Connecting Microsoft sign-in to freedam lets your team authenticate with the account they already use for Microsoft 365 — one less password to manage, one less credential to revoke when someone leaves. For organizations standardized on Entra ID (formerly Azure AD), it makes freedam feel like part of the existing identity setup rather than another island.

What it does

Microsoft is one of the single sign-on providers built into freedam, alongside Google. When an administrator enables it for a workspace, the login screen offers Sign in with Microsoft; clicking it runs the user through Microsoft's OAuth consent flow and returns them to freedam, authenticated. Users can view and manage the link between their freedam account and their Microsoft identity from their own account settings.

How it works

freedam uses the standard OAuth authorization-code flow (via Laravel Socialite) against Microsoft's common endpoint, so accounts from any Entra ID tenant can authenticate — which organization's users may actually join your workspace is governed by freedam's own rules, not by pinning a single Azure tenant.

The requested scopes are openid, email, and profile — identity only. freedam gets no access to mail, files, Teams, or anything else in the Microsoft account.

Two provider-specific details:

• Domain hint. When the workspace is configured with exactly one allowed email domain, freedam passes Microsoft's domain_hint parameter in the authorization request, so users are steered straight to the right organizational login instead of the generic account picker.
• Verified email. Microsoft does not expose an explicit email-verified claim the way Google does. Entra ID only issues an email claim for addresses it controls or has verified for the tenant — so freedam treats the presence of the email claim as the verification signal, and an identity without one is not accepted.

For self-hosted deployments, the operator registers an app in the Microsoft identity platform and supplies its credentials via environment variables: MICROSOFT_OAUTH_CLIENT_ID and MICROSOFT_OAUTH_CLIENT_SECRET, with the callback path /auth/microsoft/callback (on your instance's domain) registered as the redirect URI. Once the credentials are configured, workspace admins can switch the provider on.

Good to know

• Multi-tenant by default. Because the integration targets the common endpoint, it works whether your organization has one Entra tenant or several — freedam's workspace rules decide who gets in.
• Scopes are minimal — no offline access is requested, and no Microsoft Graph data scopes.
• Providers are independent. Microsoft and Google sign-in are enabled per workspace, separately; offer either or both.
• Self-hosted setups use their own app registration. The client ID and secret belong to your organization's Entra tenant — authentication is never proxied through a third party.

API access for scripts and integrations uses token authentication rather than browser SSO — see /developers. Rolling this out on a self-hosted instance? Get in touch if you want to talk through the setup.