Search code examples
office-addinsazure-ad-graph-api

AADSTS50020: User account does not exist in tenant


I was able to register an app created by another tenant as an enterprise app of my own tenant. I signed in to the app as a user, but I got the following error.


AADSTS50020: User account '[email protected]' from identity provider 'https://sts.windows.net/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/' does not exist in tenant 'testdomain002' and cannot access the application '55555555-6666-7777-8888-999999999999'(OneDriveAPIBrowser_test001) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.


How can a user of another tenant use it without the application creator tenant performing any processing?


Solution

  • If the Azure AD app is registered in Tenant A and you have add it as an enterprise app into Tenant B, you should use a user from Tenant B to sign in.

    In your case, if the registered app is in testdomain001 and added into testdomain002, you need to use a user from testdomain002. User "[email protected]" is not allowed to sign in to the app in testdomain002 unless it is a guest user of testdomain002.