Azure OAuth callback URL format
The Supabase Auth callback URL for Azure OAuth should follow the format: https://<project-ref>.supabase.co/auth/v1/callback
Supabase · Auth · all subjects
oauth providers/azure
21 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Azure OAuth app redirect URI requirements
When registering an Azure OAuth application, specify a Web Redirect URI. During local development, Azure does not allow 127.0.0.1 as a redirect URI hostname and requires the use of localhost instead.
Local Azure OAuth development configuration
To enable Azure OAuth during local Supabase development, configure the Supabase API external URL in config.toml with: [api] external_url = "http://localhost:54321"
Azure OAuth client secret expiry management
When creating a client secret in Azure, choose a preferred expiry time and record it in advance so you have enough time to create a new secret before the current one expires to avoid downtime.
Azure unverified email domains vulnerability
Microsoft Entra ID can send unverified email domains in certain cases, opening projects to impersonation attacks. This applies if authenticationBehaviors allows unverified emails, the app is single-tenant, or the app was created before June 20 2023. To mitigate, configure the optional xms_edov claim in the OAuth app manifest to allow Supabase Auth to identify email verification status.
Azure xms_edov claim configuration in manifest
In the Azure OAuth app manifest, configure optionalClaims with xms_edov and email claims in idToken and xms_edov in accessToken. Each claim object should have: name, source (null), essential (false), and additionalProperties (empty array).
Azure OAuth default tenant configuration
By default, Supabase Auth uses the common Microsoft tenant (https://login.microsoftonline.com/common) which allows any Microsoft account to sign in. Specific account types limit access further based on the OAuth registration configuration.
Azure tenant URL format for single-tenant apps
For OAuth apps registered as My organization only, configure Supabase Auth with the organization's tenant URL in the format: https://login.microsoftonline.com/<tenant-id>. This limits access to Microsoft accounts from only the specified tenant.
Azure personal accounts only tenant configuration
If the Azure OAuth app is registered as Personal Microsoft accounts only, configure Supabase Auth to use the consumers tenant: https://login.microsoftonline.com/consumers
Azure OAuth requires email scope
Supabase Auth requires that Azure returns a valid email address. Therefore you must request the email scope in the signInWithOAuth method.
Azure signInWithOAuth JavaScript example
import { createClient } from '@supabase/supabase-js' const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...') async function signInWithAzure() { const { data, error } = await supabase.auth.signInWithOAuth({ provider: 'azure', options: { scopes: 'email', }, }) }
Azure signInWithOAuth Dart/Flutter example
Future<void> signInWithAzure() async { await supabase.auth.signInWithOAuth( OAuthProvider.azure, redirectTo: kIsWeb ? null : 'my.scheme://my-host', authScreenLaunchMode: kIsWeb ? LaunchMode.platformDefault : LaunchMode.externalApplication, ); }
Azure signInWithOAuth Kotlin example
suspend fun signInWithAzure() { supabase.auth.signInWith(Azure) { scopes.add("email") } }
Azure signInWithOAuth C# example
var state = await supabase.Auth.SignIn(Provider.Azure, new SignInOptions { Scopes = "email" }); var signInUrl = state.Uri;
Azure offline_access scope for provider refresh token
Azure OAuth2.0 does not return the provider_refresh_token by default. To obtain the provider_refresh_token, include the offline_access scope in the signInWithOAuth call.
Azure offline_access scope JavaScript example
import { createClient } from '@supabase/supabase-js' const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...') async function signInWithAzure() { const { data, error } = await supabase.auth.signInWithOAuth({ provider: 'azure', options: { scopes: 'offline_access', }, }) }
Azure offline_access scope Dart/Flutter example
Future<void> signInWithAzure() async { await supabase.auth.signInWithOAuth( OAuthProvider.azure, scopes: 'offline_access', ); }
Azure offline_access scope Kotlin example
suspend fun signInWithAzure() { supabase.auth.signInWith(Azure) { scopes.add("offline_access") } }
Azure offline_access scope C# example
var state = await supabase.Auth.SignIn(Provider.Azure, new SignInOptions { Scopes = "offline_access" }); var signInUrl = state.Uri;
Configure Azure auth provider via Management API
Azure auth can be configured using the Management API with a PATCH request to https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth. Required fields: external_azure_enabled (boolean), external_azure_client_id (string), external_azure_secret (string), external_azure_url (string). Authentication uses Bearer token from Supabase dashboard account tokens.
Azure sign out Dart/Flutter example
Future<void> signOut() async { await supabase.auth.signOut(); }