Problems Logging In To Some Apps After Manual Office 365 Tenancy Move

Scenario

• domain.com registered with an Office 365 tenant via a reseller.

• domain.com removed from original tenant, tenancy closed.

• domain.com added to a fresh tenant.

• Email mailboxes recreated in new tenant.

• Various login issues, including 404 NOT FOUND when trying to use OneDrive/OneNote via the web application.

• Other login modalities work.

• Set user primary login to [email protected] format, with the reply address on the mailbox set to [email protected]. This improves some login experiences but not all.

• Add domain2.com to the new tenant, and add aliases to the user mailboxes. This domain has never been used in Office 365.

• Set primary login to [email protected]. This also improves the login experience but not wholly.

• Sometimes throws error AADSTS50020: User account '<user>' from identity provider 'https://sts.windows.net/<tenancyid>' does not exist in tenant '<domain.com>' and cannot access the application in that tenant.

Solution

The issue appears to be that some apps are “infected” with the legacy login and there is some leftover authentication data which links to the previous tenant.

Logging in with the [email protected] format somewhat resolves this, but the login process also resolves the additional aliases, [email protected] and [email protected], and so this does not clear out the invalid information.

Solution is to remove the alias [email protected] from the user, set domain2.com as the default domain in the tenancy and use domain2.com as the primary login for users even if domain.com is the default reply address on mailboxes.

It should now be possible to log in as [email protected]. (May be necessary to sign out of various other instances first.)

Observation: when the primary login of a user account is changed, this does not flow into OneDrive/SharePoint/OneNote immediately, and original OneDrive links will not work.