Guest invite limitation?

[adam deltinger]

Just want to make sure!  Company with DomainX use office 365 for some users! If i add a user with user.domainX.com to my team and that user have a license in their tenant it works! If I invite someone on domainX not using office 365 , they get an error using the invite link

Something like this:  AADB2B_0001 Can't create an Azure AD account with self-service due to the catalog is federated….

Adam

[#2]

Correct me if I’m wrong! A guest user from a domain in office365 uses their AAD to authenticate! If the user is not present ( not created or synced ) aka not using office 365 , the invite procedure tries to create the user in their AAD. This will probably fail due to several reasons!
So to correct this their admin has to either make a setting via powershell to enable self creation or sync/create the user in their AAD

[#3]

Yeah if they have a domain but no user account sync'd you're going to have problems because basically the account doesn't exist. If the account sync's from on-prem, but not licensed it should work in that case, but the account needs to exist in the 365 domain.

[#4]

There is no such thing as self-service account provisioning, an admin in the organization needs to provision the account. If the account doesn't exist, the entry will simply remain in your directory as "orphaned" object.

[#5]

I was looking at the Set-MsolCompanySettings -AllowEmailVerifiedUsers setting which joins by email validation

Don't know exactly what's happening here but according to this blogpost, it would be possible if the mail address matches the tenant name

https://www.xtseminars.co.uk/blog/azure-ad-b2b-invitations-and-email-verified-users

Found this MS documentation link about the cmdlet as well! Don't say much though

https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolcompanysettings?view=azureadps-1...

/ Adam

[#6]

@adam deltinger if the company your are connecting to does not use any services based on AzureAD then a tenant gets provisioned and your guests are created within it.

If the company already has AzureAD for something then it's managed by the global admins of that tenant.

Interestingly if you have one of these virally provisioned tenants, then but something with AzureAD you adopt the tenant, and can then manage the accounts created there.

[#7]

Hi! Didn’t quite catch the last paragraph! Can you please explain a little further?
Also you mean a tenant gets created if there’s no azure ad connected to the guest mails domain?
In this case there is already though but the user don’t exist in that AAD

[#8]

If there is already a managed AzureAD then accounts can only be created there by that company, it's admins etc.

If the company has never used AzureAD then accounts get automatically provisioned in a virally provisioned AzureAD tenant for the company.

[#9]

Yes! Thanks! I’ve read up on that now! There’s also way to take management of this tenant apparently :)
Although my issue is another but I seem to have figured it out

[#10]

Found this in MS doc:

You administer a directory with a verified domain such as contoso.com
You use B2B collaboration from a different directory to invite a user that does not already exist (userdoesnotexist@contoso.com) in the home directory of constoso.com
The home directory has the AllowEmailVerifiedUsers turned on
If the preceding conditions are true, then a member user is created in the home directory, and a B2B guest user is created in the inviting directory.

From:
https://docs.microsoft.com/en/azure/active-directory/users-groups-roles/directory-self-service-signu...

From what I understand from this is the following!
In my scenario when an invited user don’t have any account in their organizations AAD, the invite process tries to create one based on the email address! Without the cmdlet above, this is not possible, but should be possible if it was set to true
Although if it’s a domain synced with ad, I guess it’s still not possible!
Geez....

[#11]

@Vasil Michev @Chris Webb @Steven Collier @Christopher Hoard @Juan Carlos González Martín

Any thoughts or experiences regarding this thread and the AllowEmailVerifiedUsers setting?

I'm awaiting the guest user to accept the invite after their admin syncing the user to AAD, but the users invite url is now directing to their tenant :)

Curious about the AllowEmailVerifiedUsers though!

Adam

[#12]

They still have to go back to their tenant to authenticate. Also I used to have the issue with teams guest access back then if the user had 365 but didn’t have teams on they can’t join as a guest anywhere else. I always had them just setup or use MsA accounts for guest in those cases that they didn’t use teams.

[#13]

yeah, i've heard those scenarios. But in this case I guess the user won't have to be licenced. isn't that basically the same thing as having a 365 license, with teams disabled in this case?

[#14]

I haven’t tried in awhile so I do t know if it changed but you’ll know cause you’ll authenticate then get the whole teams must be enabled for your organization message when trying to use the client.

[#15]

Have experienced a few scenarios like this

1.) Like @Chris Webb where the other tenant has 365 but Teams is completely off and the org didn't want Teams, I have invited them as a guest on their MSA account

2.) In the same scenario when the other tenant has 365 but Teams is completely off I managed to convince the org to set up Teams for the user and invited them as a guest

3.) I have also experienced this when adding a guest to our tenant for an org who hasn't used Office 365 at all and someone has gone and created a free Power BI subscription. Had to go remove the domain and blow it away before the user could be added as a guest.

I would agree with everything others have said. If the domain/subdomain is in AAD then the invite will look for the user there. If there was a scenario, let's say, where the domain is in AAD and the org is only using SharePoint with AADC (not teams) and the user wasn't part of their SharePoint site, then the org would need to sync the user on AADC for the user to exist in Azure AD and an Office 365 licence with Teams (I.e. like Business Essentials) would be the optimal add. 

Hope that helps.

Best, Chris