User account does not exist in tenant 'Default Directory' – Azure

by
Ali Hasan
azure-active-directory

Quick Fix: Verify that the Azure AD Application is registered with the correct tenant access settings. If it’s registered as Single-Tenant, only users from that specific tenant can sign in. Update the registration to allow users from any Azure AD tenant (Multitenant) or personal Microsoft accounts to resolve the issue.

The Solutions:

Solution 1: Edit AD Application Registration

Error Cause: Your AD Application is registered as a single-tenant application, but you’re attempting to sign in with personal accounts or accounts from other organizations.

Solution:

  1. Re-register your AD Application as "Multi-tenant and personal Microsoft accounts (e.g. Skype, Xbox)".
  2. In the authorization request, specify the common tenant:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://example.com
&response_mode=query
&scope=https://graph.microsoft.com/User.Read
&state=12345

Solution 2: Use organizations in Auth Request (for School Accounts Only)

If you want to restrict login to only school accounts:

  1. Register your AD Application as "Multi-tenant and personal Microsoft accounts (e.g. Skype, Xbox)".
  2. In the authorization request, specify the organizations tenant:
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://example.com
&response_mode=query
&scope=https://graph.microsoft.com/User.Read
&state=12345

Additional Resources

Q&A

How to Reproduce the error AADSTS50020 ?

Register an app as Single-Tenant then try to login with a personal account.

How to resolve error AADSTS50020 ?

Create the azure AD application as multi-tenant and use common endpoint.

Video Explanation:

The following video, titled "AADSTS50020: User Account from Identity Provider does not exist in ...", provides additional insights and in-depth exploration related to the topics discussed in this post.

Play video

AADSTS50020: User Account from Identity Provider does not exist in Tenant. 19K views · 2 years ago ...more ...