How to fix error AADSTS500210 when using a custom domain?

Manuel T 151 Reputation points
2024-08-14T15:44:56.5533333+00:00

We have two Entra External ID tenants (companydev and companyprod).

For both of them we set up a custom domain (id-dev.company.com and id.company.com).

In both tenants, I created a user flow and added an app registration to it.

When I grab the OpenID Connect metadata document from the app registration, it initially looks like this: https://<tenantname>.ciamlogin.com/<tenant-id>/v2.0/.well-known/openid-configuration

It works fine for both tenants.

Switching to the custom domain, the URLs become https://id-dev.company.com/<tenant-id>/v2.0/.well-known/openid-configuration for DEV and https://id.company.com/<tenant-id>/v2.0/.well-known/openid-configuration for PROD.

PROD returns the OpenID Connect metadata document just fine.

DEV returns this error:

{
  "error": "server_error",
  "error_description": "AADSTS500210: Domain name does not match with the tenant identifier Trace ID: *** Correlation ID: *** Timestamp: 2024-08-13 07:04:44Z",
  "error_codes": [500210],
  "timestamp": "2024-08-13 07:04:44Z",
  "trace_id": "***",
  "correlation_id": "***"
}

I cannot find any information regarding this error anywhere. It seems like nobody else has ever faced this issue. I also can't find any information about it in Microsoft's documentations.

I'm able to run the user flow with the custom domain. So, it seems like the error only happens for the metadata document.

Please advise.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,851 questions
{count} vote

1 answer

Sort by: Most helpful
  1. Manuel T 151 Reputation points
    2024-08-20T04:29:05.9133333+00:00

    Hi.

    Thanks for the link. It successfully returned the tenant id. So, the domain verification doesn't seem to be the issue.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.