{"record":{"id":"5a84023c3b2711ae","repo":"PrefectHQ/fastmcp","slug":"tenant-name-should-be-the-short-name-without-the","errorCode":null,"errorMessage":"tenant_name should be the short name without the .onmicrosoft.com suffix (e.g. 'mytenant'), got {tenant_name!r}","messagePattern":"tenant_name should be the short name without the \\.onmicrosoft\\.com suffix \\(e\\.g\\. 'mytenant'\\), got (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/providers/azure.py","lineNumber":343,"sourceCode":"                (e.g. `\"mytenant\"`).\n            policy_name: User-flow or custom-policy name\n                (e.g. `\"B2C_1_susi\"`).\n            client_id: Application (client) ID from the B2C app registration.\n            client_secret: Client secret from the B2C app registration.\n            required_scopes: Custom API scope names without prefix\n                (e.g. `[\"mcp-access\"]`).\n            base_url: Public base URL of this server.\n            custom_domain: Custom domain for the B2C authority\n                (e.g. `\"auth.mycompany.com\"`). Defaults to\n                `{tenant_name}.b2clogin.com`.\n            identifier_uri: Application ID URI. Defaults to\n                `https://{tenant_name}.onmicrosoft.com/{client_id}`.\n            token_issuer: Expected `iss` claim. `None` (default) disables\n                issuer validation.\n            **kwargs: Forwarded to `AzureProvider.__init__`.\n        \"\"\"\n        if \".onmicrosoft.com\" in tenant_name:\n            raise ValueError(\n                f\"tenant_name should be the short name without the \"\n                f\".onmicrosoft.com suffix (e.g. 'mytenant'), got {tenant_name!r}\"\n            )\n\n        if custom_domain is not None:\n            custom_domain = (\n                custom_domain.removeprefix(\"https://\")\n                .removeprefix(\"http://\")\n                .rstrip(\"/\")\n            )\n\n        authority = custom_domain or f\"{tenant_name}.b2clogin.com\"\n        tenant_path = f\"{tenant_name}.onmicrosoft.com/{policy_name}\"\n        uri = identifier_uri or f\"https://{tenant_name}.onmicrosoft.com/{client_id}\"\n\n        provider = cls(\n            client_id=client_id,\n            client_secret=client_secret,","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/providers/azure.py#L325-L361","documentation":"AzureProvider.from_b2c builds B2C endpoints from tenant_name as https://{tenant_name}.b2clogin.com and the issuer as https://{tenant_name}.onmicrosoft.com/{client_id}. If you pass a tenant_name that already contains '.onmicrosoft.com', the constructed URLs would be malformed (double suffix), so the classmethod rejects it with ValueError.","triggerScenarios":"Calling AzureProvider.from_b2c(tenant_name='mytenant.onmicrosoft.com', ...) — the check `'.onmicrosoft.com' in tenant_name` fires for any such value.","commonSituations":"Copy-pasting the full tenant domain from the Azure portal or from a token's issuer claim instead of the short B2C tenant name; configuring from environment variables that hold the full domain.","solutions":["Strip the .onmicrosoft.com suffix: pass 'mytenant' instead of 'mytenant.onmicrosoft.com'.","If you have the full domain, split it: tenant_name = domain.split('.onmicrosoft.com')[0].","Use a custom_domain argument if your B2C tenant uses a custom login domain."],"exampleFix":"// before\nAzureProvider.from_b2c(tenant_name=\"mytenant.onmicrosoft.com\", client_id=cid)\n// after\nAzureProvider.from_b2c(tenant_name=\"mytenant\", client_id=cid)","handlingStrategy":"validation","validationCode":"def normalize_b2c_tenant(name: str) -> str:\n    if \".onmicrosoft.com\" in name:\n        raise ValueError(\"Pass the short tenant name without .onmicrosoft.com\")\n    return name","typeGuard":"def is_short_tenant_name(name: str) -> bool:\n    return bool(name) and \".onmicrosoft.com\" not in name and \"/\" not in name","tryCatchPattern":"try:\n    provider = AzureProvider.from_b2c(tenant_name=tenant, client_id=cid)\nexcept ValueError as e:\n    if \".onmicrosoft.com\" in str(e):\n        provider = AzureProvider.from_b2c(tenant_name=tenant.split(\".\")[0], client_id=cid)\n    else:\n        raise","preventionTips":["Store the short tenant name in config, not the full domain","Normalize env-provided values: tenant.split('.onmicrosoft.com')[0]"],"tags":["python","azure","azure-ad-b2c","configuration"],"backgroundTag":"invalid-tenant-identifier","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}