Better Auth · Authentication · all subjects

social sign-on/microsoft

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Microsoft Azure Entra ID OAuth provider setup

To use Microsoft as a social provider with Better Auth, you need to generate Client ID and Client Secret using your Microsoft Entra ID dashboard account. Set the redirect URL to http://localhost:3000/api/auth/callback/microsoft for local development, and update it to your application's URL for production. If you change the base path of auth routes, update the redirect URL accordingly.

Microsoft configuration parameters

To configure Microsoft as a provider, pass clientId and clientSecret to socialProviders.microsoft in auth configuration. Optional parameters include: tenantId (default 'common'), authority (default 'https://login.microsoftonline.com'), and prompt (default 'select_account' to force account selection).

Microsoft authority URL for different scenarios

Use the default https://login.microsoftonline.com for standard Entra ID scenarios. For CIAM (Customer Identity and Access Management) scenarios, use https://<tenant-id>.ciamlogin.com.

Microsoft email claim handling for managed users

Entra does not emit the email claim for managed users by default. The email value is tenant-mutable and never verified by Microsoft, so it must not be used for authorization decisions. Request email as an optional claim for managed users, and use profile.oid (plus profile.tid when correlating across tenants) as the stable identity anchor. Refer to the 'Handling Providers Without Email' documentation for the mapProfileToUser fallback.

Microsoft profile image handling

Microsoft returns profile images as base64-encoded strings, which can exceed HTTP header size limits and cause request failures. Use the mapProfileToUser function to either upload the image to your own storage or set it to null to discard the image entirely.

Microsoft sign in configuration example

import { betterAuth } from "better-auth" export const auth = betterAuth({ socialProviders: { microsoft: { clientId: process.env.MICROSOFT_CLIENT_ID as string, clientSecret: process.env.MICROSOFT_CLIENT_SECRET as string, // Optional tenantId: 'common', authority: "https://login.microsoftonline.com", prompt: "select_account", }, }, })

Microsoft profile image mapping example

import { betterAuth } from "better-auth"; export const auth = betterAuth({ socialProviders: { microsoft: { mapProfileToUser: (profile) => { const imgURL = uploadImageToStorage(profile.picture); return { image: imgURL, // or `null` to discard the image }; }, }, }, });

Microsoft sign in with client

To sign in with Microsoft using the client, use the signIn.social function with provider set to 'microsoft' and optionally specify a callbackURL for the redirect after sign in.

Microsoft sign in client example

import { createAuthClient } from "better-auth/client"; const authClient = createAuthClient(); const signIn = async () => { const data = await authClient.signIn.social({ provider: "microsoft", callbackURL: "/dashboard", }); };

Give your agent this brain