This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 89%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAG%3C/text%3E%3C/svg%3E)
Trying to log into my recently created Microsoft Entra account.
Things I've tried: Clearing cookies and cache, using a private window, logging into other Microsoft services (which was okay).
When I try to log in, I receive this error message and am prompted to log in again
{
"sessionId": "e2ba350ce3ec45bfb92dc36728093130",
"errors": [
{
"errorMessage": "interaction_required: AADSTS160021: Application requested a user session which does not exist. Trace ID: 03e1f408-4a77-42a5-b890-2115134f7200 Correlation ID: e6ed395f-65a6-4613-bf24-456f11da0c26 Timestamp: 2024-12-09 20:02:34Z",
"clientId": "74658136-14ec-4630-ad9b-26e160ff0fc6",
"scopes": [
"a57aca87-cbc0-4f3c-8b9e-dc095fdc8978/.default"
]
}
]
}
When I try logging in again, I get this error message:
Selected user account does not exist in tenant 'Microsoft Services' and cannot access the application '74658136-14ec-4630-ad9b-26e160ff0fc6' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.
How can I fix this?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 51%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
Hi @Arya Gupta
Thank you for posting your query on Microsoft Q&A.
I understand that you are trying to login into your personal Microsoft Entra Account and encountering AADSTS160021 error.
Whenever you sign in Azure portal using Microsoft Personal Account by default you are getting connected to the Microsoft Services tenant. As this is a standard tenant without any directory associated, you cannot perform actions such as creating new users, groups, enterprise applications, and so on. To perform administrative actions, you must have administrative access to the tenant.
If you want to access Entra portal using your personal Microsoft account only, you can invite that user as a guest user as mentioned here: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/add-users-administrator#add-guest-users-to-the-directory and assign the Global Administrator role.
You will receive an invite email once you are added to an azure tenant and accept it, you can use https://portal.azure.com/#create/Microsoft.AzureActiveDirectory URL to create your own tenant as well.
Hope this helps. Do let us know if you have any further queries.
------------
If this answers your query, do click `Accept Answer` and `Yes`.
Thanks,
B. Siri Chandana.
Hi,
Where am I supposed to add my personal user as a guest user according to https://learn.microsoft.com/en-us/azure/active-directory/external-identities/add-users-administrator#add-guest-users-to-the-directory?
For that I would still need to log into Microsoft Entra which Im unable to. Not able to completely understand the solution.
Hi @Arya Gupta
I understand that you still can't login into Microsoft Entra Account. Contact your Global Administrator in your account, so that they can invite your personal account as guest user by following the document.
Then you can access the tenant and make sure you are not restricted to access the application also for this make sure you are assigned necessary roles, and no other policy is applied on the user and application that restricts your access.
Thanks,
B. Siri Chandana.
Hi @Arya Gupta
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Hi @Arya Gupta
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
I'm able to login now. Thanks for checking back.
However my goal with Microsoft Entra was to capture a SAML assertion while using SAML based single sign on option.
Even though Im able to get logged in with single sign on to my desired application (I'm using Salesforce), Im unable to capture the SAML assertion.
Final goal is to capture the MFA elements within the assertion.
I'm using SAMLTracer chrome extension to attempt to capture the assertion.
How can I do this?
Hi @Arya Gupta
I understand that you are using SAML Tracer chrome extension to attempt to capture the assertion.
If you want to capture the assertion you need to capture the network trace whenever you are accessing the application.
To capture a SAML assertion during a Single Sign-On (SSO) flow and extract the MFA elements using the SAMLTracer Chrome extension, follow these steps:
3.Open your browser (with SAMLTracer enabled) and navigate to the Salesforce login page or your application’s login page.
4.Trigger the login process by entering your credentials. Since your setup is using SSO, it should redirect to Microsoft Entra (Azure AD) for authentication.
5.If MFA is configured for the user in Microsoft Entra, you will be prompted for MFA during the login process. Ensure you go through the MFA challenge.
6.When user authenticates to the application, this SAMLtracer tool will capture all the network traces and will provide you the SAML request and SAML response information from the captured frame requests.
7.This SAML Response will contain the assertion, including claims and any MFA-related information if it was included in the authentication flow.
8.Once the SAML Response is captured in SAMLTracer, click on it to inspect the details.
9.Look for an Assertion in the captured response. It is typically in XML format.In the Assertion, look for relevant <Attribute> elements that represent MFA-related data.
Other Approaches:
If SAMLTracer is not capturing the assertion properly or if you want to have more granular control, you can use Fiddler
1.Download Fiddler from: http://www.telerik.com/download/fiddler
2.Configure Fiddler to decrypt HTTPS traffic
3.Within Fiddler, click Tools -> Fiddler Options
4.Select the HTTPS tab
5.Check the checkbox to Decrypt HTTPS traffic
6.You will receive a few pop-ups that are required in order to install the Fiddler root certificate, which allows Fiddler to sit as a man-in-the-middle to your HTTPS session. Click Yes to these prompts.
7.Click OK to close Fiddler Options
8.Select the option to Clear cache.
9.Select the option to Browse.
10.Reproduce the issue.
11.Save the capture. Select File\Save\All Sessions
12.Specify a file location and name.
13.Click Save.
Another easy approach without any application or extension installed is you can use developer tools in the browser itself: https://learn.microsoft.com/en-us/azure/azure-portal/capture-browser-trace
Hope this helps. Do let us know if you have any further queries.
Thanks,
B. Siri Chandana.
Hi @Arya Gupta
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Yes these steps worked. I was able to capture a single factor in the saml assertion.
Whats the method to enable MFA in Microsoft Entra? I tried clicking on many different options under "Enterprise Applications" but couldnt find it.
Hi @Arya Gupta
I understand that you are trying to enable MFA in Entra.
You can use conditional access policy to enable MFA for your desired applications.
Follow the link for detailed information: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-azure-mfa