The Microsoft connector signs users in with a Microsoft account — personal Outlook and Xbox accounts, work or school accounts from Microsoft Entra ID, or both, depending on how you register the app.
For workforce identity where a customer's IT admin owns the tenant and you want email-domain routing, use the Entra ID connector under Enterprise SSO instead. This connector is the consumer-and-developer path.
Copy the redirect URI
In the Authdog console, select the project and environment, open Authentication > Providers, find Microsoft, and click Enable. Copy the redirect URI shown in the form:
https://identity.authdog.com/api/v1/callback/<connectionId>Register the application
- Open the Azure portal and go to Microsoft Entra ID > App registrations.
- Select New registration.
- Name the application.
- Under Supported account types, choose the audience:
- Accounts in any organizational directory and personal Microsoft accounts — the broadest option, and the one that matches this connector's default endpoint.
- Accounts in this organizational directory only — single tenant.
- Under Redirect URI, select Web and paste the redirect URI from Authdog.
- Register, then copy the Application (client) ID from the overview.
Create the secret:
- Open Certificates & secrets.
- Select New client secret, give it a description and an expiry.
- Copy the secret Value immediately — Azure hides it after you navigate away.
Configure Authdog
| Field | Value |
|---|---|
| Client ID | Application (client) ID |
| Client Secret | The secret Value, not the secret ID |
Save, then toggle the connection active.
The connector is also available under the alias azure-oauth20, which behaves identically.
What Microsoft returns
Authdog requests the user.read scope and reads the profile from Microsoft Graph at /v1.0/me.
Personal Microsoft accounts often return userPrincipalName rather than a conventional mail attribute, and some work accounts have no mail value set at all. Authdog falls back to the identifiers Graph does provide, and links returning users on the stable object identifier.
Authdog uses the common endpoint, which accepts both personal and organizational accounts. If you registered the app as single-tenant, users outside that tenant will be refused by Microsoft even though the request reaches it.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select Continue with Microsoft and complete the flow.
- Test with both a personal account and a work account if your audience covers both.
Troubleshooting
| Symptom | Cause |
|---|---|
AADSTS50011: redirect URI does not match |
The URI is missing from the app registration, or registered under the wrong platform type |
AADSTS7000215: Invalid client secret |
The secret ID was pasted instead of the secret value, or the secret expired |
AADSTS50020: user account does not exist in tenant |
The registration is single-tenant and the user is external |
AADSTS65001: consent required |
An admin must grant consent for the tenant |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| Enterprise SSO | Connect Entra ID as a workforce identity provider with domain routing |