access_denied error while login to multi-tenant app with external user

As the message says, you will have to verify your domain [DNS verification] as per the details given here

There are two modes to convert to managed app

Internal Takeover Let's say an IT administrator from Bellows College discovers that users from the school have signed up for self-service offerings. As the registered owner of the DNS name BellowsCollege.com, the IT administrator can validate ownership of the DNS name in Azure and then take over the unmanaged directory. The directory then becomes a managed directory, and the IT administrator is assigned the global administrator role for the BellowsCollege.com directory.

External Takeover For example, let's say you are an IT administrator and you already have a managed directory for Contoso.com, a domain name that is registered to your organization. You discover that users from your organization have performed self-service sign up for an offering by using email domain name user@contoso.co.uk, which is another domain name that your organization owns. Those users currently have accounts in an unmanaged directory for contoso.co.uk.

There are more details on the given link.

This is expected error because when the multi-tenant app is using common in the authorization endpoint. And Azure AD determine the Azure Active Directory by the account users input. So the Azure AD will take the default Azure Active Directory instead of the tenant the account was added to as a external users. This is reasonable since we may add the same users to many other directories.

So if we want the login with the external users for the multi-tenant app, we should use the specific tenant in the authorization endpoint instead of using common.