Published: July 25, 2025, for all the devs at copy-paste consultancies who find themselves working ER "site down" situations on July 26, 2025
Tags: Azure AD, Microsoft Entra, SignInAudience, AADSTS50020, External Tenant Access, OAuth2, Azure App Registration, Multitenant, JWT, Token Validation
If your Azure-based app stopped accepting logins from external users or service principals after July 25, 2025, it’s because of a Microsoft Entra policy change affecting multitenant apps.
Apps previously marked (or defaulted) as multitenant now require explicit reconfiguration to allow access from external tenants.
access_denied, invalid_client, or invalid_grantMicrosoft changed the rules around app registration sign-in audiences (signInAudience). Specifically:
AzureADMyOrg (single-tenant) will no longer issue tokens to identities from external tenantsAzureADMultipleOrgs, apps will be strictly tenant-boundRun this PowerShell command:
Get-AzADApplication -DisplayName "YourAppName" | Select DisplayName, SignInAudienceIf the result shows SignInAudience = AzureADMyOrg and you rely on external users or service principals, then you are affected.
Even though Powershell ISE currently appears in Visual Studio Installer for Azure Powershell, ISE is deprecated and does not work with 2FA. You need to use normal (not ISE) Powershell. Try "Connect-AzAccount". If that doesn't work in regular Powershell, you need to add the "Az" module.
Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force -AllowClobber
Beware that most Powershell Azure FAQs will tell you to authenticate as if you have only one Azure tenant. For those with more than one tenant in the subscription to which you attach (your) Powershell (machine code) during Azure authentication, you'll need to specify which tenant Id you want. Otherwise correct authentication via the web will still fail in your Powershell window.
signInAudience?| Value | Meaning |
|---|---|
AzureADMyOrg |
Only users from your tenant |
AzureADMultipleOrgs |
Users from any Azure AD tenant |
AzureADandPersonalMicrosoftAccount |
Users from Azure AD and Microsoft personal accounts (e.g., Hotmail, Outlook) |
“External service principals are actively obtaining tokens for your app”
✔ Accounts in any organizational directory (Any Azure AD directory - Multitenant)signInAudience = AzureADMyOrgAddAuthentication().AddJwtBearer() to validate tokenstid claim
options.Events = new JwtBearerEvents
{
OnTokenValidated = context =>
{
var tid = context.Principal.FindFirst("tid")?.Value;
if (tid != "your-tenant-guid")
throw new SecurityTokenValidationException("External tenants not allowed.");
return Task.CompletedTask;
}
};
User.Claims in middleware or controllers to log tid, appid, audsignInAudience on all appsYou might assume that if your app only calls Microsoft Graph API using a 3rd party user principal (which is the "secret" azure account associated with your client's Office 365 Business account) and doesn’t expose any endpoints or accept tokens for itself (for use as a service prinicipal), it’s fine to use a single-tenant app registration. That was true — until Microsoft enforced cross-tenant token boundaries in July 2025, claiming to enforce boundaries for service principals, yet also enforcing boundaries for user principals.
Starting July 26, 2025, Microsoft Entra began enforcing tenant policies at the token issuance level. That means your single-tenant app cannot request tokens on behalf of users from other tenants, even if the token is only for use as a user principal with Microsoft Graph or some other 3rd party app. Note: Microsoft Office 365 Business accounts do in fact have an associated Azure account, and thus qualify as a prinicpal from another tenant. Office 365 Business users typically do not have any idea they also have an Azure acccount. They usually aren't sure what Azure even is. They will steadfastly insist they do not have an Azure account. While it's true they never wnet and created an Azure account, if they have an Office 365 Business account, they do in fact have an Azure account and will break when using your single tenant app under the new ("after July 25th, 2025") Entra boundary paradigm. No, you can't delete their unknown and "never used it" Azure account, as it's used by Microsoft behind-the-scenes. No, adding the office 365 Business (and Azure) account as an app "ower" in your azure config does not help. Having your client's O365Business/Azure account being a "guest" or "member" of your single-tenant account also does not help.
The reasoning? Your app is initiating a cross-tenant trust relationship by requesting a delegated token — and external tenants never explicitly consented to that. Microsoft Azure/Entra now blocks this unless your app is marked as multitenant.
The fix is simple: I flipped the app registration’s SignInAudience setting from AzureADMyOrg to AzureADMultipleOrgs. This allowed tokens to be issued for external users again — without changing my code — and I optionally enforce a tenant allowlist to limit access.
If you're seeing errors like:
AADSTS50020Then your app is almost certainly affected by Microsoft Entra’s sign-in audience enforcement.
Microsoft frequently updates its Entra ID documentation, and many relevant pages change URLs or disappear. For the most up-to-date information, we recommend: