Issue: AADSTS165000 when using domain_hint=Google and login_hint for direct Google login in Entra External ID

Question

Issue: AADSTS165000 when using domain_hint=Google and login_hint for direct Google login in Entra External ID

Saravana Kumar Palanisamy 30

I have configured Microsoft Entra External ID with Google authentication and local accounts. The default sign-in page shows the Google button, but I want users to go directly to Google login without clicking it to achieve the Google OneTap login

✔️ What I Did

I added the following parameters to the authorization request so the user is redirected straight to Google:

domain_hint=Google

login_hint=******@gmail.com

prompt=login

This works for first-time sign-in:

User goes straight to Google

Authenticates successfully

Returned to the “Add details” page (External ID sign-up)

User completes details

Auth code is sent to the application

Login completes successfully

❌ The Problem

When I try to log in again using:

domain_hint=Google&login_hint=******@gmail.com&prompt=login

I get this error:

Request Id: aaaaaaaaaaa
Correlation Id: aaaaaaaaaa
Timestamp: 2025-12-06T12:28:14Z
Message: AADSTS165000: Invalid Request: The request did not include the required tokens for the user context. One or more of the user context values (cookies; form fields; headers) were not supplied, every request must include these values and maintain them across a complete single user flow. The request did not return all of the form fields. Failure Reasons:[Token was not provided;]

🔍 Additional Finding

If I remove the login_hint parameter, it works successfully. So the issue appears only when both domain_hint=Google and login_hint are used together on subsequent sign-ins.

❓ What I Need Help With

After completing sign-up, the next login attempt fails with AADSTS165000 when using both domain_hint and login_hint.

It seems the External ID user flow expects certain context cookies / tokens, and using login_hint may cause the flow to skip part of the expected sequence, resulting in missing form tokens.

Has anyone successfully implemented direct Google login with External ID using login_hint? Any help or guidance would be greatly appreciated!

George Iliopoulos 15 Reputation points

2026-02-17T18:32:51.2766667+00:00

I am having exactly the same issue. Is anyone from MS looking at it? The AI answer below is not helpful. Especially with Google the use of login_hint is needed to avoid another issue.
Nicholas Vocaire 30 Reputation points

2026-02-25T17:11:12.1166667+00:00

+1 to this. I am experiencing the same issue, though with use of a custom OIDC identity provider. Seems the issue exists for all federated OIDC identity providers (even included ones like google)

I went a little deeper into the issue, and it seem to not matter if domain_hint is present, Entra looks up the user's identity provider and redirects there anyways, so the issue seems to completely deal with login_hint.

Inspecting the network graph, I saw Entra fails to pass a code_challenge in the PKCE auth code flow it does with the identity provider if login_hint is present. Entra properly passes a code_challege for domain_hint only, or when the user clicks the "Sign in with ..." button. It also gets passed properly if the user types in their identifier manually and then clicks "Next".
Philip Hendry 110 Reputation points

2026-04-17T08:10:43.0533333+00:00

+1 from me too. I'm experiencing this issue with a custom OIDC identity provider for auth0 when providing the users email as a login_hint. Attempting to swap that for a domain_hint doesn't help either and only confuses further since, rather than home realm discovery finding the mytenant.uk.auth0.com (I'm testing with a Auth0 IdP) domain it instead fowards to okta.okta.com!! No idea where that comes from but I think it's baked into Entra for some reason.

How is it possible to have Enterprise federation with OIDC? It all works if I associate IdP to a user flow but that means all federated OIDC providers end up on the Microsoft sign in page as a "Sign in with ..." button which is unacceptable.
Lasse Herget 0 Reputation points

2026-04-22T14:00:54.1233333+00:00

+1 for me too. I'm experiencing this issue using Microsoft.Identity.Web (4.8.0) when providing the users email as a login_hint. I attempted to add "Google" as domain_hint, but that doesn't fully resolve the issue.

1 answer

Your answer

George Iliopoulos 15 Reputation points

2026-02-17T18:32:51.2766667+00:00

I am having exactly the same issue. Is anyone from MS looking at it? The AI answer below is not helpful. Especially with Google the use of login_hint is needed to avoid another issue.
Nicholas Vocaire 30 Reputation points

2026-02-25T17:11:12.1166667+00:00

+1 to this. I am experiencing the same issue, though with use of a custom OIDC identity provider. Seems the issue exists for all federated OIDC identity providers (even included ones like google)

I went a little deeper into the issue, and it seem to not matter if domain_hint is present, Entra looks up the user's identity provider and redirects there anyways, so the issue seems to completely deal with login_hint.

Inspecting the network graph, I saw Entra fails to pass a code_challenge in the PKCE auth code flow it does with the identity provider if login_hint is present. Entra properly passes a code_challege for domain_hint only, or when the user clicks the "Sign in with ..." button. It also gets passed properly if the user types in their identifier manually and then clicks "Next".
Philip Hendry 110 Reputation points

2026-04-17T08:10:43.0533333+00:00

+1 from me too. I'm experiencing this issue with a custom OIDC identity provider for auth0 when providing the users email as a login_hint. Attempting to swap that for a domain_hint doesn't help either and only confuses further since, rather than home realm discovery finding the mytenant.uk.auth0.com (I'm testing with a Auth0 IdP) domain it instead fowards to okta.okta.com!! No idea where that comes from but I think it's baked into Entra for some reason.

How is it possible to have Enterprise federation with OIDC? It all works if I associate IdP to a user flow but that means all federated OIDC providers end up on the Microsoft sign in page as a "Sign in with ..." button which is unacceptable.
Lasse Herget 0 Reputation points

2026-04-22T14:00:54.1233333+00:00

+1 for me too. I'm experiencing this issue using Microsoft.Identity.Web (4.8.0) when providing the users email as a login_hint. I attempted to add "Google" as domain_hint, but that doesn't fully resolve the issue.

Answer 1

The error AADSTS165000 indicates that the request is missing required tokens for the user context. This often occurs when the authentication flow does not maintain the necessary session state across requests. When using both domain_hint=Google and login_hint, it seems that the flow may be skipping some steps that are required to maintain the session context, particularly after the initial sign-up.

Here are a few suggestions to troubleshoot and potentially resolve the issue:

Check Session State: Ensure that the session cookies are being maintained properly between requests. If the session is lost, the login_hint may not be able to retrieve the necessary context.
Use login_hint Carefully: Since you mentioned that removing login_hint allows the login to succeed, consider using it only when necessary. For subsequent logins, you might want to rely on the session state rather than explicitly passing login_hint.
Review User Flow Configuration: Double-check the configuration of your user flow in Microsoft Entra External ID to ensure that all required parameters are set correctly and that the flow is designed to handle the direct login scenario.
Testing with Different Scenarios: Try testing the login process with different user accounts or configurations to see if the issue persists across all scenarios or is isolated to specific accounts.
Consult Documentation: Review the Microsoft documentation regarding the use of domain_hint and login_hint to ensure that you are following best practices and that there are no additional requirements for your specific setup.

If the issue continues, consider reaching out to Microsoft support for more tailored assistance regarding the Entra External ID and Google authentication integration.

References: