This will enable you to log in using any Azure AD directory - Multi-tenant and personal Microsoft accounts (for example Skype, Xbox) depending on the settings made when creating the application in Azure AD.
Creating an Application in Azure AD
To set up "Sign in with Microsoft" you must first register an application with the Microsoft identity platform.
Select "Web" as the "Redirect URI" type, and set the URI to:
After the "App Registration" is created, make note of the
Application ID and
Directory ID on top of the Overview page. To
create the client secret, navigate to "Certificates & secrets" and click "+ New client secret". Remember to copy the secret value
as it will only be shown once.
Create a Jsonnet claims mapper as described in
Save the code in
local claims = std.extVar('claims');
// Allowing unverified email addresses enables account
// enumeration attacks, if the value is used for
// verification or as a password login identifier.
// If connecting only to your organization (one tenant), claims.email is safe to use if you haven't actively disabled e-mail verification during Sign-Up.
// The email might be empty if the account isn't linked to an email address.
// For a human readable identifier, consider using the "preferred_username" claim.
[if "email" in claims then "email" else null]: claims.email,
Enable the Microsoft provider in the Ory Kratos config located at
- id: microsoft # this is `<provider-id>` in the Authorization callback URL. DO NOT CHANGE IT ONCE SET!
client_id: .... # Replace this with the Application ID from the App Registration
client_secret: .... # Replace this with the generated Secret value from the App Registration
microsoft_tenant: .... # Replace this with the Tenant of your choice (see below)
subject_source: userinfo # or alternatively: me
Azure AD is now an option to log in to Ory Kratos.
When running a self-hosted instance, you can pass the social sign-in provider configuration in the
SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS environment variable. For example:
There are two ways to use the
microsoft provider for authentication:
- For authenticating users in a single Azure AD Directory (organization), set the
tenantvalue to either the
Directory IDfrom the "App Registration" page, or the organization domain. Examples:
- For authenticating any user in the Microsoft identity platform, set the
tenantvalue to either:
organizationsto allow users with work or school accounts, or
consumersto allow users with personal accounts, or
commonto allow both kind of accounts.
Choosing source of subject identifier
By default, the microsoft provider will rely on identifier taken from the
sub field of OIDC ID token. The same identifier is
also returned by standard OIDC
But there are systems out there that use
id field returned by
https://graph.microsoft.com/v1.0/me endpoint as a subject
identifier. To make migrating such systems to Kratos easier the microsoft provider allows using
id as an
identifier. Set the provider config
subject_source field to
me to activate this feature.
Prevent Having to Login after Sign-Up
When adding social sign-in providers manually, remember to add the
session hook to
after/oidc/hooks. If you don't add this
hook, users will have to login again after signing up to get a session.
- hook: session