providers/microsoft-entra-id

Built-in Microsoft Entra ID integration.

MicrosoftEntraIDProfile

Extends

• Record<string, any>

Properties

email

email: string;

nickname

nickname: string;

picture

picture: string;

sub

sub: string;

MicrosoftEntraIDOptions<P>

type MicrosoftEntraIDOptions<P>: OAuthUserConfig<P> & {
  profilePhotoSize:   | 48
     | 64
     | 96
     | 120
     | 240
     | 360
     | 432
     | 504
     | 648;
  tenantId: string;
};

Type declaration

profilePhotoSize?

optional profilePhotoSize: 
  | 48
  | 64
  | 96
  | 120
  | 240
  | 360
  | 432
  | 504
  | 648;

https://learn.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0&tabs=http#examples

Default

48

tenantId?

optional tenantId: string;

Default

"common"

Type parameters

default()

default<P>(options): OAuthConfig<P>

Add Microsoft Entra ID login to your page.

Setup

Callback URL

https://example.com/api/auth/callback/microsoft-entra-id

Configuration

import { Auth } from "@auth/core"
import MicrosoftEntraID from "@auth/core/providers/microsoft-entra-id"
 
const request = new Request(origin)
const response = await Auth(request, {
  providers: [
    MicrosoftEntraID({
      clientId: AUTH_MICROSOFT_ENTRA_ID_ID,
      clientSecret: AUTH_MICROSOFT_ENTRA_ID_SECRET,
    }),
  ],
})

Resources

• Microsoft Entra OAuth documentation
• Microsoft Entra OAuth apps

Type parameters

Parameters

Returns

OAuthConfig<P>

Example

To allow specific Active Directory users access:

• In https://entra.microsoft.com/ select Identity from the left bar menu.
• Next, go to “App Registration” in the left menu, and create a new one.
• Pay close attention to “Who can use this application or access this API?”
  • This allows you to scope access to specific types of user accounts
  • Only your tenant, all Microsoft tenants, or all Microsoft tenants and public Microsoft accounts (Skype, Xbox, Outlook.com, etc.)
• When asked for a redirection URL, use https://yourapplication.com/api/auth/callback/microsoft-entra-id or for development http://localhost:3000/api/auth/callback/microsoft-entra-id.
• After your App Registration is created, under “Client Credential” create your Client secret.
• Now copy your:
  • Application (client) ID
  • Directory (tenant) ID
  • Client secret (value)

In .env.local create the following entries:

AUTH_MICROSOFT_ENTRA_ID_ID=<copy Application (client) ID here>
AUTH_MICROSOFT_ENTRA_ID_SECRET=<copy generated client secret value here>
AUTH_MICROSOFT_ENTRA_ID_TENANT_ID=<copy the tenant id here>

That will default the tenant to use the common authorization endpoint. For more details see here.

In auth.ts find or add the Entra entries:

import MicrosoftEntraID from "@auth/core/providers/microsoft-entra-id"
 
providers: [
  MicrosoftEntraID({
    clientId: process.env.AUTH_MICROSOFT_ENTRA_ID_ID,
    clientSecret: process.env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
    tenantId: process.env.AUTH_MICROSOFT_ENTRA_ID_TENANT_ID,
  }),
]

Notes

By default, Auth.js assumes that the MicrosoftEntra provider is based on the OAuth 2 specification.