Entra ID login with Auth0 rejecting domain for a personal account

Question

Entra ID login with Auth0 rejecting domain for a personal account

James Cash 0

I've configured an Entra application to use with Auth0 to provide authentication, configured to allow "Any Entra ID Tenant + Personal Microsoft accounts". It works perfectly with the email for a user in the tenant (i.e. the one ending with onmicrosoft.com); if I'm already signed into my personal Microsoft account, it offers that account as an option when clicking the "log in with Entra" button. However, if I'm not already logged in, attempting to enter the email for the personal account fails and the Microsoft login page displays the error "[email domain] isn't in our system. Make sure you typed it correctly.".

What do I need to do with the Entra application to make this work?

0 comments

1 answer

Your answer

Answer 1

The app registration side sounds right already. The problem is most likely on the Auth0 side: the Azure AD / Entra enterprise connection sends users to your tenant's own login endpoint (the Microsoft Azure AD Domain you entered in the connection), not to the common endpoint. So when you type a personal email, Entra looks it up inside your tenant only, doesn't find it, and you get "isn't in our system". When you're already signed in, the account picker just shows the session you have, which is why it looks like it half works.

What fixed this pattern for others, per Auth0's own support articles:

In Auth0, open your Microsoft Azure AD enterprise connection and turn on "Use common endpoint". That sends the sign-in to the common endpoint, where Entra does home realm discovery on the email domain and can route personal accounts to the Microsoft account sign-in.
In Entra, check the app registration's Manifest and make sure signInAudience is AzureADandPersonalMicrosoftAccount (that's what "Any Entra ID tenant + Personal Microsoft accounts" sets).
The app has to be registered in a regular workforce Entra ID tenant, not an External ID tenant, if you want both work and personal accounts.

One thing to watch: a few people on the Auth0 community forum reported the "Use common endpoint" toggle unchecking itself after saving, so reopen the connection and confirm it stuck. Also, Auth0's article says to check the user ID field is set to sub before you switch, so existing users keep matching.

Test it in a private browser window with no Microsoft session, type the personal email, and you should land on the Microsoft account password page instead of the error.