diff --git a/data_safe_haven/external/interface/azure_authenticator.py b/data_safe_haven/external/interface/azure_authenticator.py
index 74d28672fd..4652843ec9 100644
--- a/data_safe_haven/external/interface/azure_authenticator.py
+++ b/data_safe_haven/external/interface/azure_authenticator.py
@@ -28,6 +28,7 @@ def credential(self) -> DefaultAzureCredential:
                 exclude_interactive_browser_credential=False,
                 exclude_shared_token_cache_credential=True,  # this requires multiple approvals per sign-in
                 exclude_visual_studio_code_credential=True,  # this often fails
+                additionally_allowed_tenants=["*"],
             )
         return self.credential_