/common OAuth endpoint: Personal account rejected with "can't sign in here with a personal account"

Question

/common OAuth endpoint: Personal account rejected with "can't sign in here with a personal account"

XIANGZHE ZENG 0

Our multi-tenant SaaS application is configured to accept both organizational and personal Microsoft accounts, with the signInAudience correctly set to "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)".

However, personal Microsoft account users encounter a blocking error when attempting to sign in via the /common OAuth endpoint in fresh browser sessions (without cached Microsoft session cookies).

SCREENSHOT AND ERROR MESSAGE

User's image

Error message displayed to users:

"You can't sign in here with a personal account. Use your work or school account instead."

CRITICAL OBSERVATION

This error message appears despite our application configuration explicitly allowing personal accounts in the Microsoft Entra ID admin portal:

✓ Supported account types is set to: "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)"

✓ All users with a work or school, or personal Microsoft account can use your application or API. This includes Office 365 subscribers." (as shown in admin portal)

✓ Application permission configuration shows no restrictions on personal accounts

This suggests a mismatch between:

Application registration configuration (which allows personal accounts)
OAuth endpoint behavior (which rejects personal accounts on /common)

APPLICATION DETAILS

OAuth Endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
Requested Scopes: openid profile email User.Read

REPRODUCTION STEPS

Clear all browser cookies or use private/incognito browsing mode
Navigate to OAuth authorization URL using /common endpoint
Attempt to sign in with personal Microsoft account (@outlook.com, @hotmail.com, @live.com)
User receives error: "You can't sign in here with a personal account"

WORKAROUNDS THAT SUCCEED

The error does NOT occur when:

User already has an active Microsoft session in the browser (cached cookies exist)
Using /consumers endpoint instead of /common endpoint: https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize
Adding domain_hint=live.com parameter to override home realm discovery

TECHNICAL ANALYSIS

Based on Microsoft's home realm discovery documentation, the /common endpoint should:

Analyze the user's email domain (UPN suffix)
Route to appropriate identity provider (organizational tenant, MSA, or federated IDP)
Verify application permissions in that tenant

For @outlook.com addresses:

Step 1: Domain suffix is "outlook.com" (recognized personal Microsoft account domain)
Step 2: Should route to MSA tenant
Step 3: Should verify application supports personal accounts

However, the error at Step 3 suggests that despite application configuration allowing personal accounts, the /common endpoint is applying stricter validation rules.

QUESTION: Is there an application-level or home realm discovery policy that can override the application registration's signInAudience setting? If so, how do we disable it?

KEY QUESTIONS FOR MICROSOFT

Configuration Validation: Our application is explicitly configured to support personal accounts. Why is the /common endpoint rejecting personal accounts with "You can't sign in here with a personal account" message?
Intended Behavior: Is the current behavior (rejecting personal accounts on /common despite configuration) intended by design? If so, which endpoint should applications use to support BOTH personal and organizational accounts?
Regression vs. Design Change:
- Is the requirement for cached sessions a new validation rule?
- Why does the /consumers endpoint work but /common doesn't?
Application Interaction with HRD: How does the application's signInAudience setting interact with the home realm discovery logic on the /common endpoint? Should it override HRD's restrictive rules?
Dual-Account Support Architecture: For applications that need to support BOTH personal Microsoft accounts AND multi-tenant organizational accounts, what is the recommended architecture?
- Option A: Separate login flows (/consumers for personal, /organizations for work)
- Option B: Fix /common endpoint to respect signInAudience configuration
- Option C: Use domain_hint parameter consistently (seems like a workaround, not a solution)

Your answer

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2025-11-20T18:05:28.26+00:00

Hello XIANGZHE ZENG

Thank you for reaching out to Microsoft Q&A.

Below are the steps: -

1.) Verify App Registration

In Microsoft Entra admin center → App registrations → Your app → Authentication:

Ensure Supported account types = Accounts in any organizational directory and personal Microsoft accounts.

Confirm redirect URIs include https://login.microsoftonline.com/common/oauth2/v2.0/authorize.

For your reference: https://learn.microsoft.com/en-us/entra/identity-platform/howto-convert-app-to-be-multi-tenant

2.) Check Tenant-Level Restrictions

Go to Entra admin center → External Identities → Cross-tenant access settings and Tenant restrictions.

If personal Microsoft accounts are blocked, remove or relax the restriction.

3.) Review Conditional Access

Navigate to Security → Conditional Access.

Look for policies targeting All cloud apps or Your app that exclude MSA or enforce MFA only for work accounts.

Modify or create an exception for personal accounts.

For your reference: https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

4.) Use /consumers Endpoint for MSA

If tenant restrictions cannot be changed, direct personal accounts to:
https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize

Organizational accounts continue to use /common or /organizations.

For your reference: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#endpoints

Please reach out to us in case of any further issue.

Thanks
XIANGZHE ZENG 0 Reputation points

2025-11-26T15:54:48.96+00:00

Thanks for your help

Unfortunately, I still cannot log in to my personal account using the /common Endpoint.

I'd like you to help me confirm that all the steps I took were correct.

I had setting it before the question

I want confirm if the setting is what you say, right?

No any Conditional Access

Use /consumers Endpoint for MSA is working before I ask the question

So, if none of these work, does it mean I can only use /consumers Endpoint?
XIANGZHE ZENG 0 Reputation points

2025-12-04T15:00:31.9933333+00:00

Hi Shubham Sharma,

This has been bothering our team for days, and I'm hoping for clearer and faster communication.

Could you answer the following question

Or can you create a "Technical Support" Support Ticket for me?

Thanks
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2025-12-09T12:08:59.55+00:00

Hello XIANGZHE ZENG

I really apologize for the late response

Below are the points it may failing: -

If you selected “Accounts in this organizational directory only” during registration, /common is not allowed.

If you use flows like Resource Owner Password Credentials (ROPC), /common and /consumers are not supported for that grant type.

Resolution steps: -

Confirm Supported Account Types In Azure Portal → App Registrations → Authentication, ensure:

Accounts in any organizational directory and personal Microsoft accounts is selected.

Choose Correct Authority in Code

For both work/school + MSA: https://login.microsoftonline.com/common/oauth2/v2.0/authorize

For MSA only: https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize

3.) Update MSAL Configuration

Example: -

var`` app = PublicClientApplicationBuilder.Create(clientId)

``.WithAuthority("https://login.microsoftonline.com/common")

``.WithRedirectUri(redirectUri)

Or replace common with consumers if you only need MSA.

4.) Check Manifest Ensure signInAudience is set to:

AzureADandPersonalMicrosoftAccount for both

PersonalMicrosoftAccount for MSA only

Docs for your reference: -

https://learn.microsoft.com/en-us/entra/identity-platform/v2-supported-account-types

https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration

https://www.chilkatsoft.com/azure_oauth2_endpoints.asp

Please let us know if the above steps help

Thanks
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2025-12-11T09:48:00.6566667+00:00

Hello XIANGZHE ZENG

Following up to check if the resolution provided above was helpful. Please let us know if you need any further assistance.