Self-Service Azure AD Error

Question

Hi,&nbsp;I've created a few Sharepoint sites, &amp; added guest users. That was fine. However, one user has come into a problem I've no idea how to solve. When attempting to access the site by signing in/creating their account, they receive the following:&nbsp;We cannot create a self-service Azure AD account for you because [site address] has disabled self-service account sign-up by email validation. Ask [site address]'s admin to enable EmailVerified users or create an account for you.&nbsp;However, within my Azure Active Directory settings look fine to me:Any ideas? Is this something the person I'm inviting has to get their Admin to edit? Or should I enable the Email One-Time Passcode - though by the sounds of it, that's a "Guests never gain permanant access, just temporary 24-hour slots requiring new codes each visit"

vasilmichev · Answer

They should not be creating an account, but logging in with the one you added as guest user. Have they redeemed the invitation?

encrtia · Answer

VasilMichevYou have me confused.&nbsp;Within Outlook -&gt; Group -&gt; Group Settings -&gt; Add Members , I have invited him/her as a Guest.I can see within Azure AD the Name, UserName, Type &amp; Source read [email], [email], Guest &amp; Invited User.&nbsp;What more should I be doing, as I've completed your objective?&nbsp;When I say "creating", what I mean is, when a non-Microsoft User is invited, they'll need to create a psuedo-Microsft account when 1st logging in when accessing the Invitation Link; i.e. input a new password. It is here, I believe, where they're being barred entry when attempting to redeem their invitation.

vasilmichev · Answer

I'm with you, but if they are creating a "pseudo-Microsoft" account they should not be running into such errors. More specifically, the error message suggests that the AllowEmailVerifiedUsers setting is set to false, which can only be done for actual O365 tenants. So either he is using an account associated with another O365 tenant, or maybe he has signed up for some of the free services (Teams free, Flow Free, etc) which has resulted in a tenant created.
&nbsp;
Here's a similar thread we had here on the MTC a while back:&nbsp;https://techcommunity.microsoft.com/t5/Microsoft-Teams/Select-guests-unable-to-join-team-Azure-AD-puzzle/m-p/203270
&nbsp;
And the documentation on the parameter in question:&nbsp;https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-self-service-signup

encrtia · Answer

VasilMichev Thanks for the response. But then, if he's signed up for some free services / using an account associated with another O365 tenant, how do I resolve that? Perhaps by accessing my Site/Links via Incognito/Private Viewing mode?I can't say I'm even aware what the key term Tenant represents (though I'll look into it now..)

vasilmichev · Answer

Checking via Private session is always a good test, so let him try that. And "tenant" here means an organization registered with Microsoft. Problem is, end users can unintentionally register a tenant by signing up for one of the free services. If this is the case, then a "takeover" process must be initiated, as detailed here:&nbsp;https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/domains-admin-takeover
&nbsp;
In any case, you can always contact support for assistance on this.

Forum Discussion

Self-Service Azure AD Error

5 Replies

Resources