An application might need decided on the wrong tenant to signal into, as well as the at present logged in person was prevented from doing so given that they did not exist in your tenant. If this user must manage to log in, include them as a visitor. See docs https://ricardoszoew.timeblog.net/68018738/the-best-side-of-tentenbet-address