Set up Sign in with Microsoft

A Continue with Microsoft button on the sign-in and sign-up pages, for people whose organization doesn’t use SAML single sign-on. It is set up once for the whole wrkflow deployment by whoever runs it, not per organization. Until it is set up, the button doesn’t show.

Set up

1. 1In the Microsoft Entra admin center, open App registrations and choose New registration. Name it wrkflow, choose the account types (any organizational directory for many companies, or this directory only for one), and set the redirect URI, platform Web, to your authentication service’s callback: https://<project-ref>.supabase.co/auth/v1/callback.
2. 2Under Certificates & secrets, create a client secret and copy its Value, not its ID. Note its expiry: sign-in stops for everyone when it expires.
3. 3Under Token configuration, add optional claims for the ID token: email and xms_edov. The email claim is required, and xms_edov says whether the address is verified, which decides whether the sign-in can link to an existing wrkflow account.
4. 4In Supabase, open Authentication, Providers, Azure. Enable it and paste the application (client) ID, the secret value and the tenant URL: https://login.microsoftonline.com/<tenant-id> to restrict it to one company, or https://login.microsoftonline.com/organizations for any work or school account. Leaving it empty also admits personal Microsoft accounts.
5. 5Save. The Continue with Microsoft button appears within a minute, with no redeploy. (If your deployment sets NEXT_PUBLIC_AUTH_PROVIDERS to choose which buttons show, add azure to it.)

wrkflow asks for the email scope. Microsoft sends the person’s email, whether it is verified, and their name when they sign in. Nothing about surveys or responses is involved.

If something goes wrong

• The button doesn’t appear: the Azure provider is switched off in the authentication service, or NEXT_PUBLIC_AUTH_PROVIDERS is set without azure in it.
• Sign-in stopped working for everyone: the client secret expired. Create a new one in Entra ID and update the authentication service.

Organizations that want to require sign-in through their own identity provider use Single sign-on and verified domains instead. See Integrations for the statuses and how to ask support.