tenant with their personal account, they need to be added as guest users even you select multi-tenant account type.

If there are more users, you can make use of bulk invite option by modifying UserInviteTemplate.csv file like below.

1. Go to Azure active directory -> users -> bulk operation -> Download the csv template .

2. In template, add the list of user's email address to invite as below.

3. Upload UserInviteTemplate.csv file in bulk invite user.

4. To check whether the guest users are added or not, you can filter user type == guest as below.

Reference : Error AADSTS50020 - User account from identity provider does not exist in tenant - Active Directory | Microsoft Docs