Currently I'm implementing Microsoft Authentication Library(MSAL) on my C# .NET framework webapp (single tenant) and when I acquire the token using the code from Owin I'm getting the wrong GUID for the user/tenant in my confidential app.

This is the return from the confidential app(dc3... is the UserId and cf3.. is the TenantId), this is from a different directory on Azure.

But the claims generated by C# have the correct values:

If I check the object from the confidential app I can see inside "TenantProfiles" the same values as the above (f81 and e24), the correct ones.

But since the Claims have different values as the Confidential App, I cannot get the user with GetAccountAsync(), because it tries to find a user based on "dc3" GUID not "f81" GUID. I can get the user using a filter on GetAccountsAsync(), but this method is deprecated.

Here's my code

        public static string appKey = ConfigurationManager.AppSettings["ida:AppKey"];
        private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"]; //https://login.microsoftonline.com/{0}
        public static string tenant = ConfigurationManager.AppSettings["ida:Tenant"];
        public static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"];

        public static readonly string Authority = String.Format(CultureInfo.InvariantCulture, aadInstance, tenant) + "/v2.0";

        public void ConfigureAuth(IAppBuilder app)
        {
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions() { CookieSecure = CookieSecureOption.SameAsRequest });

            app.UseOpenIdConnectAuthentication(
               new OpenIdConnectAuthenticationOptions
               {
                   Authority = Startup.Authority,
                   ClientId = Startup.clientId,
                   RedirectUri = Startup.redirectUri,
                   PostLogoutRedirectUri = Startup.redirectUri,
                   Scope = OpenIdConnectScopes.OpenIdProfile,
                   Notifications = new OpenIdConnectAuthenticationNotifications()
                   {
                       AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                       AuthenticationFailed = OnAuthorizationFailed
                   }
               });
        }

        private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification)
        {
            var app = IdentityApiUtility.BuildConfidentialClientApplication();
            var result = await app.AcquireTokenByAuthorizationCode(new[] { "https://graph.microsoft.com/.default" }, notification.Code).ExecuteAsync();
        }

and

public static IConfidentialClientApplication BuildConfidentialClientApplication()
        {
            if (clientapp == null)
            {
                clientapp = ConfidentialClientApplicationBuilder
                                            .Create(Startup.clientId)
                                            .WithClientSecret(Startup.appKey)
                                            .WithRedirectUri(Startup.redirectUri)
                                            .WithAuthority(Startup.Authority)
                                            .Build();
            }

            return clientapp;
        }

        /// <summary>
        /// Gets an auth code on behalf of the current user
        /// </summary>
        private AuthenticationResult GetOpenIdConnectAuth()
        {
            try
            {
                string userObjectID = $"{ClaimsPrincipal.Current.GetObjectId()}.{ClaimsPrincipal.Current.GetTenantId()}";

                var app = BuildConfidentialClientApplication();

                var scopes = new[] { "https://graph.microsoft.com/.default" };
                
                //The userObjectId here starts with f81, which I got from the claims. But the user in the ConfidentialApp starts with dc3 which from another Azure Directory
                var account = app.GetAccountAsync(userObjectID).Result;

                var accessToken = app.AcquireTokenSilent(scopes, account).ExecuteAsync().Result;

                return accessToken;
            }
            catch (Exception ex)
            {
                throw new Exception("Authentication Error in GetOpenIdConnectAuth method");
            }
        }

I already checked clientid/secret/tenant multiple times just to be sure that I wasn't sending the wrong authority/tenant and this is not the case. Does anyone have a suggestion how I can get the user from the ConfidentialApp or what I'm doing wrong?