diff --git a/README.md b/README.md index ef8383f..c54fe86 100644 --- a/README.md +++ b/README.md @@ -91,6 +91,7 @@ dotnet run -- --token "" | Same error, but redirect URI is present | Single-tenant app + `/common` authority mismatch | Pass `--tenant ` so MSAL uses the tenant-specific authority | | `403 Forbidden` without a scope message | User is missing the Microsoft 365 Copilot license | Assign the license; wait 15–30 min for propagation | | `400 AuthenticationError: Error authenticating with resource` | Gateway rejected the downstream auth exchange (e.g., OBO against an unconfigured downstream service) | Check the request-id in the response headers against the gateway's logs | +| `400 AuthenticationError` in a parent/child (multi-tenant) org | App registered in one tenant, user signs in from another; token issuer (`iss`) doesn't match the user's home tenant | Register the app as **multi-tenant** (`AzureADMultipleOrgs`) and sign in with the user's home-tenant authority. See [Multi-tenant orgs](#multi-tenant-orgs-parentchild-tenants). | | WAM re-prompts for password on every `dotnet run` | MSAL in-process cache doesn't persist across processes | Expected today. A future update may add an opt-in persistent cache. | | `AADSTS65001: consent required` | Admin hasn't consented to the required permissions | Ask admin to run `admin-consent` (step 6 of the setup) | | `401 Unauthorized` | Token audience mismatch | Ensure the token `aud` is `fdcc1f02-...` / `api://workiq.svc.cloud.microsoft` | @@ -98,6 +99,19 @@ dotnet run -- --token "" --- +## Multi-tenant orgs (parent/child tenants) + +If your organization spans multiple tenants — e.g. billing/usage policy in a parent tenant and the app registration in a child tenant — note that the token **issuer (`iss`) must match the tenant the signed-in user belongs to**, not the tenant where the app is registered. Work IQ being enabled in both tenants is not enough. + +To make this work: + +1. Register the app as **multi-tenant** (`AzureADMultipleOrgs`) — `scripts/admin-setup.sh --multi-tenant` (or `-MultiTenant`). +2. Have the user sign in through **their home tenant's** authority by passing that tenant: `--tenant `. + +If the app is single-tenant in the child tenant but the user belongs to the parent tenant, you'll get `400 AuthenticationError: Error authenticating with resource`. + +--- + ## Resources - [Work IQ overview](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/workiq-overview)