Microsoft OAuth

Microsoft OAuth allows users to sign in using their Microsoft Entra ID (formerly Azure AD) accounts. This is particularly useful for B2B applications where users sign in with their corporate accounts.

Prerequisites

To use Microsoft OAuth, you need to register an application in the Azure Portal.

1. Go to the Azure Portal.
2. Search for and select App registrations.
3. Click New registration.
4. Enter a name for your application.
5. Choose the Supported account types based on your target audience (e.g., Accounts in any organizational directory and personal Microsoft accounts).
6. Under Redirect URI, select Web and enter your Better Auth callback URL (e.g., https://yourdomain.com/api/auth/callback/microsoft).
7. Once created, copy the Application (client) ID.
8. Go to Certificates & secrets > New client secret to generate a client secret. Copy the Value (not the ID).

Environment Variables

Add your Microsoft credentials to your .env file. You can optionally include a Tenant ID to restrict logins to a specific Microsoft 365 tenant.

AUTH_MICROSOFT_ID=your_microsoft_client_id
AUTH_MICROSOFT_SECRET=your_microsoft_client_secret
# Optional: Set to restrict login to a specific tenant
# AUTH_MICROSOFT_TENANT_ID=your_tenant_id

Configuration

The Microsoft provider is conditionally enabled in packages/backend/convex/auth.ts based on the presence of these environment variables:

const microsoftSocialProvider =
  env.AUTH_MICROSOFT_ID && env.AUTH_MICROSOFT_SECRET
    ? {
        microsoft: {
          clientId: env.AUTH_MICROSOFT_ID,
          clientSecret: env.AUTH_MICROSOFT_SECRET,
          ...(env.AUTH_MICROSOFT_TENANT_ID
            ? { tenantId: env.AUTH_MICROSOFT_TENANT_ID }
            : {}),
        },
      }
    : {};