Skip to content

docs: multi-tenant auth guidance for 400 AuthenticationError #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Tarun Reddy - MSFT (TarunReddy-msft) wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: multi-tenant auth guidance for 400 AuthenticationError #22

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,13 +91,27 @@ dotnet run -- --token "<SOME_TOKEN>"
| Same error, but redirect URI is present | Single-tenant app + `/common` authority mismatch | Pass `--tenant <TENANT_ID>` so MSAL uses the tenant-specific authority |
| `403 Forbidden` without a scope message | User is missing the Microsoft 365 Copilot license | Assign the license; wait 15–30 min for propagation |
| `400 AuthenticationError: Error authenticating with resource` | Gateway rejected the downstream auth exchange (e.g., OBO against an unconfigured downstream service) | Check the request-id in the response headers against the gateway's logs |
| `400 AuthenticationError` in a parent/child (multi-tenant) org | App registered in one tenant, user signs in from another; token issuer (`iss`) doesn't match the user's home tenant | Register the app as **multi-tenant** (`AzureADMultipleOrgs`) and sign in with the user's home-tenant authority. See [Multi-tenant orgs](#multi-tenant-orgs-parentchild-tenants). |
| WAM re-prompts for password on every `dotnet run` | MSAL in-process cache doesn't persist across processes | Expected today. A future update may add an opt-in persistent cache. |
| `AADSTS65001: consent required` | Admin hasn't consented to the required permissions | Ask admin to run `admin-consent` (step 6 of the setup) |
| `401 Unauthorized` | Token audience mismatch | Ensure the token `aud` is `fdcc1f02-...` / `api://workiq.svc.cloud.microsoft` |
| Empty or degraded responses | License just assigned, index not ready | Wait 15–30 minutes after license assignment |

---

## Multi-tenant orgs (parent/child tenants)

If your organization spans multiple tenants — e.g. billing/usage policy in a parent tenant and the app registration in a child tenant — note that the token **issuer (`iss`) must match the tenant the signed-in user belongs to**, not the tenant where the app is registered. Work IQ being enabled in both tenants is not enough.

To make this work:

1. Register the app as **multi-tenant** (`AzureADMultipleOrgs`) — `scripts/admin-setup.sh --multi-tenant` (or `-MultiTenant`).
2. Have the user sign in through **their home tenant's** authority by passing that tenant: `--tenant <USER_HOME_TENANT_ID>`.

If the app is single-tenant in the child tenant but the user belongs to the parent tenant, you'll get `400 AuthenticationError: Error authenticating with resource`.

---

## Resources

- [Work IQ overview](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/workiq-overview)
Expand Down