1

Yesterday I followed Vittorio Bertocci's tutorial "WS-Federation in Microsoft OWIN Components – a quick start" to set up a test application using Azure AD authentication. This is my first use of Azure AD (I work alone so don't use AD, period). I have just one Azure AD tenant containing one app.

I created a test user in the tenant, [email protected], and could log into the app just fine:

Test user can log in

Then I tried creating a new user, [email protected] who is a user with an existing Microsoft account (the email address is used to log in and manage the Azure Portal so it works elsewhere). The appropriate setting was selected to create this account -> User with an existing Microsoft account

But, I cannot log into the application as this user:

Other users can't log in

Can anyone explain why this is?

If I delete the user from the tenant, then re-create using the option New user in your organsation then the user can log in okay (although they get prompted to change their password).

I don't understand what the difference is, especially when the account works fine elsewhere.

Improve this question
0

2 Answers 2

Reset to default
3
+25

It may be that the account is both a valid Microsoft Account (formerly Live ID) AND a valid Organisational Account (Azure AD). This can happen (you have a Live ID for years then your company signs up for Office 365) and leads to all sorts of fun and games because 'home realm discovery' defaults to Azure AD.

In the first login box provided by Azure try typing any address with an '@outlook.com' address - you will be redirected to the Outlook login page (which uses Live IDs). On the Outlook login page enter your '[email protected]' email and password. I expect you'll login.

I talk about the background (and reason) for this scenario on my blog.

Improve this answer
6
  • "I expect you'll login.". You nailed it! Funny because I don't even recall signing up to Outlook.com. I've certainly never used it. Anyway, does this mean that [email protected] is a LIVE ID, and not an Azure ID? Is there any way to cleanse the overlap of accounts?
    – EvilDr
    Jan 16, 2015 at 9:43
  • As per your interesting blog, "start investing in converting users to Azure AD.". How does one even go about starting this process?
    – EvilDr
    Jan 16, 2015 at 9:45
  • 1
    Setup an Azure AD instance and map the 'mycompany.co.uk' domain to it as the custom domain. Where Microsoft Services support use of Organisational Accounts they will default to use of this directory. Services (such as the consumer Outlook.com) will continue to 'Microsoft Account (Live ID)' logins. Your best bet is to make sure any Live ID accounts are deleted to avoid confusion.
    – Simon W
    Jan 16, 2015 at 9:56
  • Yes I'm just on with that now. There has been some overlap in the usage of my domains across two different Microsoft tenants, so am just waiting on their service team to help sort it out. Thanks very much
    – EvilDr
    Jan 16, 2015 at 14:31
  • Sorry for the delay. Microsoft engineers are trying to fix this issue caused by platform "issues". I appreciate that the bounty might get removed but I'll add it again if I can
    – EvilDr
    Jan 21, 2015 at 11:02
0

There are in fact three options to choose from when creating a user in Azure AD:

  1. New User in your organization (this Azure AD)
  2. User with an existing Microsfot Account (Live ID)
  3. User in another Windows Azure AD directory (not Live)

Are you sure that your [email protected] is in fact a MS Live ID, and not a user in "another Windows Azure AD"?

When specifying "Another Windows Azure AD" option, there is a check to see if the account can be federated against, and a pass/fail is displayed on that page. There could be federation settings that are incorrect in the "other Azure AD".

Below is a cap of me throwing random info into the "Another Windows Azure AD" field, and the resulting lookup failure. Test outside azure ad failure.

I would like to expand on this answer, please let me know if any of this points you in the right direction.

PS: Serverfault community, please feel free to correct me on nomenclature if needed, re: "Live ID", "Azure AD"

Improve this answer
3
  • I thought all the Microsoft ID's were now the same (e.g. Live = Azure)? Anyhow, I can log into most Microsoft sites using [email protected], so surely it must be a valid account?
    – EvilDr
    Jan 15, 2015 at 10:38
  • So your "[email protected]" is presumably the tenant admin of an Azure tenant? I initially took it to mean that it's an account in another Azure tenant, not necessarily an MS Live ID.
    – blaughw
    Jan 15, 2015 at 17:23
  • Hi, yes it is. I actually have two Global Admin's for a single Azure company account, of which this is one.
    – EvilDr
    Jan 15, 2015 at 18:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .