Problem

When using managed identity in multi-tenant applications withAzureAd.TenantId set to"common", theGetAuthenticationResultForAppAsync method throws anIDW10405 error:

IDW10405: 'tenant' parameter should be a tenant ID or domain name, not 'common', 'organizations' or 'consumers'.

This occurs becauseResolveTenant is called before checking if managed identity is being used. For managed identity flows, tenant resolution is not needed and should be skipped entirely.

Configuration Example

{"AzureAd": {"TenantId":"common","ClientId":"<app-guid>"  },"DownstreamApis": {"MyApi": {"BaseUrl":"https://example.com","Scopes": ["scope"],"AcquireTokenOptions": {"ManagedIdentity": {"UserAssignedClientId":"<managed-identity-client-guid>"        }      }    }  }}

Solution

Moved theResolveTenant call to execute only for non-managed identity scenarios:

• Before:ResolveTenant was called unconditionally, causing the error
• After:ResolveTenant is skipped when using managed identity, preventing the error

Changes

1. TokenAcquisition.cs: MovedResolveTenant call after managed identity check
2. TokenAcquisitionTests.cs: Added test case to verify the fix

The fix is minimal and surgical - only 3 lines changed in the core logic while preserving all existing functionality.

Testing

• Added comprehensive test case covering the scenario
• Verified existing tenant resolution logic still works correctly
• Confirmed no regression in non-managed identity flows

Fixes#3395.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn moreCopilot coding agent tips in the docs.