VSTS login fails with 401 not authorized - [user] has multiple accounts associated with it

2
votes

I try to give new users in our domain access to our VSTS. We have MSDN enterprise subscriptions via MPN. The subscription is assigned and visible for the user if he logs in my.visualstudio.com with his work account. If the user tries to access the VSTS at [ourprojects].visualstudio.com he gets “VSTS login fails with 401 not authorized – [user] has multiple accounts associated with it. Your work or school account does not have access to [ourprojects].visualstudio.com, but your personal account does have access. “.

Signing in with the personal account as suggested by the error message leads to another error: “This Microsoft account does not exist.” This is correct. The account in charge is definitely a work account in Microsoft Azure Active Directory. So the first error message is somehow strange and leads into the wrong direction.

Our domain accounts are synchronized with Azure Active Directory (AAD). I can see the new users both in our domain and AAD. The user can login into my.visualstudio.com with his work account. So sync with Windows Server AD and AAD looks working correctly. MSDN assignment works, too.

Loggin into my.visualstudio.com redirects to the login page of our domain. thsi is corect and works fine. But this redirect does not take place loggin into VSTS.

For other older accounts in our domain VSTS access with work account works completely fine. Has anybody experienced similar problems?

1
loginazure-devopsazure-active-directorymsdn
Is this email address accociated with both Work school account and Personal account? E.g When you login, VSTS will let you choose which account you want to login – Wayne Yang
no, it is a work account only – Lars
Try to go to user profile page, then choose corresponding AAD, after that try to login to that VSTS and check the result. – starian chen-MSFT
which user profile page? – Lars

1 Answers

2
votes

Finally I talked to Microsoft support. It turned out that this VSTS account is not backed by Azure Active Directory. It has to be converted to do so.

To check if a Azure DevOps/VSTS account is backed by AAD, you can look in the settings page ("gears"->Settings) of Azure DevOps at the very bottom.