From 13d601709d1d7ce992e02e9d0f036f88f2c215d4 Mon Sep 17 00:00:00 2001 From: Tarun Reddy Date: Mon, 29 Jun 2026 12:46:12 +0530 Subject: [PATCH 1/2] docs: clarify multi-tenant issuer requirement for Work IQ auth --- docs/work-iq/api-overview.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/work-iq/api-overview.md b/docs/work-iq/api-overview.md index 76235b43..5c1c62a3 100644 --- a/docs/work-iq/api-overview.md +++ b/docs/work-iq/api-overview.md @@ -236,7 +236,8 @@ Work IQ uses Microsoft Entra ID delegated authentication. - On-behalf-of (OBO) flows are supported. - Application-only authentication isn't supported. - Microsoft 365 permissions, sensitivity labels, and compliance policies are enforced automatically. - +> [!IMPORTANT] +> In multi-tenant (parent/child) organizations, the access token's issuer (`iss`) must match the tenant the signed-in user belongs to, not the tenant where the app is registered. Work IQ being enabled in both tenants isn't enough. Register the app as multi-tenant (`AzureADMultipleOrgs`) and have users sign in through their home tenant's authority. Otherwise the request fails with `400 AuthenticationError: "Error authenticating with resource"`. ## Path forward for new development Work IQ is the recommended foundation for new agentic and AI-powered applications on Microsoft 365 data. Build new development on Work IQ APIs to take advantage of unified protocols, integrated governance, and continued investment. From 2a97fd2fb2ed8b8f7ed7a7f5265ac20c53e41284 Mon Sep 17 00:00:00 2001 From: Laura Graham Date: Tue, 30 Jun 2026 18:23:03 -0700 Subject: [PATCH 2/2] Update api-overview.md --- docs/work-iq/api-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/work-iq/api-overview.md b/docs/work-iq/api-overview.md index 5c1c62a3..34f15686 100644 --- a/docs/work-iq/api-overview.md +++ b/docs/work-iq/api-overview.md @@ -5,7 +5,7 @@ author: jasonjoh ms.author: jasonjoh ms.topic: overview ms.localizationpriority: medium -ms.date: 06/02/2026 +ms.date: 06/29/2026 --- @@ -237,7 +237,7 @@ Work IQ uses Microsoft Entra ID delegated authentication. - Application-only authentication isn't supported. - Microsoft 365 permissions, sensitivity labels, and compliance policies are enforced automatically. > [!IMPORTANT] -> In multi-tenant (parent/child) organizations, the access token's issuer (`iss`) must match the tenant the signed-in user belongs to, not the tenant where the app is registered. Work IQ being enabled in both tenants isn't enough. Register the app as multi-tenant (`AzureADMultipleOrgs`) and have users sign in through their home tenant's authority. Otherwise the request fails with `400 AuthenticationError: "Error authenticating with resource"`. +> In multi-tenant (parent/child) organizations, the access token's issuer (`iss`) must match the tenant the signed-in user belongs to, not the tenant where the app is registered. Work IQ enabled in both tenants isn't enough. Register the app as multi-tenant (`AzureADMultipleOrgs`) and have users sign in through their home tenant's authority. Otherwise, the request fails with `400 AuthenticationError: "Error authenticating with resource"`. ## Path forward for new development Work IQ is the recommended foundation for new agentic and AI-powered applications on Microsoft 365 data. Build new development on Work IQ APIs to take advantage of unified protocols, integrated governance, and continued investment.