How to determine if an email address is a Microsoft 'Work or School' account or a Microsoft Account

Question

I would like to authenticate against both Microsoft accounts and 'Work or School' accounts in a Azure multi-tenant environment. Each authentication type requires different requests. If I try to login as a Microsoft account against the 'work or school' request the login will fail at the Microsoft login and not return to my application.

Is there a way to query if a given email address is a 'Work or School' account against the Microsoft graph API?

Edmundoedmunds

Answer 1

If you use the REST api, it should automatically handle the two types of accounts.

However, it is in preview and might have restrictions or issues.

Here is a guide for using the REST api: http://graph.microsoft.io/en-us/docs/platform/rest

But be sure to check if that is acceptable to work with given the restrictions: https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-limitations/

Bunsen

I am using the rest API but get this error with Microsoft accounts. Work or School accounts work fine against this endpoint. AADSTS50020: User account '@.***' from identity provider 'live.com' does not exist in tenant '***' and cannot access the application '-guid-' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account. – Edmundoedmunds

As per the instructions above, have you registered your app to implement converged auth in the Application Registration Portal? – Bunsen

Thank you. This was very helpful. I didn't realize there was a new version of the API that supported combined login. I was able to test and confirm it works. – Edmundoedmunds

Answer 2

Microsoft released a converged Azure AD v2 of the authentication model. This blog post explains how to register your app to be able to use it. It will allow you to authenticate against both Work or School Account and Microsoft account.

Also, there is a YouTube tutorial here.

Doldrums

If I don't want to authenticate, but just want to know what type of account it is, should I also use this ? – Forecast