Nedo.AspNet.Authentication.Microsoft 2.0.8

Nedo.AspNet.Authentication.Microsoft

"Sign in with Microsoft Account" — your app mints its own JWTs after verifying a Microsoft-issued ID token from MSAL.js on the SPA side. Supports consumer accounts, work accounts, and multi-tenant via the Tenant option.

For Entra ID as the canonical token issuer (resource-server pattern) — i.e. validating Entra-issued JWTs directly without your app re-minting them — use Nedo.AspNet.Authentication.EntraId instead.

Install

dotnet add package Nedo.AspNet.Authentication.Microsoft

Quickstart

using Nedo.AspNet.Authentication.Microsoft;

builder.Services.AddMicrosoft(opts =>
{
    opts.ClientId = builder.Configuration["Microsoft:ClientId"]!;
    opts.Tenant   = builder.Configuration["Microsoft:Tenant"] ?? "consumers";
    // "consumers" — Microsoft personal accounts only
    // "organizations" — work / school accounts only
    // "common" — both, multi-tenant
    // "<tenant-id>" — a specific Entra tenant
});

var app = builder.Build();
app.MapLocalAuth();
app.MapLocalAccount();
app.MapMicrosoftAuth();   // POST /auth/microsoft { idToken, intent? }

Frontend (SPA)

Use @azure/msal-browser:

import { PublicClientApplication } from '@azure/msal-browser';

const msal = new PublicClientApplication({
  auth: {
    clientId: import.meta.env.VITE_MICROSOFT_CLIENT_ID,
    authority: `https://login.microsoftonline.com/${import.meta.env.VITE_MICROSOFT_TENANT}`,
    redirectUri: window.location.origin,
  },
});
await msal.initialize();

const result = await msal.loginPopup({ scopes: ['openid', 'profile', 'email'] });
const tokens = await fetch('/auth/microsoft', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ idToken: result.idToken, intent: 'signin' }),
}).then(r => r.json());

Sign-in vs sign-up intent

Same as the other social providers — see Google's README for the explanation.

Console setup

1. https://entra.microsoft.com → Identity → Applications → App registrations → New registration.
2. Supported account types — pick the audience that matches your Tenant option (consumers ↔ "Personal Microsoft accounts only", common ↔ "Accounts in any organizational directory and personal Microsoft accounts").
3. Redirect URI — Single-page application — https://app.example.com (and http://localhost:5173 for dev).
4. Copy the Application (client) ID.

Full walkthrough: docs/providers/social/microsoft.md.

License

MIT — see LICENSE.