Skip to content

Commit b2b2d33

Browse files
authored
Remove redundant verification option 2 section
The old Msol commands under the "verification option 2" don't have an equivalent in Graph so it's no longer possible to retrieve AlternativeSecurityIds not LiveID (NetId). I've asked 2 EEE teammates in the auth v-Team to review the Msol commands and their opinion is that "verification option 1" is sufficient for troubleshooting purposes, so I removed the option 2.
1 parent 90f85bc commit b2b2d33

1 file changed

Lines changed: 1 addition & 25 deletions

File tree

support/entra/entra-id/app-integration/error-code-AADSTS50020-user-account-identity-provider-does-not-exist.md

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ Use a tenant-specific endpoint (`https://login.microsoftonline.com/<TenantIDOrNa
132132

133133
Error `AADSTS50020` might occur if the name of a guest user who was deleted in a resource tenant is re-created by the administrator of the home tenant. To verify that the guest user account in the resource tenant isn't associated with a user account in the home tenant, use one of the following options:
134134

135-
### Verification option 1: Check whether the resource tenant's guest user is older than the home tenant's user account
135+
### Verification: Check whether the resource tenant's guest user is older than the home tenant's user account
136136

137137
The first verification option involves comparing the age of the resource tenant's guest user against the home tenant's user account. You can make this verification by using Microsoft Graph, Microsoft Entra PowerShell or Microsoft Graph PowerShell SDK
138138

@@ -176,30 +176,6 @@ Get-MgUser -UserId {id | userPrincipalName} -Property $p| Select-Object $p
176176

177177
Then, check the creation date of the guest user in the resource tenant against the creation date of the user account in the home tenant. The scenario is confirmed if the guest user was created before the home tenant's user account was created.
178178

179-
### Verification option 2: Check whether the resource tenant's guest alternative security ID differs from the home tenant's user net ID
180-
181-
> [!NOTE]
182-
> The [MSOnline PowerShell module](/powershell/azure/active-directory/install-msonlinev1) is set to be deprecated.
183-
> Because it's also incompatible with PowerShell Core, make sure that you're using a compatible PowerShell version so that you can run the following commands.
184-
185-
When a guest user accepts an invitation, the user's `LiveID` attribute (the unique sign-in ID of the user) is stored in the `AlternativeSecurityIds` attribute. Because the user account was deleted and created in the home tenant, the `NetID` value for the account will have changed for the user in the home tenant. Compare the `NetID` value of the user account in the home tenant against the key value that's stored within `AlternativeSecurityIds` of the guest account in the resource tenant, as follows:
186-
187-
1. In the home tenant, retrieve the value of the `LiveID` attribute using the `Get-MsolUser` PowerShell cmdlet:
188-
189-
```azurepowershell
190-
Get-MsolUser -SearchString tuser1 | Select-Object -ExpandProperty LiveID
191-
```
192-
193-
1. In the resource tenant, convert the value of the `key` attribute within `AlternativeSecurityIds` to a base64-encoded string:
194-
195-
```azurepowershell
196-
[convert]::ToBase64String((Get-MsolUser -ObjectId 01234567-89ab-cdef-0123-456789abcdef
197-
).AlternativeSecurityIds.key)
198-
```
199-
200-
1. Convert the base64-encoded string to a hexadecimal value by using an online converter (such as [base64.guru](https://base64.guru/converter/decode/hex)).
201-
1. Compare the values from step 1 and step 3 to verify that they're different. The `NetID` of the user account in the home tenant changed when the account was deleted and re-created.
202-
203179
### Solution: Reset the redemption status of the guest user account
204180

205181
Reset the redemption status of the guest user account in the resource tenant. Then, you can keep the guest user object without having to delete and then re-create the guest account. You can reset the redemption status by using the Azure portal, Azure PowerShell, or the Microsoft Graph API. For instructions, see [Reset redemption status for a guest user](/azure/active-directory/external-identities/reset-redemption-status).

0 commit comments

Comments
 (0)