Set up Sign in with Microsoft

A Continue with Microsoft button on the sign-in and sign-up pages, for people whose organization doesn’t use SAML single sign-on. It is set up once for the whole wrkflow deployment by whoever runs it, not per organization. Until it is set up, the button doesn’t show.

Set up

1. 1In the Microsoft Entra admin center, open App registrations and choose New registration. Name it wrkflow, choose the account types (any organizational directory for many companies, or this directory only for one), and set the redirect URI, platform Web, to your authentication service’s callback address, which ends in /auth/v1/callback: https://api.wrkflow.si/auth/v1/callback for the server at wrkflow.si, or https://<project-ref>.supabase.co/auth/v1/callback on Supabase’s hosted service.
2. 2Under Certificates & secrets, create a client secret and copy its Value, not its ID. Note its expiry: sign-in stops for everyone when it expires.
3. 3Under Token configuration, add optional claims for the ID token: email and xms_edov. The email claim is required, and xms_edov says whether the address is verified, which decides whether the sign-in can link to an existing wrkflow account.
4. 4Switch on the Azure provider with the application (client) ID, the secret value and the tenant URL. On a server run from infra/server, that is AZURE_ENABLED=true, AZURE_CLIENT_ID, AZURE_SECRET and AZURE_URL in its settings, then apply the settings; on Supabase’s hosted service, open Authentication, Providers, Azure. The tenant URL is https://login.microsoftonline.com/<tenant-id> to restrict it to one company, or https://login.microsoftonline.com/organizations for any work or school account. Leaving it empty also admits personal Microsoft accounts.
5. 5Save. Once the sign-in service runs with the new settings, the Continue with Microsoft button appears within a minute, with no redeploy. (If your deployment sets NEXT_PUBLIC_AUTH_PROVIDERS to choose which buttons show, add azure to it.)

wrkflow asks for the email scope. Microsoft sends the person’s email, whether it is verified, and their name when they sign in. Nothing about surveys or responses is involved.

If something goes wrong

• The button doesn’t appear: the Azure provider is switched off in the authentication service (AZURE_ENABLED is not true), or NEXT_PUBLIC_AUTH_PROVIDERS is set without azure in it.
• Sign-in stopped working for everyone: the client secret expired. Create a new one in Entra ID and update the authentication service.

Organizations that want to require sign-in through their own identity provider use Single sign-on and verified domains instead. See Integrations for the statuses and how to ask support.