Edit "Restrict-Access-To-Tenants" to external tenant Azure AD (error AADSTS500021: Access to tenant is denied)

Question

Hi, recently we've adding an external identities from some external customers. But they are receiving an error message when trying to login to microsoft powerbi through a website developed by our company. I've read that I would have to edit a header to add the tenant that we want to authorize to authenticate with our AD, but I do not get a clear procedure to do it, do you know how this would be done? Thank you

Answer 1

@R. Alejandro Taborda Chinea Thank you for posting your query on Q&A forum!!!

As mentioned here the mentioned error specifies that Access to '{tenant}' tenant is denied. AADSTS500021 indicates that the tenant restriction feature is configured and that the user is trying to access a tenant that is not in the list of allowed tenants specified in the header Restrict-Access-To-Tenant.

For similar error there is reference to this article which specifies For Restrict-Access-To-Tenants, use a value of <permitted tenant list>, which is a comma-separated list of tenants you want to allow users to access. Any domain that is registered with a tenant can be used to identify the tenant in this list, as well as the directory ID itself. For an example of all three ways of describing a tenant, the name/value pair to allow Contoso, Fabrikam, and Microsoft looks like: Restrict-Access-To-Tenants: contoso.com,fabrikam.onmicrosoft.com,72f988bf-86f1-41af-91ab-2d7cd011db47

This means that on the users organization side there is setting for restricted tenant and your tenant is not configured under set of permitted tenants on user side as explained in above example and hence they are getting the error. The mentioned feature is configured in many tenants for security reason and hence this setting is needed to be changed on user side to add your tenant to the list of Restricted Access to tenants. You can refer to the above article for settings to be made on their Tenant side.

Additionally you might have covered this article already when configuring external identities for PowerBi but adding it here so that in case if you have not already covered it you can consider all the Pre requisites as well for configuration.

Hope it helps!!!

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.

Answer 2

Hello, thank you for your reply

How could I do to add or edit the value to add the client tenant? that's what I haven't been able to see clearly in the documentation, is it done by powershell or azure portal? the adjustment is only on our side or should the client also do something? in our case it is the client who tries to authenticate in our tenant, thanks

Best regards

Answer 3

@R. Alejandro Taborda Chinea - were you able to resolve this issue? If so what was the solution.
Our clients are unable to login to the application hosted by our company with the same tenant restriction error.

Thanks for your help.

Answer 4

I have the same problem, one of my clients trying to login to M365 tenant from Citrix VDI and gets the same error message. Can you please let me know what is the procedure to resolve it. All Citrix user can log in to M365 from their normal computer but get's : Failure reason "Access to '{xyz}' tenant is denied.

Thank you!