Issue: Cross-Tenant OBO with CIAM - Resource Resolved in Wrong Tenant

Hello Parth Jagani

Thank you for reaching out to Microsoft Q&A.

I understand that you would like to fix this > Message: AADSTS500207: The account type can't be used for the resource you're trying to access.

1. If you are requesting tokens for a protected API, the first thing to check is your authority configuration. Make sure you are using the CIAM tenant-specific authority with v2.0, such as: https://{tenantSubdomain}.ciamlogin.com/{tenantId}/v2.0 If you miss the/v2.0 suffix or use the workforce endpoint (login.microsoftonline.com), your request will fail with 500207. See Microsoft docs in this link - https://learn.microsoft.com/en-us/entra/external-id/customers/overview-customers-ciam
2. Another important step is to review the API app registration settings. For custom scopes to work in Entra External ID, the resource API app must be single-tenant. In the Azure portal, go to your API’s app registration, and under Supported account types, select Accounts in this organizational directory only (AzureAD MyOrg). Then under Expose an API, define your scope (e.g.,api://{api-client-id}/access_as_user`) and grant the client app permission to use it. - https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis
3. On the client app registration (your Flutter app - flutter_appauth), add this custom scope under API permissions, then in your code ensure the token request includes: final result = await appAuth.authorizeAndExchangeCode( AuthorizationTokenRequest( '{clientId}', '{redirectUrl}', discoveryUrl: 'https://{tenantSubdomain}.ciamlogin.com/{tenantId}/v2.0/.well-known/openid-configuration?p={userFlowId}', scopes: ['openid', 'offline_access', 'api://{api-client-id}/access_as_user'], ), );
4. Use the Sign-in logs in the Entra portal to confirm your fix. Enter your Correlation ID (9c5d72ee-2dfa-4b85-8a8d-7b00b094baaa) and Timestamp (2025-08-21T13:43:59Z) to validate if the failure is resolved or if any scope/audience mismatch remains. See more guides here - https://learn.microsoft.com/en-us/entra/identity/conditional-access/troubleshoot-conditional-access

Though, the error occurs because the requested token’s account type doesn’t align with the API’s supported audience. By using the correct CIAM v2.0 authority, setting the API registration to single-tenant, and correctly requesting your custom scope, the AADSTS500207 issue will be resolved.

Please let us know if you need any further assistance.

Thanks

I have concerns about step 2 as below!

I would like to raise a concern regarding step 2 of the recommended configuration. Specifically, when the workforce app registration is set to single-tenant, the Workforce API does not appear in the CIAM tenant’s API Permissions list. In our testing, the Workforce API can only be added when the app registration is configured as multi-tenant.

This creates a challenge because the guidance suggests that for custom scopes to work in Entra External ID (CIAM), the resource API app must be registered as single-tenant (“Accounts in this organizational directory only”). However, in that configuration, we are unable to discover or add the Workforce API from the CIAM tenant, which prevents us from granting the necessary permissions. As per other documentation, workforce app and its service principal need to exist in CIAM tenant too.

Could you clarify the correct approach for this scenario?

Is there a specific configuration or workaround that allows a CIAM tenant to reference a single-tenant Workforce API?

Should the API remain multi-tenant for visibility, and if so, how does that align with the requirement for single-tenant registration in CIAM?

Are there additional steps (such as service principal instantiation, explicit scope definition, or tenant-specific authority usage with the ciamlogin.com/{tenantId}/v2.0 endpoint) that would resolve this mismatch?