Azure B2B Guest Users Can Accept Invitation but Cannot Sign In Directly ("We couldn't find an account with that username")

Question

Azure B2B Guest Users Can Accept Invitation but Cannot Sign In Directly ("We couldn't find an account with that username")

SIX IMPOSSIBLE THINGS BEFORE BREAKFAST LIMITED 0

Hi,

I am experiencing an issue with Microsoft Entra B2B guest users.

Scenario:

Two external users were invited as Guest users.
Both users successfully accepted the invitation and initially accessed the tenant.
The guest accounts show:
- Invitation State = Accepted
- Account Status = Enabled
- Appropriate role assignments are present (Reader/Owner).
Sign-in logs show successful authentications.

Issue: After logging out, both users are no longer able to sign in directly via Azure Portal.

When attempting to sign in using their email addresses, they receive: " We couldn't find an account with that username"

Both users report that they were originally able to access the tenant via the invitation link, but direct sign-in subsequently stopped working.

Troubleshooting performed:

Reset redemption status.
Sent new invitations.
Deleted and recreated the guest accounts.
Re-assigned the required Azure roles.
Confirmed Invitation State = Accepted.
Confirmed successful authentication entries in the sign-in logs.
Tested using InPrivate/Incognito browser sessions.

The issue persist for both users. Any guidance would be greatly appreciated.

Thank you very much.

0 comments

1 answer

Your answer

Answer 1

Hi,

Since both guest users were previously able to access the tenant and you've already recreated their accounts and resent invitations, I'd focus on the authentication configuration and tenant-specific sign-in flow rather than repeating the invitation process.

I'd check these areas first:

Use a tenant-specific sign-in link. Instead of signing in through the generic Azure portal page, try opening the Azure portal with your organization's tenant ID in the URL. This helps ensure the users are directed to the correct resource tenant.

Check Email One-Time Passcode (OTP). If either guest uses email OTP rather than a work, school, or Microsoft account, open Microsoft Entra admin center and navigate to External Identities > All identity providers. Verify that Email One-Time Passcode is enabled if these users depend on it. Also review Authentication methods under Protection to ensure the required method is available to the affected users. A disabled or excluded authentication method can prevent guest sign-in.

Verify the exact sign-in identity. Ask each guest to use the exact email address that received the invitation, not an alias. If an address is associated with both a personal Microsoft account and a work account, make sure the correct identity is selected.

Inspect a failed sign-in event. In Entra ID > Monitoring & health > Sign-in logs, filter for one affected guest and examine the failure reason, error code, resource tenant, authentication details, correlation ID, and timestamp. A successful authentication entry alone doesn't necessarily confirm that access to the intended tenant succeeded.

Review recent configuration changes. Check whether any changes were made to authentication methods, cross-tenant access settings, Conditional Access policies, or identity-provider configuration around the time the problem began.

Because the same issue affects both users and you've already reset redemption status, I would prioritize checking the authentication method configuration, especially Email OTP if applicable, and examining an actual failed sign-in before making more account changes.

One key detail is whether these guests sign in using their own organization's Microsoft Entra accounts or receive a one-time passcode by email. That distinction determines which authentication settings to investigate first.

SIX IMPOSSIBLE THINGS BEFORE BREAKFAST LIMITED 0 Reputation points

2026-10-23T09:47:11.1433333+00:00

Hi,

Thank you for your suggestions.

I have completed the checks you recommended:

Tested a tenant-specific Azure Portal URL.

Confirmed Email One-Time Passcode (OTP) is enabled.

Verified the users are signing in with the exact email addresses used in the invitations.

Reviewed the sign-in logs, including failed sign-in events and authentication details.

Reviewed cross-tenant access settings, external collaboration settings and tenant restrictions.

Additional findings:

The guest accounts are present in Microsoft Entra ID and the invitation status is Accepted.

The users authenticate using Email OTP (they do not have Microsoft 365 or Microsoft accounts).

The guest users appear under Default Directory (Signed in) in My Account.

Azure role assignments are in place.

Sign-in logs show Azure Portal authentication attempts

Despite this, the users remain unable to access the Azure Portal after successful OTP authentication.

Given that the guest users are authenticated and appear as signed in to the tenant, is there any additional Microsoft Entra External ID or Email OTP configuration that should be checked?

Thank you very much.