Microsoft social login
Users authenticate with existing Microsoft accounts through Azure Entra ID.
Better Auth · Const
microsoft
The microsoft provider enables Microsoft Azure Entra ID OAuth sign-in and sign-up in Better Auth. Configure it under socialProviders.microsoft with an application client ID and an appropriate confidential-client credential.
How it works
The microsoft provider entry enables OAuth sign-in and sign-up through Microsoft Entra ID. Supply the application client ID and, for confidential clients, either a client secret or a client-assertion callback; optional tenant and authority settings control the Entra directory used.
Syntax
socialProviders: { microsoft: { clientId, clientSecret } }Parameters
| Name | Type | Description |
|---|---|---|
clientId | string | Microsoft Entra application client identifier. |
clientSecret | string | Client secret for a confidential client; mutually exclusive with clientAssertion. |
clientAssertion | function | Callback that returns a JWT assertion for supported confidential-client configurations. |
tenantId | string | Optional Entra tenant selection. |
authority | string | Optional authentication authority URL. |
prompt | string | Optional account-selection prompt. |
Returns
Configured Microsoft social authentication through Better Auth.
Key points
- The provider supports both account creation and login through Microsoft Azure Entra ID.
- Put the Entra application client ID in the provider configuration and select one supported confidential-client credential when required.
- Local development uses the documented Microsoft callback path under port 3000.
- A deployed application must register its own production callback URL instead of retaining the local-development address.
- Client assertions are the credential option for private-key JWT or workload-federation Entra applications.
Common mistakes
- Choose one confidential-client credential mechanism: a client assertion or a client secret, not both.
- Keep Microsoft's registered callback URL synchronized with any customized Better Auth route base path.
Example: Configure Microsoft sign-in
import { betterAuth } from "better-auth";
export const auth = betterAuth({
socialProviders: {
microsoft: {
clientId: process.env.MICROSOFT_CLIENT_ID!,
clientSecret: process.env.MICROSOFT_CLIENT_SECRET!,
tenantId: "common",
},
},
});Configure Microsoft as a social provider with the Entra application credentials, then use Better Auth's social sign-in client flow.
When to use it
Microsoft-based account registration
New users should be created during their first Microsoft authentication.
Assertion-based confidential clients
An Entra application uses private-key JWT or workload identity federation.
Interview questions
QHow do you configure Microsoft authentication?
The provider is configured under socialProviders.microsoft in the Better Auth configuration. It requires a Microsoft Entra client ID and, for confidential clients, either a client secret or a client assertion.
Follow-up: When should a client assertion be used? Use it instead of a client secret for applications configured with private_key_jwt or workload identity federation.
QWhat redirect URI should be registered?
The local callback URL is /api/auth/callback/microsoft beneath the application's local origin. Production deployments should register the equivalent callback under the production application URL.
Follow-up: What must change if the authentication route base path changes? The registered Microsoft redirect URL must be changed to match the new callback path.
QHow does a client initiate Microsoft sign-in?
The client starts Microsoft login through Better Auth's signIn.social function, passing an object whose provider value is microsoft. This selects the built-in Microsoft social provider.
Follow-up: What value identifies the provider in the sign-in request? Use the literal provider name microsoft.
Related
socialProviderssignIn.socialtenantIdauthoritypromptclientAssertionclientSecret