The Microsoft connector signs users in with a Microsoft account — personal Outlook and Xbox accounts, work or school accounts from Microsoft Entra ID, or both, depending on how you register the app.

For workforce identity where a customer's IT admin owns the tenant and you want email-domain routing, use the Entra ID connector under [Enterprise SSO](/docs/sso) instead. This connector is the consumer-and-developer path.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **Microsoft**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Register the application

1. Open the [Azure portal](https://portal.azure.com) and go to **Microsoft Entra ID > App registrations**.
2. Select **New registration**.
3. Name the application.
4. Under **Supported account types**, choose the audience:
   - *Accounts in any organizational directory and personal Microsoft accounts* — the broadest option, and the one that matches this connector's default endpoint.
   - *Accounts in this organizational directory only* — single tenant.
5. Under **Redirect URI**, select **Web** and paste the redirect URI from Authdog.
6. Register, then copy the **Application (client) ID** from the overview.

Create the secret:

1. Open **Certificates & secrets**.
2. Select **New client secret**, give it a description and an expiry.
3. Copy the secret **Value** immediately — Azure hides it after you navigate away.

> **Caution**
>
> Client secrets expire, up to a maximum of 24 months. Put the expiry date in
> your calendar: when it passes, every sign-in through this connector fails at
> the token exchange with no warning beforehand.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | Application (client) ID |
| **Client Secret** | The secret **Value**, not the secret ID |

Save, then toggle the connection **active**.

The connector is also available under the alias `azure-oauth20`, which behaves identically.

## What Microsoft returns

Authdog requests the `user.read` scope and reads the profile from Microsoft Graph at `/v1.0/me`.

Personal Microsoft accounts often return `userPrincipalName` rather than a conventional mail attribute, and some work accounts have no `mail` value set at all. Authdog falls back to the identifiers Graph does provide, and links returning users on the stable object identifier.

Authdog uses the `common` endpoint, which accepts both personal and organizational accounts. If you registered the app as single-tenant, users outside that tenant will be refused by Microsoft even though the request reaches it.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select **Continue with Microsoft** and complete the flow.
3. Test with both a personal account and a work account if your audience covers both.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `AADSTS50011: redirect URI does not match` | The URI is missing from the app registration, or registered under the wrong platform type |
| `AADSTS7000215: Invalid client secret` | The secret ID was pasted instead of the secret value, or the secret expired |
| `AADSTS50020: user account does not exist in tenant` | The registration is single-tenant and the user is external |
| `AADSTS65001: consent required` | An admin must grant consent for the tenant |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |
| [Enterprise SSO](/docs/sso) | Connect Entra ID as a workforce identity provider with domain routing |