Sign in to web application with Microsoft

Question

I have a nextjs app that allows users to sign in with Microsoft (using nextauth). I registered the app in AzureAD and everything works alright. But if I try to with any Microsoft account which is not registered in my organization, I get this error:

AADSTS50020: User account '[email protected]' from identity provider 'live.com' does not exist in tenant 'orgdomain.com' and cannot access the application 'at0293-9999-999c-9999c-99999c9a299'(MyAppName) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

I want any Microsoft account to have access to the app. They don't have to be in my organization. I have set the supported account types to "All Microsoft Account User" but that didn't fix it. I still have to explicitly add accounts to my organization before they can sign in. Is there any way around this?

Answer 1

Note that: To authenticate multi-tenant users and the Microsoft account users, you have to create Azure Ad application by selecting "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)" option and the Sign-in URL must be https://login.microsoftonline.com/common/ Refer this MsDoc.

I registered a multi-tenant application:

For sample, to authorize users I used below endpoint:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://graph.microsoft.com/user.read 
&state=12345

When I tried to sign-in as Microsoft account user, I got the same error as below:

To resolve the error, pass common authorize endpoint:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://graph.microsoft.com/user.read 
&state=12345

The Microsoft account user signed-in successfully:

Pass common as the value for tenantid in your code:

AZURE_AD_CLIENT_ID=ClientID 
AZURE_AD_CLIENT_SECRET=ClientSecret 
AZURE_AD_TENANT_ID=common

Reference:

Error AADSTS50020 - User account from identity provider does not exist in tenant - Active Directory |