Loging into Entra ID throws error

Aaron Kamphuis 25 Reputation points
2026-03-30T18:29:18.36+00:00

when i login, an old client's directory is giving me all sorts of fits within the Azure and EntraID

What do i do?

Request Id: 61857958-0b77-4989-a6ae-3e038dbe2300

Correlation Id: 019d3fff-0f8e-74e9-b40e-fe93ff4720e9

Timestamp: 2026-03-30T18:26:14Z

Message: AADSTS90072: User account '******@gmail.com' from identity provider 'live.com' does not exist in tenant 'xxxxxx Corp.' and cannot access the application 'c44b4083-3bb0-49c1-b47d-974e53cbdf3c'(Azure Portal) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account

Microsoft Security | Microsoft Entra | Microsoft Entra External ID

1 answer

Sort by: Oldest
  1. AI answer

    2026-03-30T18:29:37.74+00:00

    The error means the personal Microsoft account from live.com no longer exists as a user in that old client’s Entra ID tenant, so Azure Portal can’t sign in there with that account.

    To resolve:

    1. Switch to a different tenant that the account can access
      In the Azure Portal or Entra admin center sign-in page, use the tenant picker to select a different directory where the gmail.com account is actually a member. If necessary, sign out completely from all Microsoft accounts in the browser and sign back in, then choose the correct directory.
    2. Remove or re-add the account in that tenant (admin required)
      If access to that old client tenant is still required, an administrator in the xxxxxx Corp. tenant must add the gmail.com account as a guest user:
      • Sign in to the Microsoft Entra admin center as at least a user administrator or higher.
      • Go to Entra ID > Users and verify whether the account exists. If not, add it as an external (guest) user and assign any required roles or app access.
    3. Use the correct sign-in endpoint for the account type
      If using custom apps or tools, ensure the authority/endpoint matches the account type. For example, for personal Microsoft accounts or multi-tenant apps, use the appropriate sign-in URL instead of a tenant-specific one:
      • Multitenant apps: https://login.microsoftonline.com/organizations
      • Multitenant + personal accounts: https://login.microsoftonline.com/common
      • Personal accounts only: https://login.microsoftonline.com/consumers

    If the account should no longer access that client’s tenant, simply ensure a different directory is selected when opening Azure Portal and ignore that old tenant.


    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.