Getting error ""errorMessage": "interaction_required: AADSTS16000: User account '{EUII Hidden}' from identity provider"

Question

Am getting the "

"errorMessage": "interaction_required: AADSTS16000: User account '{EUII Hidden}' from identity provider

". Not able to trouble shoot and resolve it

"

{
  "sessionId": "4724871fc38247929113d9186240cb4e",
  "errors": [
    {
      "errorMessage": "interaction_required: AADSTS16000: User account '{EUII Hidden}' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application '74658136-14ec-4630-ad9b-26e160ff0fc6'(ADIbizaUX) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account. Trace ID: 1ba536b3-cd6e-4cae-a2a9-e010c1230c00 Correlation ID: b50c098a-77b9-4471-b289-4375751e649b Timestamp: 2025-01-16 16:29:38Z",
      "clientId": "74658136-14ec-4630-ad9b-26e160ff0fc6",
      "scopes": [
        "a57aca87-cbc0-4f3c-8b9e-dc095fdc8978/.default"
      ]
    }
  ]
}"

Answer 1

Hi @MyStudyLoop ,

Thank you for reaching out Microsoft Q&A.

I understand you are getting AADSTS16000 error this is a very common error that occurs when you try to sign in to the Microsoft Entra admin center with a personal Microsoft account that does not have a directory associated with it.

Reason:
Whenever you sign in Azure portal using Microsoft Personal Account you by default get connected to the Microsoft Services tenant

As this is a standard tenant without any directory associated, you cannot perform actions such as creating new users, groups, enterprise applications, and so on. To perform administrative actions, you must have administrative access to the tenant.

Solution:
For this purpose, you need to create your own tenant rather than using the Microsoft Services tenant.To create a new tenant, open in-private/incognito browser window (just to avoid SSO), access https://azure.microsoft.com/en-us/free/ to create a free Azure account.
When you create a new tenant, you by default become the Global Administrator of the new tenant and have full access to all the options in that tenant.

If you still want to access Entra portal using your personal Microsoft account only, you can invite that user as a guest user as mentioned here : https://learn.microsoft.com/en-us/azure/active-directory/external-identities/add-users-administrator#add-guest-users-to-the-directory and assign the Global Administrator role.

Once you are added to an azure tenant and you accept the invite sent to you via email, you can use https://portal.azure.com/#create/Microsoft.AzureActiveDirectory URL to create your own tenant as well.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Regards,
Goutam Pratti.