The account needs to be added as an external user in the tenant first. Please use a different account.

Hello Code Embassy,

Greetings! Thanks for raising this question in the Q&A forum.

This error is not caused by your resource configuration. It comes from a Microsoft-internal client application, Microsoft_Azure_SupportPortalExtension (client ID e6694c91-1590-4e35-9bb7-b865c638b9c1), which the Azure portal silently tries to sign in to in the background against Microsoft's own internal tenant named "Microsoft Services." Since your account is not a member of that internal Microsoft tenant, this background call always fails and surfaces the "needs to be added as an external user" message. It has nothing to do with an external-user or guest-access problem in your own tenant.

In most cases this is cosmetic and does not block resource creation by itself, but it commonly shows up together with (and points to) one of two real underlying issues: the portal landing on the wrong directory, or your account not yet having an active Azure subscription. Work through these in order.

Confirm you're on the correct directory

Sign in to https://portal.azure.com, click your account icon in the top right, and select Switch directory. Make sure you land on your own tenant, not a default or leftover directory. If you see multiple directories listed, pick the one where your subscription actually lives.

Confirm a subscription actually exists on this account

Go to Subscriptions in the portal. If nothing is listed, that's your real blocker. A brand-new Entra ID/Azure account with no subscription cannot fully initialize several portal extensions, and this background auth error is a known side effect of that state. Create one of the following to resolve it:

portal.azure.com > Subscriptions > + Add

Options: Free Trial, Pay-As-You-Go, Azure for Students (if you're a verified student), or an Azure Sponsorship if you have one. Once a subscription is provisioned, this error typically disappears on its own.

Clear the stale sign-in session

The error frequently persists because the browser is holding a cached token tied to the wrong account context.

• Sign out completely from https://portal.azure.com and https://login.microsoftonline.com
  • Close all browser tabs, then open a fresh InPrivate/Incognito window
    • Sign in directly at portal.azure.com, and when prompted, explicitly choose Use another account rather than an account suggested from cache
    Try a different browser or disable extensions Ad blockers, privacy extensions, or third-party cookie blocking can interfere with the multiple silent auth redirects the portal performs. Test in a clean browser profile with extensions disabled to rule this out. If you were actually trying to create a specific resource (e.g. an Azure Load Testing resource) and it fails, not just a banner Check the exact operation that fails after you've confirmed steps 1–2. If subscription and directory are both correct and the error still blocks a specific resource creation, please reply with the resource type, the full error including any correlation ID, and whether it happens only for that one resource or across the whole portal, so it can be narrowed down further.

If none of the above resolves it and you can't submit a support ticket because there's no subscription to attach it to, you can still reach Azure support through the free support options here: Azure support plans and how to create a ticket.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.