User cannot login with Microsoft Account (unlicensed)?

[Jani]

Hi,

Many of our users have reported that they can no longer log in with their Microsoft account.

Accounts that have not been licensed with any license from the Microsoft platform will no longer be able to log in.

Logging in goes well until the Appsheet app should open (ID + password + MFA = OK). With the same account (without MS license), you can log in to e.g. office.com without any problems.

Appsheet page only shows message: "You cannot login from a Microsoft account with an unverified email address."

Has any requirement changed on the Appsheet platform, that the MS account must have a working e-mail box?

BR,

Jani

[Jani]

Hi,

Update on this case. I just added an MS Exchange Online license to one user (who previously did not have a license), and immediately after that the user's account was able to log in to the Appsheet app.

[Jani]

Hi,

Can anyone tell me if there is a feature added to the login requirements that the account must have a working email inbox?

In the past, our Users have been able to log in only with a Microsoft account that did not have a working email box.

[ma2tak]

I am having the same problem. I can no longer access past apps, even though I have an O365 account with no Outlook subscription!

[AleksiAlkio]

Is it showing that message after the Microsoft "button" is pressed?

[Jani]

Hi Aleksi,

Here is a detailed overview of the login process.

1. Link added to browsers address bar (only Microsoft authentication provider is possible to sing in this app)

2. User account:

3. Password:

4. And after that it waits few seconds, and cannot login, if Microsoft account has no Exchange Plan activated:

Previously, a Microsoft account has not had to have any license activated, and the login has still been successful. Also with MFA settings enabled.

[SkrOYC]

Hi everyone.

I had this issue some time ago and also discovered that adding a licence (temporarily) to the account could solve it. In any case this is a situation that I reported to support at the time and they told me that they introduced a more "secure" process (that's why it's asking for the account to be "verified"). As many other times I discovered the solution by myself and reported to the support team hoping they could solve it.

So, in the end, I just wanted to tell everyone that the team is aware of it but Idk if they will be able to change it or if they actually want to. The good news is that now I will link them to this thread so that they could also follow everyone else's opinion

[Jani]

Hi @SkrOYC 

Thanks for the tip that I should try with a temporary license 👍

I have to try and see how it goes.

Do you have experience that you need to activate licenses from time to time to users account and deactivate again after a while? Or is it enough once and then works "forever."?

[AleksiAlkio]

Let me check how the MS login process has changed.

[SkrOYC]

Well, from the MS side, it hasn't. It's AppSheet that changed it.

[SkrOYC]

Latest responde by the support team.

@devingu I'm making the response public here and also the next interations because I think many reply to our needs without taking at least some time to analyze our particular case. This response was received after I used the Trusted Escalation thing but the issue here is that someone already suggested it in a previous email and I already mentioned them that 1) didn't work and 2) adding a license seems to fix the issue but it's not something we can do to fix it.

[devingu]

Thanks SkrOYC, unfortunately, this is a change that we made intentionally to make your account more secure. The only way we recommend is for you to go through the verification process by Microsoft. 

[Joseph_Seddik]

Does this mean that users with a free @hotmail.com accounts for example wouldn't be able to use AppSheet?

[SkrOYC]

In my experience it's just a problem on business accounts... seems like now we need to pay an extra Microsoft license just to log in into AppSheet

[Joseph_Seddik]

---

@SkrOYC wrote:

In my experience it's just a problem on business accounts... seems like now we need to pay an extra Microsoft license just to log in into AppSheet

---

Thank you!

That's quite strange 🤷🏻‍

[AleksiAlkio]

I checked this and yes, this is an update because of a security reason. User's MS account needs to be verified. Temporary verification and then removing it, should not help.

[SkrOYC]

---

@devingu wrote:

The only way we recommend is for you to go through the verification process by Microsoft

---

Sorry for my language but, what the hell does this mean? There is no verification whatsoever that we are laking of, it's just a license thing and we cannot do that. How is it that you consider "verified" an account just if it has a license? Makes no sense. My domain has been verified since years and the account even has 2FA... what on earth do you mean by verification process?

Sorry for my anger @devingu but this is clearly not the answer I was hoping from someone on the team after a change breaks the current workflow and cannot provide any fix because you swear that the issue is on our side instead of yours. It's just plainly shameful

[Jani]

I agree with @SkrOYC that there is no verification process for email, it only needs MS license for the users account, nothing else.

I have a few user accounts for which I absolutely do not want a working email box, only an account that can log into the Appsheet platform, now apparently this is no longer possible?

I also wonder what security element this requirement of a working email box adds, when you can still use a username + password + MFA. Especially when you don't even have to do any verification with email address?

[bcairns]

AppSheet requires email address verification for accounts in order to prevent individuals outside your organization from creating an AppSheet account that contains your domain name.

AppSheet requires email address verification for all sign-in providers. Some sign-in providers, such as Google, require every account to have a verified email address. 

Other sign-in providers, including Microsoft, do not require email address verification for all account types. Microsoft provides information to AppSheet when you use your Microsoft, Office 365, or Azure AD account to sign in to AppSheet. Part of the information that Microsoft provides to AppSheet includes whether or not Microsoft considers the email address on the account to be domain verified.

AppSheet relies on Microsoft's determination as to whether a particular Microsoft, Office 365, or Azure AD account is domain verification. Although we do not have detailed technical information on exactly how Microsoft determines whether an account is email verified, our observations indicate that Office 365 accounts must have an active license to be considered email verified.

Unfortunately, we are unable to provide a full workaround for this issue.

Partial workarounds include:

• Attach licenses and email inboxes to the Office 365 accounts that need to be used with AppSheet
• Use alternative accounts which Microsoft considers to be email verified, such as a consumer Microsoft Account
• Use an alternative sign-in provider

[SkrOYC]

So basically we have no choice.
I'm thankful to you anyway for providing us a proper professional response about this issue so that we now know for sure we have to look for an alternative instead of keeping smashing our heads to the wall with this

[bcairns]

That's correct. Unfortunately we don't have a way around this right now.

If you purchase Office 365 through a Microsoft reseller, I would recommend reaching out to your reseller to see if there are any options. It's possible that this behavior is unintentional. Microsoft's documentation is not very precise regarding what makes an account "email verified" according to their APIs. Any information regarding this would be extremely helpful.

I know that this has been disruptive and confusing. Thank you all for your patience.