Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

[AOBELAR]

Hello everyone,

I have a Remote Access VPN implementation configured with MFA authentication. The issue I’m facing is that the authentication fails when I connect using my home Internet Service Provider’s network.

The error message shows an App registration that doesn’t exist in my Azure tenant and isn’t linked to any Identity Provider configured in my Management Server.

However, when I connect using my mobile hotspot, the authentication works perfectly, and the URLs correspond to the current Identity Provider configured on the gateway.

Could this behavior be related to how the ISP handles IP assignment (NAT, CGNAT, etc.)?
Is there any known limitation or recommendation regarding authentication flows behind carrier-grade NAT or similar configurations?

Thanks in advance for any insight or suggestions.

[the_rock]

Im not expert in this particular subject by any means, but I do know those values have to come from Azure/gw side. By the way, I see the option for importing file, you did not do so, you chose manual...any reason why?

[AOBELAR]

I tried a different approach because it wouldn’t start before. It starts now, but it’s showing some strange behavior.

[the_rock]

Did you try importing the file approach?

[the_rock]

I meant below settings, more less what you had in your screenshot.

 

[AOBELAR]

In the previous cases, I followed this approach.

[the_rock]

And I assume it was same error?

[AOBELAR]

It doesn’t have any impact, but the idea was to test an alternative approach.

[the_rock]

Small favor, if you dont mind...can you please paste the text error itself, rather than the screenshot?

[AOBELAR]

AADSTS700016: Application with identifier 'https://IP/saml-vpn/spPortal/ACS/ID/e630b697-b47e-4029-be4b-33599e317cb0' was not found in the directory 'XXXXXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

Troubleshooting details

If you contact your administrator, send this info to them.

Copy info to clipboard

Request Id: fe7e2435-c841-4163-b60d-b2f7b4964301

Correlation Id: 51b51ef5-6f1a-4f0b-a58c-b2cc4b6cfeb4

Timestamp: 2025-12-02T01:17:28Z

Message: AADSTS700016: Application with identifier 'https://IP/saml-vpn/spPortal/ACS/ID/e630b697-b47e-4029-be4b-33599e317cb0' was not found in the directory 'XXXXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

Flag sign-in errors for review: Enable flagging

If you plan on getting help for this problem, enable flagging and try to reproduce the error within 20 minutes. Flagged events make diagnostics available and are raised to admin attention.

[the_rock]

Give me some time, let me look into it.

[the_rock]

Here are some things I would check, from my previous notes:

1) Check the tenant

2) check the app registration

3) confirm the identifier

[AOBELAR]

But why would the scenario that authenticates me vary depending on the connection?

[the_rock]

Just thought of something, might not be related, but lets double check. What are dns servers when it works and when it does not, can you check?

[AOBELAR]

falis

fails

Works
works

[the_rock]

K, so lets take a step back, as they say. So, with one that fails, are you able to resolve google dns, say google.com. Does that work?

[AOBELAR]

[the_rock]

I would open TAC case, see if they provide specific vpn debug for this.

[AOBELAR]

Thank you very much for your time and for the validation tips. I will share any updates as soon as I have them, in case they’re helpful for future cases.

[the_rock]

Yes, thanks a lot for that, appreciated.