We are testing azure active directory single sign on for arcgis enterprise(specially access to ArcGIS Portal) at 10.5.1 on windows 2012 machine.
When adding new portal members to portal, email is used in email and username, in two places. So in that sense, the email also serves as the user id that members will have to put in when logging into the portal.
We have two types of users, user type A who have organization email and user type B, who do not have organization email, but have their own external email ids. We are testing to see if we can add those external users with their external email id to Azure Active Directory and also to Portal and if they can sign in to the portal without having an organization email id.
Everything seems to work great for user A with organization email id. This user can access the portal from machines in the organization domain and also machine that are not in the domain. This user is also able to access the maps through ArcGIS Collector.
But we are seeing error with user type B with external email id.
for example: portaluser@xyz.com is added to the portal (where username is portaluser@xyz.com and email is also portaluser@xyz.com )
Same user B is also added to the Azure Active Directory. but when user B tries to sign in, they are receiving this error below:
"AADSTS50105:The signed user 'portaluser_xyz.com#EXT#@organization.onmicrosoft.com' is not assigned to a role for the application 'ArcGIS Enterprise'
