Answered

Tenant Guest Users Need Admin Approval to Complete Registration

(0) Share

Report

Posted on by KyleSchroeder

Hello,

I've come across an issue in my Production Portal (Power Pages) solution. I have configured the authentication for users to use Azure AD (Entra ID). In my Sandbox environment and Portal, this works perfectly for all Tenant users (members and guests). However, I have recently deployed the portal to a Production environment, and only members are able to complete the invitation process. Guest users get the invitation code, register it with their contact profile, and then go through the MFA setup process only to see a message saying Approval required. The Sandbox environment was created a year ago, and the Production environment was created back in August 2023. Does anyone know why Guest users can sign in with Azure AD in the Sandbox version but not the Production version? Is there a setting in Dynamics 365 that I need to change that I forgot? This doesn't seem like an Azure AD (Entra ID) thing. Any assistance would be greatly appreciated!

Categories:

Security

I have the same question (0)

All responses (3)

Answers (1)

Fubar 8,435 Super User 2025 Season 2 on at

Like (0)

Report
Copy link

Link copied!

The Message you are seeing is an Azure message. I can't remember where the setting is exactly, but think it is to do with the Consent workflow, in Azure locate the Application that will exist for the Portal/Power Pages site and you configure it for the Azure Application.

Was this reply helpful? Yes No
KyleSchroeder on at

Like (0)

Report
Copy link

Link copied!

Can you elaborate a little more on "Configure it for the Azure Application"? When I go to Azure and find both Portals in App Registration under Applications, they both have identical configurations and I don't see anything that stands out. I know this didn't need to done for the Sandbox version or the other Portals solutions I've built and migrated.

Was this reply helpful? Yes No
Verified answer

KyleSchroeder on at

Like (1)

Report
Copy link

Link copied!
I've found the solution to my issue, and I hope this will help everyone else. The cause behind this issue is due to the creator of the Portal/Power Pages site. The account I was using to create the Production version did not have enough permissions in Azure/Entra, so it was not prompted to approve access to the Microsoft Graph API. This meant that I needed someone with Global Admin permission to go to Azure AD/Entra ID and follow these steps.
Go to entra.microsoft.com
Under Applications, select App Registration
Search for the name of the Portal/Power Pages and click on the name
Go to the API permissions
If the APIs have not been approved, the Global Admin needs to click Grant admin consent for <Company Name>
Once the last step has been completed, it should allow guest users in the tenant to use Azure AD as their OpenID connection and authenticator. In the future, I'll be looking to use Google and/or Microsoft as alternative authenticators.

Was this reply helpful? Yes No