How to fix error AADSTS500210 when using a custom domain?

Question

We have two Entra External ID tenants (companydev and companyprod).

For both of them we set up a custom domain (id-dev.company.com and id.company.com).

In both tenants, I created a user flow and added an app registration to it.

When I grab the OpenID Connect metadata document from the app registration, it initially looks like this: https://<tenantname>.ciamlogin.com/<tenant-id>/v2.0/.well-known/openid-configuration

It works fine for both tenants.

Switching to the custom domain, the URLs become https://id-dev.company.com/<tenant-id>/v2.0/.well-known/openid-configuration for DEV and https://id.company.com/<tenant-id>/v2.0/.well-known/openid-configuration for PROD.

PROD returns the OpenID Connect metadata document just fine.

DEV returns this error:

{
  "error": "server_error",
  "error_description": "AADSTS500210: Domain name does not match with the tenant identifier Trace ID: *** Correlation ID: *** Timestamp: 2024-08-13 07:04:44Z",
  "error_codes": [500210],
  "timestamp": "2024-08-13 07:04:44Z",
  "trace_id": "***",
  "correlation_id": "***"
}

I cannot find any information regarding this error anywhere. It seems like nobody else has ever faced this issue. I also can't find any information about it in Microsoft's documentations.

I'm able to run the user flow with the custom domain. So, it seems like the error only happens for the metadata document.

Please advise.

Answer 1

Hi.

Thanks for the link. It successfully returned the tenant id. So, the domain verification doesn't seem to be the issue.