Microsoft

Members sign in with a Microsoft account — personal, work or school, depending on how you register the app. Sign-in happens in the system browser.

Before you start

Console	Azure portal, App registrations
Endpoint group	Social Login
Email	Returned, but not verified — cannot match an existing account
Signs in	In the browser

Create the app registration

1. Open App registrations in the Azure portal and choose New registration.

2. Name it with something your members will recognise on the consent screen.

3. Choose who can sign in. This is the decision that matters:

   • Accounts in any organizational directory and personal Microsoft accounts is what most communities want. Leave the tenant field in Memberside empty.
   • Accounts in this organizational directory only limits sign-in to your organization. You will need the Directory (tenant) ID.

4. Set the Redirect URI, platform Web: the address from Memberside → API Keys → Social Login → Microsoft, which looks like https://yoursite.com/wp-json/memberside/v1/social/callback/microsoft.

5. Copy the Application (client) ID from the Overview page.

6. Create a client secret under Certificates & secrets → New client secret, and copy the Value — not the Secret ID.

7. Note the expiry you chose. Microsoft secrets expire, at most in two years. Sign-in stops on that date with no warning.

Scopes

The registration needs openid, profile, email and User.Read, which are delegated permissions granted without an administrator’s approval. Memberside asks for exactly those.

Some guides suggest adding Contacts.Read. Do not — it forces administrator consent in many tenants, and sign-in then fails for every member whose organization has not approved it.

Why the email cannot match an existing account

Microsoft does not assert that the address is verified

The response carries an address but no verification claim. Memberside therefore refuses to attach a Microsoft sign-in to an existing account by matching that address, because anyone able to register the address at any tenant could otherwise claim the account.

A member who already has an account on your site should sign in first, then link Microsoft from Social Connects.

New members can still register through Microsoft. It is only the matching of an address to an account that already exists which is refused.

What to paste into Memberside

Under Memberside → API Keys → Social Login → Microsoft:

Field	Value	Required
Client ID	The Application (client) ID	Yes
Client secret	The client secret Value	Yes
Directory (tenant) ID	Only for a single-organization registration	No

Leave the tenant field empty for a multi-tenant app; sign-in then goes to Microsoft’s shared endpoint, which is what lets personal accounts through.

When it does not work

Symptom	Cause	Fix
Sign-in stopped working on a specific date	The client secret expired	Create a new one and paste it
“The client secret is invalid”	The Secret ID was pasted instead of the Value	Copy the Value column
Personal accounts are refused	The registration is single-tenant	Re-register for any directory and personal accounts, or accept the limit
“Need admin approval”	A scope beyond sign-in was added	Remove it
A second account is created for an existing member	Microsoft’s email is unverified, so matching is refused	Have them sign in first, then link