You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The old Msol commands under the "verification option 2" don't have an equivalent in Graph so it's no longer possible to retrieve AlternativeSecurityIds not LiveID (NetId).
I've asked 2 EEE teammates in the auth v-Team to review the Msol commands and their opinion is that "verification option 1" is sufficient for troubleshooting purposes, so I removed the option 2.
Copy file name to clipboardExpand all lines: support/entra/entra-id/app-integration/error-code-AADSTS50020-user-account-identity-provider-does-not-exist.md
+1-25Lines changed: 1 addition & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -132,7 +132,7 @@ Use a tenant-specific endpoint (`https://login.microsoftonline.com/<TenantIDOrNa
132
132
133
133
Error `AADSTS50020` might occur if the name of a guest user who was deleted in a resource tenant is re-created by the administrator of the home tenant. To verify that the guest user account in the resource tenant isn't associated with a user account in the home tenant, use one of the following options:
134
134
135
-
### Verification option 1: Check whether the resource tenant's guest user is older than the home tenant's user account
135
+
### Verification: Check whether the resource tenant's guest user is older than the home tenant's user account
136
136
137
137
The first verification option involves comparing the age of the resource tenant's guest user against the home tenant's user account. You can make this verification by using Microsoft Graph, Microsoft Entra PowerShell or Microsoft Graph PowerShell SDK
Then, check the creation date of the guest user in the resource tenant against the creation date of the user account in the home tenant. The scenario is confirmed if the guest user was created before the home tenant's user account was created.
178
178
179
-
### Verification option 2: Check whether the resource tenant's guest alternative security ID differs from the home tenant's user net ID
180
-
181
-
> [!NOTE]
182
-
> The [MSOnline PowerShell module](/powershell/azure/active-directory/install-msonlinev1) is set to be deprecated.
183
-
> Because it's also incompatible with PowerShell Core, make sure that you're using a compatible PowerShell version so that you can run the following commands.
184
-
185
-
When a guest user accepts an invitation, the user's `LiveID` attribute (the unique sign-in ID of the user) is stored in the `AlternativeSecurityIds` attribute. Because the user account was deleted and created in the home tenant, the `NetID` value for the account will have changed for the user in the home tenant. Compare the `NetID` value of the user account in the home tenant against the key value that's stored within `AlternativeSecurityIds` of the guest account in the resource tenant, as follows:
186
-
187
-
1. In the home tenant, retrieve the value of the `LiveID` attribute using the `Get-MsolUser` PowerShell cmdlet:
1. Convert the base64-encoded string to a hexadecimal value by using an online converter (such as [base64.guru](https://base64.guru/converter/decode/hex)).
201
-
1. Compare the values from step 1 and step 3 to verify that they're different. The `NetID` of the user account in the home tenant changed when the account was deleted and re-created.
202
-
203
179
### Solution: Reset the redemption status of the guest user account
204
180
205
181
Reset the redemption status of the guest user account in the resource tenant. Then, you can keep the guest user object without having to delete and then re-create the guest account. You can reset the redemption status by using the Azure portal, Azure PowerShell, or the Microsoft Graph API. For instructions, see [Reset redemption status for a guest user](/azure/active-directory/external-identities/reset-redemption-status).
0 commit comments