How can we make Microsoft Teams better?

← Public

Solution for guests accounts with an organisation account without Office365 tenant to be able to login at teams.microsoft.com

I have created several guest accounts following the instructions here:

https://docs.microsoft.com/en-us/microsoftteams/guest-access

Basically,

1. Enabled Guest Access in Office365 Admin Center

2. Added guest account through Azure Active Directory

a. Guest account received email Azure AD "You're invited to the organization"

b. Guest follows the "Get Started" link in the email to create a password

4. Added guest to a Team through Microsoft Teams desktop application

a. Guest account received email Teams "You have been added to a team in Microsoft Teams"

b. Guest follows the "Open Microsoft Teams" link in the email to be sent to teams.microsoft.com

c. Guest is redirected to login.microsoftonline.com
d. Guest logins in using email/password from #2b

e. Guest is redirected to the Teams page and is able to work.

--

When the Guest tries to login directly to Teams - either through teams.microsoft.com or the Teams desktop application - they are redirected first to a login page (login.microsoftonline.com), then after login to an error page:

https://teams.microsoft.com/_#/licenseError?errorCode=UserLicenseNotPresentForbidden

The Guest can still login/access Teams following the "Open Microsoft Teams" link in the #4b email.

Workaround

If the Guest adds the "tenantId" indicated in the #4b/Open Msft Teams email to the Teams URL, for example: https://teams.microsoft.com?tenantId=1234567-89ab-cdef-0123-456789abcdef

1. Guest is redirected to login.microsoftonline.com

2. Guest logs in using username/password

3. Guest is redirected back to https://teams.microsoft.com/_?tenantId=1234567-89ab-cdef-0123-456789abcdef

4. Guest can now access the Team (without the UserLicenseNotPresentForbidden error)

This workaround only works through the Browser - it does not work through the Teams Desktop App, as it is not possible to include the requisite "tenantId" to login. Using the Desktop App always fails with UserLicenseNotPresentForbidden.

When the Guest is logged in using the correct "tenantId", the Teams menu (in the Browser) looks like this:

microsoft-teams-menu.png

If the Guest clicks on the other account under "Your accounts" (abcdef-0123-4567-89ab-cdef012345), the Guest is redirected to the UserLicenseNotPresentForbidden error page.

microsoft-teams-userlicensenotpresent.png

It seems that a Guest has been assigned two different "tenantId"s (or Azure Object IDs), the first is the one created in step #2, the second is the one created in step #4. When the Guest tries to login without specifying the tenantId, login.microsoftonline.com defaults to the tenantId in #2 (which isn't authorized to access Teams).

I see no place in Teams, Office365 Admin Center, or Azure AD to manage these separate 'tenantId's or allow the Guest to login to Teams using the Desktop App.

55 votes
Sign in
Check!
(thinking…)
Reset
or sign in with
  • facebook
  • google
    Password icon
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    Jorik Polhuis shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

    18 comments

    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      Forgot password?
      Create a password
      Signed in as (Sign out)
      Close
      Close
      Submitting...
      • Anonymous commented  ·   ·  Flag as inappropriate

        In layman's terms - in my experience anyone with an existing Microsoft account somewhere that gets invited as a guest to MS Teams has an awful time getting in. It's happened so much that I add them as provisioned users, eat the $5 and then kill them when the project is over. MS please fix this so it's as smooth as Slack.

      • Peter Rozek commented  ·   ·  Flag as inappropriate

        Getting this same issue while trying to join another company's team. I'll direct them here.

      • Anonymous commented  ·   ·  Flag as inappropriate

        Same issue as others. Meeting guests who have O365 accounts, but don't have Teams enabled in their tenant are getting the lovely "You're missing out!" message when they click the meeting link. Pasting the meeting link into a incognito/private browser and joining via web app seems to work, but this is pretty trash.

        Every single day I stumble on a new issue with Teams.

      • Heikki commented  ·   ·  Flag as inappropriate

        Having this issue with ios teams and guest login. Pc Desktop and chrome web logins are working in (latter works in ipad too)
        The guest has 0365 account, but not teams. Still she is recognized via her o365 account rather than as guest when trying to sign up in ios Teams app as guest. And the error is ”you’re missing ou ask your admin...”

      • Ian Caldwell commented  ·   ·  Flag as inappropriate

        Argh! I just hit this guest access issue today for the first time. There is no way to know which external people have Office 365 business subscriptions - possibly only Outlook - but then they get hit by a brick wall "you're missing out ask your admin to enable microsoft teams". So far, the workaround is not working for us, trying to force the tenant ID for Teams.

        We have configured our Office 365 tenant to be as open and sharing as possible, guests are enabled for everywhere with the highest level of access possible.

      • JB commented  ·   ·  Flag as inappropriate

        Same "UserLicenseNotPresentForbidden" problem here when a guest tries to login directly over https://teams.microsoft.com or the desktop app!

        FYI Guest Access is enabled in the Office Admin portal. (Services and Add-ins > Microsoft Teams)

      • Dan Smith commented  ·   ·  Flag as inappropriate

        I can confirm that we're hitting this issue as well.

        - Created an Azure AD user account (no license in Office 365)
        - Added to Team (success)
        - Attempted to logon to teams.microsoft.com
        - The team UI is shown for a split-second and then replaced with a splash page asking the user to tell the "administrator" to enable Teams for the tenant.

      • Chris Webb commented  ·   ·  Flag as inappropriate

        Still having this same issues and it's a huge issue. There are some e-mail login's people use that some how fall under a work account and these people have no clue that it's hosted on o365 or azuread. Because of this they have no control and those tenants don't have or allow Teams so because of this they cannot access any other Tenant's Team as a guest, so constantly having to create new MSA accounts to invite people to Teams which is less than ideal, especially when they want e-mail notifications sent to their primary e-mail address. Trying to test changing the "alternate e-mail" address on their guest account in my tenant, but I don't think this works and is a bandaid approach.

        What really needs to happen is when joining as a guest, it doesn't check if Teams is licensed and or turned on with their homed accounts. This would fix this problem.

        Also a secondary issue with this, they have a work account and a MSA account with same address. This wouldn't be an issue other than the fact that the Teams Client defaults to their work account once switched to the guest tenant and accepting the B2B/guest account, so you cannot join the Team in this instance with the personal account and then your back at step one with having to either create a new account or change the login alias for the original account. Both not great user experiences and causing a tons of wasted support time in my org.

      • Seb Herrmann commented  ·   ·  Flag as inappropriate

        Guest access user experience for MS teams is very poor. We have this issue as well, and it's preventing further adoption of our Teams / and external collaboration with partners as it's so clunky and difficult for a users to gain seamless access to Teams.
        The work around to use the link in original email does work, but it's not practical for guest access. Please address / update us on this issue progress.

      • Chris Webb commented  ·   ·  Flag as inappropriate

        Hi Warren, getting same issue. The problem is users don't know they have office 365, or users that have both MSA and O365 account with same e-mail are running into this issue. It seems even if you pick personal account login the desktop client still tries to login to the work account and you get the "Please enable teams" error , or no license etc. because it's trying to use the work account and not the MSA account. I know having them change their MSA account primary alias fixes this but it's rough to have them do that and reinvite their new alias etc.

      • Sean McGrath commented  ·   ·  Flag as inappropriate

        Hey, we're experiencing this issue with our tenant also. As described, guests without their own O365 tenant can't log in via the app, or directly via https://teams.microsoft.com.

        Our workaround is for the guests to always use the link in the initial Teams invitation email, but this is not a good experience for them.

      • Christian Kaeomat commented  ·   ·  Flag as inappropriate

        Hey Guys,

        We are hitting the same issue. About a Week ago it worked fine but now we have the same problem Jorik describes, when we are adding a new Guest-User. The Warkaround he postet works well, but as the Guest-User cannot access or login via the App, this is pretty much useless.

      • Vincent Van Dyck commented  ·   ·  Flag as inappropriate

        I'm experiencing this issue.

        Context:
        1. We've added guests to our team
        2. They receive an email
        3. They register with a password
        4. They enter the verification code they received
        => They can't go to the next step(s) from here on out, the "next" button doesn't do anything

        They are unable to access the Team through the link in the email or a link directly to the team (copied from within Teams). They always arrive on the URL with UserLicenseNotPresentForbidden

        They are however listed as guest team members when we look at the team members from within the application.

      • Pranav Kothare commented  ·   ·  Flag as inappropriate

        We have faced this issue in our environment. The workaround was viable, but it leads to undesirable end user experience

      Public: Guest Access

      Feedback and Knowledge Base

      (thinking…)

      More Teams Info