How to fix 'OpenIdConnectMessage.Error was not null, indicating an error. Error: 'access_denied' using Azure Active Directory

2
votes

This server '/' error pops up in my application if the user is signed in to another AAD account with a different domain, is there a way to make the azure website redirect back to the log in page so he/she can sign in to the proper user account instead of showing this error?

"OpenIdConnectMessage.Error was not null, indicating an error. Error: >'access_denied'. Error_Description (may be empty): 'XXXYYY00000: User account '{EmailHidden}' from identity provider 'live.com' does not exist in tenant 'XXXX' and cannot access the application '00X1XXX0-XXXX-XXXX-XXXX-XXXXXXXXXXXX'(00000_website.azurewebsites_XXXX) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account Trace ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Correlation ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Timestamp: 2019-09-11 02:31:47Z'. Error_Uri (may be empty): 'https://login.microsoftonline.com/error?code=90072'."

1
azureazure-active-directory
What do you use as authority for your app? – juunas

1 Answers

0
votes

So you are using single tenant to let only your tenant users to login, right? If you don't want to get this error message, you can detect the error in your code and redirect it to the login page directly.

However, I think this error page is needed, since we can know clearly why we can not login in. Then we can login with the correct account.