title: Allow all external users to access via Azure AD authentication
body: <p>I have configured Azure AD authentication to my JavaScript front-end using ADAL JS library. I can successfully log in using accounts that belong to the Active Directory.</p>
  
  <p>We want to allow all external users to log in the application. As long as you have a Microsoft or Live account, you should be granted access. I'm receiving this error:</p>
  
  <blockquote>
    <p>AADSTS50020: User account 'xxxx@gmail.com' from identity provider 'live.com' does not exist in tenant 'Default Directory' and cannot access the application 'xxxx' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.</p>
  </blockquote>
  
  <p>Adding the user as a guest would fix this issue but I don't want that. It has to work automatically. I have configured the application to be multi-tenanted. I think that enabling self-service would be the solution. However, the settings are greyed out for unknown reason and I don't know how to change them.</p>
  
  <p>I have enabled users to request access and also grant access automatically on the application.
  <a href="https://i.stack.imgur.com/jkr0z.png" rel="nofollow noreferrer">Screenshot: Enterprise application - Self-service settings</a></p>
  
  <p>However, in the directory, self-service is not enabled (option <code>Self-service group management enabled</code> is set to <code>No</code>) and there is nothing I can do about it. How can I change these settings?
  <a href="https://i.stack.imgur.com/r5sVh.png" rel="nofollow noreferrer">Screenshot: Groups - General settings</a></p>
  
  <hr>
  
  <p>I tried registering another application to <a href="https://apps.dev.microsoft.com" rel="nofollow noreferrer">https://apps.dev.microsoft.com</a> as said on this thread <a href="https://stackoverflow.com/questions/46056091/azure-ad-authentication-without-app-registration">Azure AD authentication without app registration</a> but I still get the same error message for the new clientId.</p>
  
  <p>In this thread <a href="https://stackoverflow.com/questions/34996003/azure-multi-tenant-application-with-windows-live-id-authentication">Azure Multi-Tenant Application with Windows Live ID Authentication</a> the solution seems to change the authentication endpoint based on the tenant. This requires to first ask the user what tenant it is using and then redirect to authentication, which seems like a very bad UX.</p>