Oath problem with Microsoft personal account authentication

Question

Hello guys i have this problem when i try to autenticate a personal account microsoft through Oauth2. My endpoint URL is configured on common already

The application is configured as a multitenant:

My manifest is:

{
"id": "0982f18d-116c-45c0-b1ee-59dd9fa3344b",
"acceptMappedClaims": null,
"accessTokenAcceptedVersion": 2,
"addIns": [],
"allowPublicClient": null,
"appId": "002543f2-87b6-43e4-91a3-cfdef655dc7a",
"appRoles": [],
"oauth2AllowUrlPathMatching": false,
"createdDateTime": "2021-02-04T10:09:11Z",
"disabledByMicrosoftStatus": null,
"groupMembershipClaims": null,
"identifierUris": [],
"informationalUrls": {
    "termsOfService": null,
    "support": null,
    "privacy": null,
    "marketing": null
},
"keyCredentials": [],
"knownClientApplications": [],
"logoUrl": null,
"logoutUrl": null,
"name": "AppBotTipBook",
"oauth2AllowIdTokenImplicitFlow": false,
"oauth2AllowImplicitFlow": false,
"oauth2Permissions": [],
"oauth2RequirePostResponse": false,
"optionalClaims": null,
"orgRestrictions": [],
"parentalControlSettings": {
    "countriesBlockedForMinors": [],
    "legalAgeGroupRule": "Allow"
},
"passwordCredentials": [
    {
        "customKeyIdentifier": null,
        "endDate": "2299-12-30T23:00:00Z",
        "keyId": "86c3141b-02ac-4d47-9ecf-0cabb8ba2fc4",
        "startDate": "2021-02-04T10:10:43.464Z",
        "value": null,
        "createdOn": "2021-02-04T10:10:44.3986206Z",
        "hint": "_3D",
        "displayName": "botlogin"
    }
],
"preAuthorizedApplications": [],
"publisherDomain": "unisalerno.onmicrosoft.com",
"replyUrlsWithType": [
    {
        "url": "https://token.botframework.com/.auth/web/redirect",
        "type": "Web"
    }
],
"requiredResourceAccess": [
    {
        "resourceAppId": "00000003-0000-0000-c000-000000000000",
        "resourceAccess": [
            {
                "id": "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
                "type": "Scope"
            },
            {
                "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
                "type": "Scope"
            },
            {
                "id": "b340eb25-3456-403f-be2f-af7a0d370277",
                "type": "Scope"
            },
            {
                "id": "e383f46e-2787-4529-855e-0e479a3ffac0",
                "type": "Scope"
            },
            {
                "id": "37f7f235-527c-4136-accd-4a02d197296e",
                "type": "Scope"
            },
            {
                "id": "14dad69e-099b-42c9-810b-d002981feec1",
                "type": "Scope"
            }
        ]
    }
],
"samlMetadataUrl": null,
"signInUrl": null,
"signInAudience": "AzureADandPersonalMicrosoftAccount",
"tags": [],
"tokenEncryptionKeyId": null

}

But when i try to login with an account hotmail i get this error: AADSTS50020: User account '[email protected]' from identity provider 'live.com' does not exist in tenant 'Università di Salerno' and cannot access the application '002543f2-87b6-43e4-91a3-cfdef655dc7a'(AppBotTipBook) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

How i should solve this problem? Please help me :(

Pamela Peng Pamela Peng · Accepted Answer · 2021-02-08T12:06:49

The setting that you mentioned seems correct. I will show you my steps to sign in with an external user.

1. Create an invited user

2. Register an application

Same Supported account types:

Same signInAudience like yours:

3. Add a client secret:

4. Test the application with auth code flow

① Request an authorization code in browser, and login with the external user account.

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?
client_id={}
&response_type=code
&redirect_uri=https://myapp
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345

② Request an access token

POST https://login.microsoftonline.com/common/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id={}
&scope=https://graph.microsoft.com/.default
&code={code from previous step}
&redirect_uri=https://myapp
&grant_type=authorization_code
&client_secret={}

Oath problem with Microsoft personal account authentication

1 Answers