Invite External Partner to Azure AD Tenant: Troubleshooting "Generic Authorization Exception"

Solving "Unable to Invite User user1@outlook.com" Error for Admin1

Question

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.

The User administrator role is assigned to a user named Admin1.

An external partner has a Microsoft account that uses the user1@outlook.com sign in.

Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: Unable to invite user user1@outlook.com " Generic authorization exception.

You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.

What should you do?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

A

https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Generic-authorization-exception-inviting-Azure-AD-gests/td-p/274742

The error message "Generic authorization exception" indicates that the user attempting to invite an external partner does not have sufficient permissions to do so. In this scenario, the User administrator role is assigned to Admin1, but the external partner has a Microsoft account that uses the user1@outlook.com sign-in. To allow Admin1 to invite the external partner, we need to enable external collaboration in Azure AD.

The correct answer is A. From the Users blade, modify the External collaboration settings.

Explanation:

A. From the Users blade, modify the External collaboration settings. To enable external collaboration in Azure AD, follow these steps:

  1. Sign in to the Azure portal with an account that is a member of the User Administrator role or Global Administrator role.
  2. Open the Azure Active Directory blade.
  3. Click on the Users blade.
  4. Click on the User settings button at the top of the Users blade.
  5. Under External collaboration, select "Guest users can be invited to this organization" and click on the Save button.
  6. Wait a few minutes for the changes to take effect.

By enabling external collaboration, Admin1 can invite the external partner with the Microsoft account that uses the user1@outlook.com sign-in.

B. From the Custom domain names blade, add a custom domain. This answer is incorrect because adding a custom domain is not related to the error message or the task of inviting an external partner.

C. From the Organizational relationships blade, add an identity provider. This answer is also incorrect because adding an identity provider is not related to the error message or the task of inviting an external partner.

D. From the Roles and administrators blade, assign the Security administrator role to Admin1. This answer is incorrect because assigning the Security Administrator role to Admin1 does not grant the necessary permissions to invite an external partner. The User Administrator role is sufficient for this task.