Hacker News new | ask | show | jobs
by vimslayer 2207 days ago
Microsoft has their notorious "is this account personal or issued by company it department" (or something like that) question when you login. Which is the reason it very often takes two tries and several minutes to get logged in as I never seem to guess the correct answer to that question...
4 comments

Extra credits for when Azure DevOps Server requires you the other kind of login compared to actual Azure, or for when you log in with one kind and the next time you access the service you are randomly switched over to the other.

Also the fact that when you ask your login to be remembered the will just show you the email at the next login, without telling you if it's the personal or work account.

It is the worst login experience Iv've ever had, bar none, I am constantly amazed how they could ship that and always wonder what hellish dungeon of reasons there must be behind the decision to keep it as it is.

I think the difference is between Microsoft online accounts where you can register an account with them using any email address and Azure AD accounts (e.g. for Office/Microsoft 365). The catch is that you can register for a Microsoft online account using an account that is also in Azure AD - so you end up with two accounts of different types with the same email address as username and (hopefully) different passwords. So hence the question asking which one of your accounts you want to log in with.

Yes, this can be confusing.

That's a confusing and annoying UI, to be sure - but for these systems, the email adress is not the identifier. The (email,account issuer) pair is the identifier.

So you can have two accounts, say for (vimslayer@contoso.com, Microsoft Account) and (vimslayer@contoso.com, Contoso AD) - and there is no collision and no possible confusion on the system end. All the confusion is on the human end.

And there is a lot of confusion on the human end :)

You can create a personal account with Azure or Microsoft more generically with your work email address, eg you@work.com. Because this was set up by you, you could conceivably change it to you@freemail.com.

However your organization may then do a deal with MS for Azure, or MSDN subscriptions, etc. And they’ll issue a login with the same email* address you@work.com — you now have two accounts tied to the same email, one which you created by yourself and one which your IT department created for you. There’s no way for you to change this second one. Typically authentication for the second one will happen via your org’s single sign on.

So the answer to “is this account personal or issued by your IT dept” really means — did you create the account yourself? Or was it provisioned for you by IT?

* Many orgs by default don’t use email to log in. Instead a “username” like jsmith is used instead. However while interfacing with Azure it seems to be a best practice to use email.

And some B2B+B2C SaaS products (Box/Dropbox/etc), when encountering this situation, only let 1 account exist. When the IT department tries to provision a conflict, instead of being provisioned, the personal account goes into an "invited to assimilate" status. The end user gets an email asking them to allow their account, which was created personally, to be converted to one managed by the enterprise admin. The user gets an opportunity, before the IT admin has control, to migrate personal data out (if they want the account converted) or change the email address to something that wouldn't conflict (if they want 2 accounts).