Jul 29 2021 01:01 AM
Jul 29 2021 01:01 AM
A client created a public Teams Live Event, they informed us several people had trouble joining.
Anyone can join the event anonymously, no problem.
Also if they are logged into the Teams website or Teams app using a M365 Business account, that is in a different tenant and not a guest of the organisers tenant, they can join no problem.
The problem only seems to be with MSFT accounts, the outlook.com/live.com/hotmail.com personal type MSFT consumer accounts.
If user is logged onto Teams app on mobile with MSFT personal account then they get a message that the device is not trusted.
If user is logged onto Teams windows app with MSFT personal account then they end up in a logon loop or if lucky get a message that access is denied because they are not a guest of the organiser M365 Business tenant.
If user is logged onto Teams website with MSFT personal account they get a message that access is denied because they are not a guest of the organiser M365 Business tenant.
How can a meeting be open to all to join anonymously, but if you have a MSFT personal account and you've authenticated you are not allowed to join?
Doesn't make sense to me.
MSFT 365 Business support advised me my client needs to create a website advising people with MSFT personal accounts to sign-out of Teams, or use an in-private browser. I find this ridiculous.
Jul 29 2021 02:05 AMSolution
Jul 29 2021 07:09 AM
@grommit @Christopher Hoard Hello, I just tried to reproduce the issue by creating a Public Live Event from a "work account" and send the link to a personal MS account (@outlook.com). This account is not a guest user or federated user and I was using a personal laptop signed in with that personal account. Every time, no matter if I'm using Teams on the web or the desktop app (signed in all over with @outlook.com account) I got this prompt.
For me it worked like a charm to select Join anonymously over and over. My guess is that the users that had problems with loops etc. were caused either by mixed/cached credentials or by trying to sign in to the tenant not being allowed (hence the error message).
For the record I was signed in with the Microsoft account the entire time.
Jul 29 2021 07:20 AM - edited Jul 29 2021 07:21 AM
Hmm, yeah, I think it may be a dual problem. Did you manage to test if you were logged into Teams for personal use at the time with that MSA account? Being in Teams for Personal use could cause the caching but I would be interested to see a confirm on that behavior for both sign in and caching. My thoughts on it is that it's not possible to join a public event whilst in use of Teams Personal. You would literally need to join anonymous from an incognito session or a browser session where you've blown the cache. If you don't have Teams for Personal Use and just the MSA account this would make for an easier sign in.
Jul 29 2021 10:41 AM
1. I had the Teams windows app up and running, logged in using my MSFT personal account.
2. I opened Edge (New/Chromium) then browsed to the public Teams Live Event url
3. The Teams windows app flashed up automatically, but rather then the expected logged in session I had before I was prompted with the below Live Event Sign In page.
4. Clicked sign-in, if memory serves my MSFT personal account was displayed so only had to accept the MFA prompt to allow this from my MSFT authenticator app.
5. Now stuck on “We just need to sign in, and then we’ll get you to your meeting“ for about 1 minute which then changes back to ‘Welcome to the live event!’ sign in page.
6. If I select Sign In again, I go through the same logon failure loop.
7. If I select Join anonymously I join the Teams Live Event without issue.
8. If I select Sign In again but provide my M365 Business work account details it works fine, different tenant to the organizser, I'm not a guest on that tenant, I wasn't invited directly to the meeting.
This is broken and not user friendly.
I've not tested from my mobile, but the M365 tenant which created the public Teams Live Event has that SharePoint Online/Onedrive setting enabled to limit un-managed devices to web access only, no apps. This may explain why the Teams app on mobile logged into using MSFT personal account threw error about needing to be a managed device, however this is a PUBLIC Teams Live Event so should just work for anyone, MSFT 365 Business accounts and MSFT Personal accounts AND anonymous.
0. Set Edge (New/Chromium) to not open Teams app
1. Logon to the Teams webpage using my MSFT personal account.
2. Browsed to the public Teams Live Event url
3. Select Watch on the web instead
4. Flashes between "We're sorry - weve run into an issue" and trying again until finally gets stuck on "To open the web app, change your browser settings to allow third-party cookies or allow certain trusted domains. Try again If that doesn't work, try signing out and back in."
Teams webpage in-private
0. Delete application link that opens Team URL in Teams app
1. Open Edge (New/Chromium) in-private
2. Select watch on web
3. Select Sign in
4. Entered MSFT personal account username
5. Accepted passwordless MFA prompt to select number from MSFT authenticator app
6. MSFT sign message
Sorry, but we’re having trouble with signing you in.
AADSTS50020: User account '%MY MSFT PERSONAL ACCOUNT%' from identity provider 'live.com' does not exist in tenant '%PUBLIC TEAMS LIVE EVENT ORGANISER DOMAIN%' and cannot access the application '5'(Microsoft Teams Web Client) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
This is ridiculous, as if something can be access anonymously then why all the issues when trying to access the same thing whilst authenticated to MSFT using MSFT personal account.
How many people have given up trying to connect to public Teams Live Events, because they have MSFT personal accounts and get logon loops or unhelpful error messages? This is extremely poor, even by MSFTs low standards.
Jul 29 2021 12:06 PM
@grommit I can understand the frustration. But as we're talking about public events anyone can join, not anyone can sign in. If you're trying to sign in with an anonymous account (not a guest user or trusted/federated user) it will not work as the account isn't added to your org. in any way. You can actually read this in the "error message" you get. If these "live accounts" where added to the org. it would work to select the sign-in option.
@Christopher Hoard Perhaps my MS account wasn't the best one to test with as I do have a Teams free org. associated with that as well. But, I was properly signed out of all sessions and only signed in to Teams for Personal use, both online and desktop. I did notice though right now that the icon changes from the white personal to the blue business when connecting to the live event. So perhaps I should create a brand new @outlook.com account and test again.
Jul 29 2021 12:11 PM
Jul 29 2021 12:28 PM
Jul 29 2021 12:29 PM
Jul 29 2021 12:41 PM
Jul 29 2021 12:45 PM
Jul 29 2021 12:51 PM - edited Jul 29 2021 12:52 PM
@ChristianJBergstrom and I are definitely with you on this. We love the feedback and we can be a conduit for it to push to the product and engineering teams because as MVP's we have the access. I think your points are valid. I think what you experienced is going to be what many others experience and this is going to result in negative feedback and a negative perception of the product. I agree with you that Teams is really amazing and that it was better than just lock stock buying slack, but also there are things we all want to see and we ourselves are vocal and call it out when we see it. Whilst we cannot influence a change insofar we are not Microsoft employees we can put this in front of the right people. We will do. I hope personally, and I know Christan does, that this is resolved. The workaround works, but is it the experience we want to see. Absolutely not.
Jul 29 2021 01:45 PM
@Christopher Hoard I had to try it. I created a brand new W10 profile with a brand new personal MS account (@outlook.com). Signed in to Teams on the web and then downloaded the desktop app and signed in there too. From my test tenant I sent a public live event link to this new account using a simple email. Clicked on the link and got redirected to the prompt for "Sign in" and "Join anonymously". The latter worked here as well..