I'm trying to enable the Multi-Factor Authentication on my Azure account, (To secure my access to the Azure portal), i am following the tutorial from here, but, unlike this picture :
I have no Enable button when I select my user:
I've tried to send a csv bulk request with only my user (the email address), but it says user does not exists.
I am trying to add MFA on the user william#[something].com when i'm logged with the william#[something].com MS account (i am the only one user, and i'm global administrator)
In the MFA management page, you can only manage/enable MFA for your own Microsoft Azure AD Accounts, including accounts creating in Azure AD or synced from your on-premise AD; not any Microsoft Account or accounts from other Microsoft Azure AD. As you said you're using a MS account, you surely can't see the enable button.
In Azure Classic Portal, you can easily see if it's a Microsoft account or a Microsoft Azure Active Directory account:
If you want to enable this for your Microsoft account, you need to use Microsoft service at here ,sign in and then click Set up two-step verification.
Follow steps afterwards, you'll enable Two-step Verification it for your Microsoft account.
Of course you can create a new account in your Microsoft Azure Active Directory (Type of User is: New user in your organization), then you can enable MFA for this new user. If you would like a Global Admin, you can click this user and assign user Global Admin role. So then later you can use this admin account for your management work.
Related
I want to access the outlook API with a Python application. I followed this guide but quickly ran into authentication issues. Tried it with my existing private Microsoft account and with a new created account, but ran into authentication issues quickly. Whenever I try to do anything in the portal, I get this message:
Already checked in with the general Microsoft support. They directed me towards Azure support, but I can't reach anybody there.
I tried to reproduce the same in my environment and got the same error as below:
The error usually occurs if the Microsoft personal account is not added as an external/guest user to an Azure AD tenant.
To resolve the error, contact the Global admin to invite the account as a guest user like below:
Once the admin invites, you will get an email notification to accept the invitation like below:
After accepting the invite, the Personal Microsoft account will be added to the tenant successfully like below:
And now you will be able to access the Azure Portal without any issue and you can also create your own tenant to have admin access.
If still the issue persists, try the below:
Sign out from the active session and sign in incognito window or any different browser.
Clear browser cache and cookies and try.
Confirm whether the admin has set any External user settings that is restricting the access:
Reference:
Error AADSTS50020 - User account from identity provider does not exist in tenant - Active Directory
When looking into the Build Python apps with Microsoft Graph tutorial that you followed, one of the pre-requisites mentioned signing up for the Microsoft 365 Developer Program to get a free Microsoft 365 subscription. After you sign-up, you'll need to use the Microsoft 365 developer sandbox credentials in order to continue following the tutorial without having to leverage your own Azure AD tenant or subscription (pay-as-you-go).
Build Python apps with Microsoft Graph:
Join the Microsoft 365 Developer Program
Deploy the Developer Sandbox
Using the Microsoft 365 Developer subscription(s) info you'll be able to login to the Azure Portal or Azure Active Directory admin center.
Note: You can navigate to your developer tenant using - https://aad.portal.azure.com/<<SandboxTenantName>>.onmicrosoft.com, or when prompted to sign in use your sandboxes' admin account.
If you only signed up for a new personal Microsoft account (Outlook), you'll notice that once you sign into the Azure AD Admin Center, your Outlook.com user isn't associated with any Azure tenants, and you'll run into the authentication issue error message that you referenced, so you'll have to create your own Azure AD tenant by signing up for an Azure Free Trial or Pay-as-you-go.
I hope this helps!
I'm developing system where any user can login through Microsoft Azure SSO.
I have done following
Create B2C tenant (Initially tried B2B)
Create enterprise application
Set "AzureADandPersonalMicrosoftAccount" for "signInAudience"
Setup SSO with SAML using "https://simplesamlphp.org/"
Now everything is working fine for my account. But if I trying with other personal user (which I haven't added as guest user in my tenant), then it returns error
User account 'user#domain.com' from identity provider 'live.com' does not exist in tenant 'xxxx'
and cannot access the application in that tenant.
The account needs to be added as an external user in the tenant first.
Sign out and sign in again with a different Azure Active Directory user account.
I want any personal Microsoft user can login through SSO (without adding it as guest user in tenant).
Thanks in advance!
I tried to reproduce the same in my environment and got the below results:
Please note that, if you are creating Enterprise Application in Azure AD b2c Tenant it will be authenticated via Azure Active Directory only not Azure AD b2c.
When I tried to login through Personal Account, I got the same error as below:
As Enterprise Applications authenticate via Azure AD, it is not
possible to authenticate users with personal Microsoft accounts
without adding them as Guest Users.
The only approach is that you add them as Guest users and login to SAML SSO without invitation.
Go to Azure Portal -> External Identities -> External collaboration settings -> Enable guest self-service sign up via user flows
On the left blade, Click on User flows -> New User Flow,
Once the user flow gets created successfully, click on the user flow, select applications and add your application like below:
And try signing to your application with Microsoft Personal Account.
I have configured identity provider as described in this documentation
Sign up page shows up as in the photo. When entering existing office 365 email address, it doesn't accept. It only accepts personal Microsoft accounts.
Found an old feature request what was declined.
https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/16849006-aadb2c-integrate-office-365-to-work-with-b2c
Is it still the same OR is there any alternate way ?
Update (couldnt page photo in comment, updating the question)
I chose 2nd option for multi-tenancy from suggestion and now it gives me error
The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
If you want any O365 Account to sign in to your AAD B2C protected app, you need to federate with AAD Multi Tenant using Custom Policies.
https://learn.microsoft.com/en-gb/azure/active-directory-b2c/identity-provider-azure-ad-multi-tenant-custom?tabs=app-reg-ga
Set up sign-up and sign-in with a Microsoft account using Azure Active Directory B2C is only for personal Microsoft accounts.
You should configure Azure AD IDP by following Set up sign-in for a specific Azure Active Directory organization in Azure Active Directory B2C.
Then you can use existing office 365 account to sign in.
I want to access the Azure AD Graph Explorer using my administrator account. When I try to access it, it shows this error:
Selected user account does not exist in tenant graphExplorerMT and cannot access the application d3ce4cf8-6810-442d-b42e-375e14710095 in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.
What shall I do?
You should probably try with a user that is internal to the AAD or add your MS account as an external user to it.
The Azure subscription admin is not necessarily part of the Azure Active Directory.
For Azure AD Graph Explorer, you can only use the member account(internal) to sign in, such as xxx.onmicrosoft.com.
You cannot use a guest user account(external) to sign in AAD Graph Explorer.
Solutions:
Try to sign in AAD Graph Explorer with a member account.
According to this answer on Microsoft's forum, this does not work with Microsoft accounts.
Are you trying to sign in using a Microsoft account (outlook/live) into https://graphexplorer.azurewebsites.net/ ?
Azure AD Graph explorer cannot authenticate social accounts and only works with work or school accounts in Azure AD.
You would have to use the latest MS graph, if you want to use MSA accounts
I've logged in to azure portal using my work account (Azure AD) and created new vsts account and team project. I can now login to vsts using my work account and add my colleagues from the same AD to team project.
Is it possible to add users/stakeholders from another company to my team project if I don't have admin access to my company's AD?
EDIT:
please vote for multi-tenant authentication in VSTS on uservoice
Answer from Microsoft support:
Any user who wants to use VSTS will have to be in that AAD. Normally they would get added as an MSA account, or an account in another AAD.
Me: I was thinking about creating my own AAD in Azure and adding users from another AAD to it, but I’m not sure whether they will still be able to log in using their corporate login and in case their account will be disabled in their AAD, it will be disabled also in my AAD.
If it is linked to an AAD, the accounts have to be in there somehow.
If he creates his own AAD and doesn’t have admin access to the corp aad, users will be added as MSA users.
If he did add corp users as AAD users (not MSA users) in his AAD and they were deleted/disabled in the native AAD, they would not be
able to logon to his VSTS. (Same is true for MSA users, if the MSA
account is deleted/disabled they couldn’t logon to VSTS even though
they were in his AAD as #EXT)
Accoording to this doc, no.
Q: Why can't some users sign in?
A: This might happen because users must sign in with Microsoft accounts unless your Visual Studio
Team Services account controls access with Azure Active Directory
(Azure AD). If your account is connected to Azure AD, users must be
directory members to get access. How do I find out if my account uses
Azure Active Directory (Azure AD)?
If you're an Azure AD administrator, you can add users to the directory. If you're not, work with the directory administrator to add
them. Learn how to control account access with Azure AD.