Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.iru.com/llms.txt

Use this file to discover all available pages before exploring further.

This guide applies to Mac computers
Note: Microsoft Entra ID is the new name for Azure AD (Azure Active Directory)

​
About this article

Use this article when Passport sign-in fails with Microsoft Entra ID (formerly Azure AD). It covers login checks, diagnostics, network requirements, and common Entra ID error codes. For setup, use Configure Passport with Microsoft Entra ID - Mac Login or Configure Passport with Microsoft Entra ID - Web Login, then Configure the Passport Library Item.

​
Login, diagnostics, and network

Sign in with the full email address

At the Passport login window, always enter the user’s full email address in the username field so the session uses your IdP instead of local authentication. For how the login window and visibility settings interact with Passport, see Passport Compatibility.

Use Passport Diagnostics

If a user cannot sign in, open Iru Endpoint Passport Diagnostics with Command-Shift-K-L on the Mac. The panel shows useful detail, including error messages returned from your IdP.

Confirm network connectivity

Passport must reach Microsoft Entra ID to validate credentials. When you customize the Passport login window, enable the network manager so users can join Wi-Fi if needed. The control respects AirPort security settings in macOS.

Wi-Fi limits and isolation testing

Passport shows a Wi-Fi icon at the upper-right of the login window; users can click it to join a password-protected network. Passport does not support captive portals, click-through acceptance pages, or enterprise 802.1X networks that require a separate username and password in that flow. To isolate network issues, try a mobile hotspot or wired Ethernet while testing at the Passport login window.

​
Common Microsoft Entra ID errors

To look up Microsoft Entra ID sign-in error codes (often prefixed with AADSTS), use login.microsoftonline.com/error.
What you see:Microsoft Entra ID message: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access the resource named in the error.What to do:
  • The user needs to complete multi-factor authentication. Multiple policies or settings can require MFA (for example Conditional Access, per-user enforcement, or client-requested MFA).
What you see:Microsoft Entra ID message: User account <user principal name> from identity provider <your Microsoft Entra ID Active Directory Tenant ID> does not exist in tenant <your tenant name> and cannot access the application <your Passport Application (client) ID> in that tenant. The account needs to be added as an external user in the tenant first.What to do:
  • In the Microsoft Entra admin center, open Users > All users and confirm that the user exists.
What you see:Microsoft Entra ID message: The user account <user principal name without the @ symbol and domain> does not exist in <your tenant name> directory.What to do:
  • For Passport with MFA, each user in Microsoft Entra ID needs an Email value. Without it, the user may complete MFA in the web view but fail at the Enter your Microsoft Entra ID password verification step. In the Microsoft Entra admin center, open Users > All users, select the user, click Edit properties, enter an address in Email, and click Save. The value does not need to be a working mailbox; often it matches User principal name.
What you see:Microsoft Entra ID message: InvalidUserNameOrPassword: error validating credentials due to invalid username or password. The user did not enter the right credentials. Some of these errors in logs are expected when users mistype credentials.What to do:
What you see:Microsoft Entra ID message: Client is public so neither ‘client_assertion’ nor ‘client_secret’ should be presented.What to do:
What you see:Microsoft Entra ID message: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value.What to do:
What you see:Microsoft Entra ID message: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access the identifier shown in the error.What to do:
  • If you use Mac Login, the user may have legacy per-user MFA enabled. A managed user may need to register security info, or a federated user may need the MFA claim from the federated IdP.
  • Conditional Access, per-user enforcement, and other policies can also require MFA enrollment.
What you see:
  • Ticket decode failed
  • Failed to login with possible error: Unknown
What to do:
  • Remove the optional client secret from the Passport Library Item, let the device check in, sign out of the local user, and sign in again with Passport.
  • If it persists, rule out network issues (for example try a mobile hotspot).
What you see:An error occurred fetching user info: No key was found matching “givenName”.What to do:
  • In the Microsoft Entra admin center, open Identity > Users > All users, open the user who is signing in, and confirm that First name is populated.
For Mac Login or Web Login setup, see Configure Passport with Microsoft Entra ID - Mac Login or Configure Passport with Microsoft Entra ID - Web Login.