On OBO scenario, got a Warning when using "organizations" as TenantId in my service

[Kawottex]

Hello,
I've built a client and a service based on the "on behalf of user" scenario with the Microsoft-Identity-Web library.

• The client authenticates a user to obtain an access token. We use the "organizations" tenant for the authority because we need to handle users from multiple tenants.
• The access token is sent to an API service setup with AddMicrosoftIdentityWebApi / EnableTokenAcquisitionToCallDownstreamApi / AddMicrosoftGraph methods. This service is also setup with "organizations" as TenantId in the configuration (same scenario, we need to handle users from multiple tenants).

But when I call the Graph API in the service, even if it works correctly and I successfully get the informations I need from the API, I've got a warning message:

Have not filtered by tenant ID. This can happen in OBO scenario where authority is /common or /organizations. Please use tenanted authority.

I don't clearly understand why I should not use "organizations" as a tenant id in a OBO scenario when it's not a deamon service (it doesn't call the API on behalf of itself but on behalf of a user). And if that's the case, I don't understand how I can setup a multi-tenant OBO scenario without using "organizations" as tenant id.

Thank you,
Kevin

[bgavrilMS]

common and organizations mean "I don't know the tenant, let AAD discover it for me". Since a user can be in multiple tenants (primary in his home tenant, guest in others), AAD will essentially replace organizations by the home tenant id.

My understanding of multi-tenant OBO is to not use organizations tenant, but instead use the tid claim of the original assertion. @jennyf19, @jmprieur - should Microsoft.Identity.Web do this since it reads / decodes the original assertion? I believe that if you use WithTenantId(tokenUsedToCallTheWebApi.TID) is should cover all cases, as WithTenantId will only replace the original tenant if it is "organizations"