Account sign-in routes to personal Microsoft account, blocking Startups business verification

ISSUE: Organizational account sign-in redirects to personal Microsoft account

ENVIRONMENT:

Tenant: Readynis (Tenant ID: 6bf03b74-9b29-474e-a4a2-19bc4a62117a)

Domain: founderreadynis.onmicrosoft.com

Affected account: ******@readynis.com (Global Administrator)

Subscriptions: sub-readynis-prod, sub-readynis-nonprod

EXPECTED BEHAVIOR:

Signing in to portal.azure.com or entra.microsoft.com with ******@readynis.com should authenticate against the Readynis Entra tenant via login.microsoftonline.com.

ACTUAL BEHAVIOR:

The sign-in flow begins correctly at login.microsoftonline.com/organizations/oauth2/v2.0/authorize (client_id c44b4083-3bb0-49c1-b47d-974e53cbdf3c), but is then redirected to login.live.com/oauth20_authorize.srf (client_id 51483342-085c-4d86-bf88-cf50c7252078) - a consumer/personal Microsoft account authorization endpoint - instead of continuing organizational authentication. The personal account flow then offers passkey (Apple iCloud Keychain), email-code, or password sign-in - none of which are the organization's registered methods (Passkey/FIDO2, Microsoft Authenticator).

STEPS TO REPRODUCE:

1. Navigate to portal.azure.com (or entra.microsoft.com) in a fresh browser session.
2. Enter ******@readynis.com on the org sign-in page.
3. Click Next.
4. Observe redirect to login.live.com instead of the organizational password/MFA prompt.

TROUBLESHOOTING ALREADY COMPLETED:

• Reproduced in a clean Incognito window with browsing history cleared - ruled out browser autocomplete.
• Reproduced with all browser extensions disabled - ruled out extension interference.
• Confirmed a separate personal Microsoft account exists under the same email address, with its own distinct security methods (passkey via iCloud Keychain, no password set, recovery email fi*****@gmail.com).
• Automated Azure diagnostic tool (run via Help + Support) found no Conditional Access policies blocking or interrupting the sign-in - confirms this is not a Conditional Access or MFA policy issue.

SUSPECTED ROOT CAUSE:

Likely tied to a previously-flagged identity verification conflict during Microsoft for Startups credit signup/verification (mismatched name across signup details, account profile, and LinkedIn verification), which may have caused ******@readynis.com to become linked to or associated with a personal Microsoft account (MSA) rather than resolving purely to the organizational identity.

REQUESTED RESOLUTION:

Please investigate and correct the Home Realm Discovery / account routing for ******@readynis.com so that organizational sign-in resolves directly to the Entra tenant (login.microsoftonline.com) without redirecting to the personal account system (login.live.com).

BUSINESS IMPACT:

This account-routing issue is also suspected to be blocking completion of Microsoft for Startups business verification for this account, which is required to unlock an increased Azure credit limit ($5,000, currently capped at $1,000). Resolving the underlying account link/routing issue may be necessary to complete that verification.

CURRENT WORKAROUND IN USE:

On the login.live.com prompt, selecting "Other ways to sign in" then passkey (Touch ID via iCloud Keychain) allows sign-in to proceed, avoiding the need for an emailed one-time code each time. This is a workaround, not a fix.