Oath problem with Microsoft personal account authentication - azure

Question

Hello guys i have this problem when i try to autenticate a personal account microsoft through Oauth2.
My endpoint URL is configured on common already
The application is configured as a multitenant:
My manifest is:
{​​​​​​
"id": "0982f18d-116c-45c0-b1ee-59dd9fa3344b",
"acceptMappedClaims": null,
"accessTokenAcceptedVersion": 2,
"addIns": [],
"allowPublicClient": null,
"appId": "002543f2-87b6-43e4-91a3-cfdef655dc7a",
"appRoles": [],
"oauth2AllowUrlPathMatching": false,
"createdDateTime": "2021-02-04T10:09:11Z",
"disabledByMicrosoftStatus": null,
"groupMembershipClaims": null,
"identifierUris": [],
"informationalUrls": {​​​​​​
"termsOfService": null,
"support": null,
"privacy": null,
"marketing": null
}​​​​​​,
"keyCredentials": [],
"knownClientApplications": [],
"logoUrl": null,
"logoutUrl": null,
"name": "AppBotTipBook",
"oauth2AllowIdTokenImplicitFlow": false,
"oauth2AllowImplicitFlow": false,
"oauth2Permissions": [],
"oauth2RequirePostResponse": false,
"optionalClaims": null,
"orgRestrictions": [],
"parentalControlSettings": {​​​​​​
"countriesBlockedForMinors": [],
"legalAgeGroupRule": "Allow"
}​​​​​​,
"passwordCredentials": [
{​​​​​​
"customKeyIdentifier": null,
"endDate": "2299-12-30T23:00:00Z",
"keyId": "86c3141b-02ac-4d47-9ecf-0cabb8ba2fc4",
"startDate": "2021-02-04T10:10:43.464Z",
"value": null,
"createdOn": "2021-02-04T10:10:44.3986206Z",
"hint": "_3D",
"displayName": "botlogin"
}​​​​​​
],
"preAuthorizedApplications": [],
"publisherDomain": "unisalerno.onmicrosoft.com",
"replyUrlsWithType": [
{​​​​​​
"url": "https://token.botframework.com/.auth/web/redirect",
"type": "Web"
}​​​​​​
],
"requiredResourceAccess": [
{​​​​​​
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{​​​​​​
"id": "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
"type": "Scope"
}​​​​​​,
{​​​​​​
"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
"type": "Scope"
}​​​​​​,
{​​​​​​
"id": "b340eb25-3456-403f-be2f-af7a0d370277",
"type": "Scope"
}​​​​​​,
{​​​​​​
"id": "e383f46e-2787-4529-855e-0e479a3ffac0",
"type": "Scope"
}​​​​​​,
{​​​​​​
"id": "37f7f235-527c-4136-accd-4a02d197296e",
"type": "Scope"
}​​​​​​,
{​​​​​​
"id": "14dad69e-099b-42c9-810b-d002981feec1",
"type": "Scope"
}​​​​​​
]
}​​​​​​
],
"samlMetadataUrl": null,
"signInUrl": null,
"signInAudience": "AzureADandPersonalMicrosoftAccount",
"tags": [],
"tokenEncryptionKeyId": null
}​​​​​​
But when i try to login with an account hotmail i get this error:
AADSTS50020: User account 'xxxxxxxxx#hotmail.it' from identity provider 'live.com' does not exist in tenant 'Università di Salerno' and cannot access the application '002543f2-87b6-43e4-91a3-cfdef655dc7a'(AppBotTipBook) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
How i should solve this problem? Please help me :(

Answer 1

The setting that you mentioned seems correct. I will show you my steps to sign in with an external user.
1. Create an invited user
2. Register an application
Same Supported account types:
Same signInAudience like yours:
3. Add a client secret:
4. Test the application with auth code flow
① Request an authorization code in browser, and login with the external user account.
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?
client_id={}
&response_type=code
&redirect_uri=https://myapp
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345
② Request an access token
POST https://login.microsoftonline.com/common/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded
client_id={}
&scope=https://graph.microsoft.com/.default
&code={code from previous step}
&redirect_uri=https://myapp
&grant_type=authorization_code
&client_secret={}