Office 365 / Entra ID / Rights Protection

[PurpleTentacle]

Please excuse my inexperience with most things Microsoft cloud related, I've been working more with on-site OS and application deployment than anything cloud related for far too long.

 

We have received a number of email from a local authority that they have sent as rights protected.

 

The right protection requires our users to authenticate against the LA's tenant.

 

When the user enters their school email address and password to try to authenticate the error we get back (translated by me) says the account (user's school email address) is not recognised and as such is not authorised to use the rights protection {GUID} application.

 

We have reported this back to the sender but they keep saying we should be able to read the emails if we log in.

 

Are there any settings on our tenant that would stop the LA's tenant authenticating one of our users and allowing that user access to the rights protection app?

[EssentialRug]

Please excuse my inexperience with most things Microsoft cloud related, I've been working more with on-site OS and application deployment than anything cloud related for far too long.

 

We have received a number of email from a local authority that they have sent as rights protected.

 

The right protection requires our users to authenticate against the LA's tenant.

 

When the user enters their school email address and password to try to authenticate the error we get back (translated by me) says the account (user's school email address) is not recognised and as such is not authorised to use the rights protection {GUID} application.

 

We have reported this back to the sender but they keep saying we should be able to read the emails if we log in.

 

Are there any settings on our tenant that would stop the LA's tenant authenticating one of our users and allowing that user access to the rights protection app?

 

Very basic troubleshooting, but is the LA sending to an alias rather than the actual email address of the users? I know we've had this issue in the past with accessing our LA's SharePoints. Could be worth a quick look...

[PurpleTentacle]

Very basic troubleshooting, but is the LA sending to an alias rather than the actual email address of the users? I know we've had this issue in the past with accessing our LA's SharePoints. Could be worth a quick look...

That didn't occur to me to check. TBH I'm not sure what alias it could have gone to to get to the users it went to, but it worth checking. Thanks.

[PurpleTentacle]

Still can't get in.

 

Does this look like something could be misconfigured on our tenant?

 

Request Id: 0288b80e-1b62-474e-aef7-f1736c2fd700

Correlation Id: 1f1283c7-208a-4918-868d-b630445238b4

Timestamp: 2023-11-27T09:29:48Z

Message: AADSTS90072: User account 'email address' from identity provider 'https://sts.windows.net/59ee22e4-2fca-4f6d-86d0-2a2fabecce72/' does not exist in tenant 'Local Authority' and cannot access the application 'd3590ed6-52b3-4102-aeff-aad2292ab01c'(Microsoft Office) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account

[StevieM]

Does your LA provide email addresses to you or other schools? We used to have issues when we first moved away from LA provision as they just expected things to just carry on working as before. Of course, it didn't because our new email addresses were no longer in their tenancy.

[PurpleTentacle]

They are a neighbour LA, so we definitely never had addresses from them.

 

The cynic in me thinks this is a ploy by the department sending the email because if we don't answer it they make assumptions that would appear to benefit them.

[StevieM]

They are a neighbour LA, so we definitely never had addresses from them.

 

Ah, then perhaps they are expecting it to work in the same way as it does with schools in their LA. If they want you to access the resource, they will need to add you to the tenant as an external user - as stated in the error message.

[PurpleTentacle]

Ah, then perhaps they are expecting it to work in the same way as it does with schools in their LA. If they want you to access the resource, they will need to add you to the tenant as an external user - as stated in the error message.

 

Thank you! This is what I said in response to the user's request for help. The LA just keep telling us it should work and it's not their fault.