The app is single tenant authentication so users must be present in contoso directory. https://docs.microsoft.com/en-us/azure/active-directory/develop/single-and-multi-tenant-apps With Azure AD B2B, external users authenticate to their home directory, but have a representation in your directory. https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management- external-users