Forum Discussion
Issue AADSTS50020 when using external tenant account to sign in into Microsoft Teams Bot app
Let's say that I am creating 2 Microsoft Teams Bot apps (A) and (B) with 2 app registration (A-reg) and (B-reg) in my tenant (F). Each app use Microsoft Graph API with Chat.ReadWrite, Chat.Create and Files.Read, and configured to multi-tenant type to allow users from other tenants to sign in and use the app. In this case, let's say users in tenant (C) needs to access the app hosted in my tenant (F)
The problem here is the app (A) work perfectly but the app (B) fails to allow users from external tenants to sign in and use Microsoft Graph API. Both app work well with user in the same tenant. And I don't know which configuration is different between the 2 app. Below is what I've tried until now:
+ Create an Azure registration with multi-tenant type, setup Redirect URI, Application ID URI, add client ID of 'Microsoft Teams' and 'Microsoft Teams Web Client' to the authorized client applications, add Scopes for Application ID URI
+ Create Azure Web app to run the bot code and Azure Bot that accept the messaging endpoint, add OAuth connection (AAD v2) using the app registration before, add channel Microsoft Teams to the bot
+ Create the manifest.zip and request the admin tenant (C) to add to their tenant and publish for all users.
Both apps then can be access from user in my tenant (F), is visible to users in tenant (C). However, no user in tenant (C) including the admin themselves can sign in to the bot. All attempt results in 'AADSTS50020: User account 'account@(C)' from identity provider 'https://sts.windows.net/tenant_C_id/' does not exist in tenant '(F)' and cannot access the application 'app_client_ID'(app_name) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.'
Did anyone experience the same issue? I went through many documents and topics but not yet find any solution.