title: Microsoft oidc in AWS Cognito allowing multiple tenants
body: <p>I'm trying to implement social login using Microsoft account in AWS Cognito User Pools.</p>
  <p>I followed documentation and the solution mentioned in this thread:
  <a href="https://forums.aws.amazon.com/thread.jspa?threadID=287376&amp;tstart=0" rel="noreferrer">https://forums.aws.amazon.com/thread.jspa?threadID=287376&amp;tstart=0</a><br />
  My problem is with setting the issuer to allow multiple tenants.</p>
  <p>This issuer works only for private accounts:<br />
  <a href="https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0" rel="noreferrer">https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0</a></p>
  <p>This issuer works only for accounts in our directory (tenant):
  <a href="https://login.microsoftonline.com/AZURE_ACTIVE_DIRECTORY/v2.0" rel="noreferrer">https://login.microsoftonline.com/AZURE_ACTIVE_DIRECTORY/v2.0</a></p>
  <p>This issuer does not work at all. I get bad issuer error or bad request after sign in with Microsoft:
  <a href="https://login.microsoftonline.com/common/v2.0" rel="noreferrer">https://login.microsoftonline.com/common/v2.0</a></p>
  <p>I need to have one oidc provider that will work for any Microsoft account (all tenants) is that even possible?</p>
  <p>If I set issuer tenant to common in the AWS Cognito oidc config, then this starts the correct Microsoft flow, but I assume the check for issuer in Cognito fails because Microsoft always returns the specific tenant id inside the jwt token as part of the issuer.</p>
  <p>Additional info from microsoft documentation I have checked:<br />
  <a href="https://docs.microsoft.com/de-de/azure/active-directory/develop/v2-protocols-oidc" rel="noreferrer">https://docs.microsoft.com/de-de/azure/active-directory/develop/v2-protocols-oidc</a>
  <a href="https://docs.microsoft.com/de-de/azure/active-directory/develop/id-tokens" rel="noreferrer">https://docs.microsoft.com/de-de/azure/active-directory/develop/id-tokens</a></p>