Does what you send in Scope Governs whether you can login with Microsoft Account using Azure AD V2 Endpoints

0
votes

I have registered a application using the App Registration (Preview) Blade and added the Azure Service Management API as API Permissions I downloaded the MSAL based Sample from

https://github.com/azure-samples/active-directory-dotnet-webapp-openidconnect-v2

Now in startup.auth.cs if i change the Scope i.e keep openid and add https://management.azure.com and then run and try and Login with a Microsoft Account i get the following error

This Doesn't Look like a Work or School Email you cant Sign-in here with Personal Account use your work or School Account Instead.

if i remove the Scope for https://managment.azure.com and just keep Openid profile offline_access i get the Consent Screen and Login

new OpenIdConnectAuthenticationOptions { // The Authority represents the v2.0 endpoint - https://login.microsoftonline.com/common/v2.0 // The Scope describes the initial permissions that your app will need. See https://azure.microsoft.com/documentation/articles/active-directory-v2-scopes/ ClientId = clientId, Authority = String.Format(CultureInfo.InvariantCulture, aadInstance, "common", "/v2.0"), RedirectUri = redirectUri, Scope = "openid https://management.azure.com/.default", PostLogoutRedirectUri = redirectUri,

I am Expecting to have the user Login and Obtain a Token for management API , i am Looking for Reasons for getting the above Error is this Expected ? The Account that i am using exists in my directory as a Member . this works if i use a Managed user([email protected]) to Login

1
azure-active-directorymsal
You should probably use organizations instead of common. That allows only AAD accounts (like the v1 common endpoint) – juunas

1 Answers

0
votes

Since personal MS accounts cannot be used to manage Azure subscriptions unless they are added to an Azure AD, you should use the organizations endpoint instead of common.

In v1 "common" meant any AAD tenant. In v2 "common" means any AAD tenant + any personal MS account. If you wanted only personal accounts, you can use "consumers".

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc#fetch-the-openid-connect-metadata-document

You can use "organizations" to allow any AAD tenant but disallow MS accounts. Of course a user can just edit the URL and login with a personal MS account anyway, so you'll want to check the tenant id of the logged in user.

The tenant id for MS accounts is always 9188040d-6c67-4c5b-b112-36a304b66dad, per the docs: https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#payload-claims. So check the idp claim.