How do I disable cross tenant access type: passthrough from happening

Question

How do I disable cross tenant access type: passthrough from happening

Alex Holland 20

Users that were migrated from another Microsoft tenant into another tenant are having issues with specifically Microsoft Teams where they are unable to sign in. The only thing I see in the sign in log that looks weird is this Cross Tenant Access Type: Passthrough. Using the troubleshooter, it references the same thing, that the user does not exist in the <domain.com> tenant and does not have access. Other apps like outlook and authenticator work fine. The domain it references shows the domain setup in the current tenant. The device being used to sign in is an iPhone that we have tried uninstalling teams, removing the account from authenticator then reinstalling teams. We have done almost everything in between besides wipe the phone or register the phone in the new tenant, as it is a personal device not company owned. The device has no work or school account or device management profile from the old tenant under "Settings" -> "General" -> "VPN & Device Management"

User's image

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Vivian-HT 17,895 Microsoft External Staff Moderator

Dear @Alex Holland,

Thank you for posting your question in the Microsoft Q&A forum.

Before giving you the best solution, could you please confirm these questions below to help me diagnose the issue more effectively:

Can you confirm the user’s current UPN and the tenant domain they should be signing into?
Was the old tenant fully decommissioned or does it still exist?
Has the user tried signing in from a browser (e.g., Safari or Edge) using an InPrivate session? If so, does it succeed?
Does the user have a personal Microsoft account using the same email address? If yes, has the primary alias been updated to avoid conflicts?
Are there any cross-tenant access policies configured in Microsoft Entra for the old tenant? Has outbound access to the old tenant been blocked or restricted?
Does the user have an active Teams license in the new tenant?
Is the domain verified and set as the primary UPN suffix?

In Microsoft Entra (Azure AD) sign‑in logs, Passthrough indicates the user is authenticating in their home tenant, and that token is being passed through to a different resource tenant (the app’s tenant) without a guest object being used. When the app (here, Microsoft Teams mobile) presents your user to a tenant where they don’t exist, Entra throws AADSTS50020 (“user does not exist in tenant”), exactly what you’re seeing. For reference: Passthrough sign-ins

Therefore, this account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. If this user should be a member of the tenant, they should be invited via the B2B system. For reference: Microsoft Entra authentication and authorization error codes

Have you tried all the steps in this article as Microsoft has released some troubleshooting steps for this issue to help user troubleshoot error code AADSTS50020 that's returned if a guest user from an identity provider (IdP) can't sign in to a resource tenant in Microsoft Entra ID: Error AADSTS50020 - User account from identity provider does not exist in tenant.

In the meantime, here are some steps I recommend you try again:

Step 1: Use InPrivate/Incognito to validate identity routing

In Edge/Safari, open an InPrivate session and sign in. If this lands you in the correct tenant and MFA prompts look normal, device routing is fixed; proceed to Teams.

Step 2: Sign in with the new tenant credentials

Ensure the user signs in using the correct UPN from the current tenant. If the Azure AD app is registered in Tenant A and you have added it as an enterprise app into Tenant B, you should use a user from Tenant B to sign in. For example, if the registered app is in testdomain001 and added into testdomain002, you need to use a user from testdomain002. User "******@testdomain001.onmicrosoft.com" is not allowed to sign in to the app in testdomain002 unless it is a guest user of testdomain002.

(Optional) tenant-level control:

If you want to prevent passthrough attempts entirely, configure Cross-tenant access settings in Microsoft Entra: Navigate to Identity > External Identities > Cross-tenant access settings.

For reference: Manage cross-tenant access settings for B2B collaboration and Overview: Cross-tenant access with Microsoft Entra External ID

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this. If I misunderstand anything, please feel free to reach out.

Please understand that our initial response does not always resolve the issue immediately. However, with your help and more detailed information, we can work together to find a solution.

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out.

I'm looking forward for your reply.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Alex Holland 20 Reputation points

2025-12-02T13:49:20.71+00:00
Thank you for the response and the information you've provided. To answer your questions here is a list of the answers.

Yes, the user's current UPN is being used to sign in as I am getting sign in logs for the UPN in the "new" tenant

The "old" tenant is still up for data loss prevention but does not have the original domain that was used. The domain was defederated and transferred into the "new" tenant.

Yes, the user can sign into Outlook, Teams, SharePoint from a computer. Outlook and Authenticator also work on the same iPhone that is having issues with Microsoft Teams.

No, the user does not have any personal accounts with the same email.

No there is no cross-tenant access policies in place. Reading more about the cross-tenant access it seemed like it was a block and fail rather than a fail over process. For example, if we blocked the "old" tenant it would error the sign in instead of falling back to use the "new" tenant

Yes, these users have E3 licenses.

Yes, the domain is verified and is set as the primary SMTP email not smtp. The smtp is set to the @<domain>.onmicrosoft.com

The user is using the "new" tenant credentials as it successfully validates the credentials in the sign-in logs from the new tenant however it is passed to the other tenant only for this specific app, being Microsoft Teams. Other apps on this iPhone are being handled correctly and successfully signing the user in without passing through the credentials to the "old" tenant. It's very weird the only issue is with Microsoft Teams. We are not able to test if opening a browser on the phone works to sign into Microsoft Teams as it does not allow the iPhone browser to open teams online using Edge, or Safari.

To give more context for what happened during the migration we moved all data from one tenant to the other. We then changed all users in the "old" tenant to a generic domain like @examplecomp.com to allow us to defederate the @<domain>.com domain and remove it from the "old" tenant. We then were able to add the domain to the "new" tenant then switching the accounts in the "new" tenant from @<domain>.onmicrosoft.com to @<domain>.com. This was done so the users would continue on with their same email address and login as before just in a "new" tenant managed by a new company.

This issue is happening only with a few of our users from this migration. Not all iPhone users involved in this are having issues. And we are trying to avoid the nuclear approach of requiring a device wipe on their personal phones.
Vivian-HT 17,895 Reputation points Microsoft External Staff Moderator

2025-12-04T07:36:12.5866667+00:00
Dear @Alex Holland,

Thank you for providing the detailed information and context regarding the tenant migration and the sign-in behavior on iOS devices. Based on the complexity of this issue, particularly the interaction between Microsoft Teams mobile, cached tenant data, and authentication flows, we recommend escalating this to Microsoft Support for deeper investigation.

Please create a support ticket with Microsoft and include:

A summary of the migration steps you outlined.

Confirmation that many users are experiencing this issue, even though other apps (Outlook, SharePoint) work correctly.

Details of the affected users and devices.

Recent sign-in logs for Microsoft Teams (mobile) from Entra ID.

Any error messages or screenshots from the Teams app.

Microsoft Support can run advanced diagnostics and confirm whether residual tenant artifacts or app configuration policies are causing the issue.

You can open a support request through the Microsoft 365 Admin Center. For reference, please refer to Get support for Microsoft 365 for business.

Once you have the support ticket ID, please feel free to share it with me so I can track progress to make sure that whether the case is assigned to correct support engineer, or assist further if needed.

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out.

I'm looking forward for your reply.
Vivian-HT 17,895 Reputation points Microsoft External Staff Moderator

2025-12-05T07:24:44.2333333+00:00

Dear @Alex Holland,

Good day and I hope you're doing well. I just wanted to check in and see if there is any update from you

If you're still facing any problems, please feel free to share more details about the current error or steps you're stuck on. I’ll be happy to assist further.

Looking forward to your update.
Vivian-HT 17,895 Reputation points Microsoft External Staff Moderator

2025-12-08T07:01:25.3966667+00:00

Dear @Alex Holland,

I hope this message reached you.

This is my second time reaching out to check if there is any update from you. I really want to make sure your experience is as smooth as possible. If your issue persists or if you encounter any new difficulties, please share more details about the current steps you are taking. I am always happy to assist you whenever you need.

While waiting for your response, I will also be monitoring other customer questions on the forum to assist them. If you have any further questions or updates, please tag (@Vivian-HT) in the reply so I can assist you more promptly and thoroughly.

I look forward to hearing from you soon.
Alex Holland 20 Reputation points

2025-12-08T13:08:12.4666667+00:00

Hi Vivian,

I will go ahead and submit a ticket with Microsoft directly. Thank you for the information provided, and trying to help me out with understanding this issue.

Have a great holiday season!
Vivian-HT 17,895 Reputation points Microsoft External Staff Moderator

2025-12-08T23:50:11.3166667+00:00

Dear @Alex Holland,

Thank you for your update. Have a great holiday season!
Erwin de Beer 1 Reputation point

2026-06-24T12:52:31.4233333+00:00

@Alex Holland Were you able to solve this? We seem to be running into a similar issue for some users trying to access Office components.
Alex Holland 20 Reputation points

2026-06-24T13:21:19.2433333+00:00

@Erwin de Beer Unfortunately, we were able to solve the issue by either allowing BYOD devices or wiping the end user's device. The issue we were running into was a tenant domain transfer, once the domain transferred to a different tenant the accounts on devices would not automatically change the tenant they thought they were in. So, when the device tried authenticating it would "Passthrough" the request to the old domain. Allowing BYOD policy allowed us to temporarily allow these devices to register into our Entra ID tenant to apply the new device profile which switched the tenant and SSO to the new tenant.

This worked for most if not all windows devices. The phones on the other hand were a bit different and required the phone to uninstall all office apps, remove any device profile, by wiping or from settings if possible. Then reinstalling only Microsoft Authenticator first, once the authenticator was set back up the other office apps will use the authenticator to authenticate and get past being stuck on the old domain.

I hope this helps.