Azure login to multi-tenant AD app failing

user_3740951 0
Viewed 5844

I have user A in tenant A and a multi-tenant AD app B in tenant B. I am trying to get token from user A's context for the AD app

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=a573ddda-b34a-4206-a73b-d67ff6e98aec&response_type=token&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&scope=a573ddda-b34a-4206-a73b-d67ff6e98aec%2F.default&response_mode=fragment&state=12345&nonce=678910

I logged in using user A's credentials and got error

AADSTS700016: Application with identifier 'a573ddda-b34a-4206-a73b-d67ff6e98aec' was not found in the directory 'domainA.onmicrosoft.com'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

I have configured AD app B with id - a573ddda-b34a-4206-a73b-d67ff6e98aec to be multi-tenant. Any idea why this might not be working?

azure-active-directory azure
2 Answers

I had the same error caused by completely different factors: I configured the Oauth2 client using Secret ID and Secret Value instead of App ID and Secret Value.

It took few hours browsing tons of config pages to figure out that the reason is stupidly simple and responses from MS API are useless.

user_35564720

As @juunas mentioned, if you use a guest user to login, use the tenant id of the tenant A instead of common, it will force the user to authenticate against tenant A instead of his home tenant.

And if your guest user is the first login the app, make sure some settings are like below in tenant A, otherwise, the user will not be able to consent for the app in tenant A.

  1. Navigate to the Azure Active Directory in tenant A -> User settings -> Manage external collaboration settings -> set Guest users permissions are limited to No.

enter image description here

  1. Navigate to the Azure Active Directory in tenant A -> Enterprise applications -> User settings -> set Users can consent to apps accessing company data on their behalf to Yes.

enter image description here

For more details about the member user and guest user, see this https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions

user_94556590
Related