Microsoft sign-in

A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Let users sign in with Microsoft over OIDC, keyed on tenant and object id, because the email claim is not proof of an address.

Usually comes after: Google sign-in.

Prompt for your AI assistant

Read the sign-in decision record in docs/decisions and check Microsoft's current guidance on the email claim before you start. Add Sign in with Microsoft through Entra ID. Ask me whether this product takes work accounts, personal accounts or both and register the application to match. On a hosted provider, use its Microsoft connection with this product's own registration. In your own service, use a maintained library for the OIDC authorization code flow with PKCE and validate the issuer against the tenant in the token, because it differs per tenant. Store the identity by tenant id and object id (the tid and oid claims), never by address. Do not link to an existing user from the email claim, which can come from an unverified source: ask the user to sign in first and link from settings. Record what you did in the decision record and try it with a real account.

This is https://gradus.kazet.blog/tree/cloud-application/step/microsoft-sign-in as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.