Search code examples
azureoauth-2.0multi-tenantwebapi

Error in Connecting Two Tenants Using Web API in Microsoft Dynamics 365: User is Not a Member of the Organization

I am attempting to establish a connection between two tenants that belong to different Azure accounts.

I followed the post: https://stackoverflow.com/a/78437433/4373243

My objective is to utilize the web API of Tenant B, but with the client ID and client secret from Tenant A. However, I am currently using the tenant_id associated with Tenant B, as well as the scope (web API endpoint) of Tenant B.

Tenant B web api endpoint: https://org8885b353.api.crm.dynamics.com/

$response = $this->client->post("https://login.microsoftonline.com/{tenantB_id}/oauth2/v2.0/token", [
'timeout' => 30,
'form_params' => [
'client_id' => 'tenantA_clientId',
'client_secret' => 'tenantA_clientSecret',
'scope' => 'https://org8885b353.api.crm.dynamics.com/.default',
'grant_type' => 'client_credentials',
],
]);

When I call the URL below to get the list of all entities with the access token from $response, it throws me an error:

https://org8885b353.api.crm.dynamics.com/api/data/v9.2
"error": {
"code": "0x80072560",
"message": "The user is not a member of the organization."
}

below is the screenshot of api permissions enter image description here

Solution

  • The error "The user is not a member of the organization" usually occurs if the Application user is not created by adding Application ID of Microsoft Entra ID application in the Power Platform admin center.

    In TenantA, created an application and granted API permission like below:

    enter image description here

    In TenantB, the application is added as Enterprise application like below:

    enter image description here

    Generated access token by using parameters like below:

    GET https://login.microsoftonline.com/TenantBID/oauth2/token

client_id:TenantAAppID
client_secret:TenantASecret
scope: https://orgxxxxxx.crm.dynamics.com
grant_type:client_credentials

    enter image description here

    And got the same error:

    GET 
https://orgXXX.api.crm.dynamics.com/api/data/v9.2

    enter image description here

    To resolve the error, create Application user by adding Application ID of Microsoft Entra ID application.

    Go to Power Platform admin center -> Environments -> Select your organization -> Settings -> Users + permissions -> Select Application users

    enter image description here

    Click on New app user -> Add an app -> Search the application with the Application ID -> Add

    enter image description here

    Under Business Unit, select your organization and assign System Administrator role and select create:

    enter image description here

    Regenerate the access token again, and I am able to get the response successfully like below:

    GET 
https://orgXXX.api.crm.dynamics.com/api/data/v9.2

    enter image description here