I made progress here, by selecting Multitenant instead of Single tenant in Azure:
Who can use this application or access this API?
Accounts in this organizational directory only (mycorp only - Single tenant) Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)
Even though the documentation states:
Supported account types:
Please note that Zammad only supports these account types (App dependent):
Accounts in this organizational directory only (Default Directory only - Single tenant)
Accounts in any organizational directory (Any Azure AD directory - Multitenant)
Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)
Related discussion: Azure Login: Error 422
Maybe the documentation should be updated?
I am new to all this, but “Single tenant” sounds more like what I need, since I want only the users directly maintained by “mycorp” to be able to log in in Zammad.