When configuring external identities, the Microsoft one (i.e. for using personal accounts), for a portal, fails to work with a generic "Unable to authenticate with the external account provider.". The URL offers a slightly better hint: `Account/Login/ExternalLoginCallback?ReturnUrl=%2F&Provider=Microsoft&error=access_denied`.
Any thoughts on how to diagnose/debug this?