Enterprise authentication
Add Azure AD sign-in to a Next.js Auth.js application.
Auth.js · Const
AzureAD
AzureAD is Auth.js’s built-in Azure Active Directory OIDC provider. It is deprecated in favor of the Microsoft Entra ID provider because Azure Active Directory was renamed.
How it works
AzureAD is Auth.js’s built-in OpenID Connect integration for Azure Active Directory. Calling the provider factory creates an OIDC configuration from client settings, optionally including a supported profile-photo size; the documentation recommends Microsoft Entra ID for new integrations because Azure AD has been renamed.
Syntax
function default(config): OIDCConfig<MicrosoftEntraIDProfile>Parameters
| Name | Type | Description |
|---|---|---|
config | OIDCUserConfig<MicrosoftEntraIDProfile> & { profilePhotoSize: 64 | 48 | 96 | 120 | 240 | 360 | 432 | 504 | 648 } | OIDC user configuration plus the optional supported profile-photo size. |
Returns
OIDCConfig<MicrosoftEntraIDProfile>
Key points
- AzureAD is included as a ready-made Auth.js provider rather than requiring a custom OAuth or OIDC implementation.
- Calling the provider function with configuration produces an OpenID Connect provider configuration using the Microsoft Entra ID profile type.
- The configuration combines standard OIDC user settings with a profile-photo-size option.
- The profile-photo-size setting is limited to the documented supported pixel values.
- The getting-started page documents an Auth.js Azure AD ID environment variable for provider setup.
- The setup documentation also names an environment variable for the Azure AD client secret.
- Tenant selection is configured through the documented Azure AD tenant ID environment variable.
Common mistakes
- The provider is deprecated because Microsoft renamed Azure Active Directory; new integrations should use the Microsoft Entra ID provider instead.
- Existing AzureAD imports should be migrated to the Microsoft Entra ID provider submodule.
Example: Configure Azure AD in Next.js
import NextAuth from "next-auth"
import AzureAD from "next-auth/providers/azure-ad"
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [AzureAD({
clientId: process.env.AUTH_AZURE_AD_CLIENT_ID,
clientSecret: process.env.AUTH_AZURE_AD_CLIENT_SECRET,
tenantId: process.env.AUTH_AZURE_AD_TENANT_ID,
})],
})Registers Azure AD as an Auth.js provider using application credentials and the tenant identifier.
When to use it
Tenant-based identity integration
Connect an Auth.js application to an existing Azure tenant.
AzureAD compatibility
Maintain an existing application while planning provider migration.
Interview questions
QWhat does the AzureAD provider factory return?
AzureAD is a built-in Azure AD integration, and its factory returns an OIDCConfig<MicrosoftEntraIDProfile>. It accepts OIDC user configuration plus an optional profilePhotoSize constrained to the documented sizes.
Follow-up: What should a new application use instead? Use the Microsoft Entra ID provider submodule, since Azure Active Directory was renamed and the AzureAD provider is deprecated.
QHow is AzureAD registered in a Next.js Auth.js setup?
Configure the provider in the Auth.js providers array by calling AzureAD with the application client ID, client secret, and tenant ID. The provider then supplies the OIDC configuration used for sign-in.
Follow-up: Where should the credentials come from? Store the client ID, client secret, and tenant ID in environment variables rather than embedding secrets in source code.
QWhich profile type does AzureAD expose?
The API reference aliases AzureADProfile to MicrosoftEntraIDProfile. This reflects the provider’s current identity model while retaining the AzureAD export name for compatibility.
Follow-up: What migration concern follows from that alias? New code should prefer the Microsoft Entra ID provider import rather than building further dependencies on the deprecated AzureAD name.
Related
MicrosoftEntraIDProfileOIDCConfigOIDCUserConfigproviders/microsoft-entra-id