Skip to content
masterclassBuddyTech Buzz5 fresh blogs · 5:00 AM IST
Start learning

Auth.js · Const

MicrosoftEntraID

MicrosoftEntraID is Auth.js’s built-in OpenID Connect provider for Microsoft Entra ID. Configure client credentials and optionally an issuer to restrict authentication to a specific tenant.

How it works

MicrosoftEntraID is Auth.js’s built-in OpenID Connect provider for Microsoft Entra ID. Configure it with an application client ID and secret; supplying a tenant issuer restricts sign-in to that organization, while the default issuer permits personal, school, or work Microsoft accounts.

Syntax

function default(config): OIDCConfig<MicrosoftEntraIDProfile>

Parameters

NameTypeDescription
configOIDCUserConfig<MicrosoftEntraIDProfile>Provider configuration containing the client credentials and optional issuer.

Returns

OIDCConfig<MicrosoftEntraIDProfile>

Key points

  • Auth.js provides Microsoft Entra ID as a built-in provider rather than requiring a custom OAuth/OIDC implementation.
  • The client ID is conventionally supplied through AUTH_MICROSOFT_ENTRA_ID_ID.
  • The client secret is conventionally supplied through AUTH_MICROSOFT_ENTRA_ID_SECRET.
  • A tenant-specific issuer uses the Microsoft login URL with the Directory (tenant) ID and v2.0 path.
  • Auth.js treats this provider as OpenID Connect by default.

Common mistakes

  • Omitting issuer uses the common Microsoft endpoint, so the provider accepts personal, school, and work Microsoft accounts rather than limiting access to one tenant.
  • Use a tenant-specific issuer when sign-in must be limited to your organization.
  • Register the provider’s callback URI in the Microsoft application configuration before testing authentication.

Example: Configure Microsoft Entra ID

import NextAuth from "next-auth"
import MicrosoftEntraID from "next-auth/providers/microsoft-entra-id"

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    MicrosoftEntraID({
      clientId: process.env.AUTH_MICROSOFT_ENTRA_ID_ID,
      clientSecret: process.env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
      issuer: process.env.AUTH_MICROSOFT_ENTRA_ID_ISSUER,
    }),
  ],
})

Registers Microsoft Entra ID with client credentials and an optional tenant-specific issuer.

When to use it

Microsoft sign-in

Add Microsoft account authentication to an Auth.js application.

Tenant-restricted access

Permit only users from one Microsoft Entra organization.

Multi-account authentication

Support personal, school, and work Microsoft accounts through the common endpoint.

Interview questions

QWhat does MicrosoftEntraID configure?

MicrosoftEntraID configures Auth.js as an OpenID Connect provider. The essential application credentials are the client ID and client secret; an issuer can also be supplied.

Follow-up: How would you restrict access to one organization? Set issuer to the tenant-specific Microsoft login URL containing the Directory (tenant) ID.

QWhat is the default issuer behavior?

Without an issuer, Auth.js defaults to the common v2.0 endpoint. That endpoint allows Microsoft personal, school, and work accounts to authenticate.

Follow-up: What changes for single-tenant authentication? Provide the organization’s Directory (tenant) ID in the issuer URL.

QHow must the Microsoft application be configured?

The callback path is /api/auth/callback/microsoft-entra-id, and it must be registered as the application’s callback URI. The environment variables hold the client ID, secret, and optional issuer.

Follow-up: Which provider identifier determines the callback path? The provider’s identifier is microsoft-entra-id.

  • MicrosoftEntraIDProfile
  • OIDCConfig
  • OIDCUserConfig
  • microsoft-entra-id

Source: providers/microsoft-entra-id. Checked 2026-10-15.