Microsoft Graph App sign in with different tenant not possible

Question

I created an app with teh Microsoft App registration portal.

I can use this app with the a user in the Azure AD tenant that created this app. The Azure AD tenant is linked to an office 365 business subscription.

If I try to use this app with a user thatbelongs to a life.com tenat, an error is shown right after the Microsoft sign in screen:

Message: AADSTS50020: User account 'xyz@outlook.com' from identity provider 'live.com' does not exist in tenant 'My-Tenant' and cannot access the application 'asdf-asd-1234-asd-12341234' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

According to the app manifest other tenants are allowed:

"tags": [
    "NoLiveSdkSupport",
    "appModelVersion:2",
    "accessTokenVersion:1",
    "availableToOtherTenants:true",
    "supportsConvergence:true",
    "emailAddress:feedback@modlize.com"
],

How do I register an app that can be used by users from all Microsoft tenants?

Answer 1

There are a number of ways you can try to fix it:

• As someone stated before you need to add the external user as a member of your tenant
• In the case of guest accounts when logging in you may not be able to use login.microsoftonline.com/common. Common should be replaced by the domain of the tenant you want to authenticate against. That may help with your issue (though I'm not 100% sure)
• It wasn't clear what your end goal was, but if you intend this to be a SaaS app then you have to enable multi-tenant access in your app registration

Answer 2

Multi-tenant Applicaiton doesn't mean that you can use any Microsoft Account to sign in the App. It also needs the Microsoft Account to exist in the Tenant and do consent to use the App, the App will be auto created in the Tenant.

For your scenario, I think Azure AD B2C may be better for you. With Azure AD B2C, you can use the MSA as the IDP and build sign-up/in policy for it. So that you can let any MSA to access your Applicaiton.

Please let me know if it helps!