Blackbaud ID Error: "account needs to be added as an external user in the tenant first"

Jeanne Townsend

We have successfully been using BBID for our faculty, staff and students for over a year now, and just launched BBID for our Parents and Parents of Candidates.

I watched Janet's excellent tutorial video that explains how parents can use their work email with BBID in a couple of different ways (thank you Janet!!!)

Yesterday, a parent contacted me with the following issue…has anyone see this error with BBID before?

The parent accepted the invitation to BBID and was directed to the screen explaining that her username was being converted to use Blackbaud ID with her email address. When she clicked “Continue”, she received an error from Microsoft stating “unfortunately we cannot login”.

Here are her screen shots (she's in Liechtenstein)…

Bryna Gleich

Have you sent this to Customer Support yet? That's the best way for us to track it and “triage” the problem.

Thanks for the screenshots!

Troy Burki

It seems like maybe the issue might have to do with this parent having both a personal Microsoft account and then trying to create an Office365/AD account with the same address.

We had an instance of something similar when a parent was already using BBID via their employer and then we tried to convert their account in our database to BBID. It ended up not being possible because of the conflict between the two SSO providers and the parent just used a different email address.

Jeanne Townsend

Yes Bryna Gleich! I already had a case open with support regarding BBID for parents, so I added this issue to it.

?

Jeanne Townsend

Thanks Troy Burki …that's along the lines of what I was guessing might be happening.

The parent responded today that the email she is trying to use is a personal email, not a work email, so I'm a bit more confused now about how someone might be using a personal email that is trying to authenticate to MS Azure???

Jeanne Townsend

We have another instance of a parent getting this same error message. This time the parent is in Canada.

This instance was also different from the first one in that on my end in Core, the system is showing me that the BBID account is Registered and the user logged in, even though the user emailed me that he could not log in.

Jeanne Townsend

I now have a third parent with this same “Selected user account does not exist in tenant 'Tabor Academy' ” error. This parent is in the U.S., and on my end she is showing as “Registered” on her profile.

I just can't figure out what the parents are doing! Each one I talk to has tried multiple things and they aren't sure what they clicked or what they tried.

I did not think rolling out BBID to our parents would be this difficult. Feeling very frustrated. ?

Brian Gray

@Jeanne Townsend - I have run into similar problems with some of our parents signing in with BB-ID. The most common error is that they click on the wrong button during the sign-in process.

The blue button is for employees and students (who use Google SSO for authentication). Parents must click Use a different Blackbaud ID. It's not at all obvious.

If my first canned set of instructions doesn't work for parents, I usually meet with them via Zoom so that I can watch what they're doing. I often see something on the screen that they would never mention to me in an email.

One effective troubleshooting step is to ask the parent to open a Chrome Guest window and sign in from it. That separates the sign-in process from browser profiles and from any third-party sites the parent may be signed into.

Jeanne Townsend

Thanks Brian Gray‍! I just came to that same conclusion this morning.?


I think what is happening is that when the parent is walking through the Sign Up process, they receive the confirmation email, they confirm their email address, and then the system will re-direct them to our school login page. If they are using a browser that their child has used to log in to our school website, there is a cached token with their child's credentials, which directs the login site to try to authenticate to Microsoft (our school ID provider). But, of course, the parent's email address is not in our school's Azure Directory! So the parent gets a Microsoft error message about the user not being in our tenant.


The most frustrating thing is that parents are reporting to me that when they get the error, they just start "clicking around like crazy", and that doesn't fix the problem, but does make them very frustrated. So far, I have found that asking them to try logging in from a private browsing session, or purposely starting on our website page and slowly going through the login process seems to allow them to log in successfully. I think the redirect from the email confirmation page is the step that's triggering this error, at least as far as I can tell.


In a few cases, I've had to disconnect the user and start all over again. My "trouble with BBID" rate is running at about 10% right now. I'm worried that it will spike when school starts and the parents who've ignored our instructions all want to log in right away! But I guess that means that our success rate is about 90% so far! ?