Sign in with Microsoft

Your app can let people sign in with a Microsoft account — the one they use for Outlook.com and Xbox, or the work account their company gives them for Microsoft 365. It takes about ten minutes, and it is a one-time setup apart from renewing the secret.

Like Sign in with Google, it is an exchange between two places: Microsoft needs to know which app is asking and where to send people back to; Sapilon needs the values Microsoft gives you in return.

Turn it on, and choose who signs in

Open Explorer → Authentication, choose the Microsoft tab and tick Sign in with Microsoft. Then pick who the button is for:

• Personal accounts — anyone with an Outlook.com, Hotmail, Live, Xbox or other personal Microsoft account.
• One organization — only people with a work or school account in one organization’s Microsoft 365: yours, or a customer’s.

It has to be one or the other. Your app’s sign-in service trusts one Microsoft directory at a time, so “any work account from any company” is not something it can offer.

The redirect URI to paste into Microsoft is shown underneath. If it is not shown yet, your project does not have a web address so far — publish to a server first, then come back. A Rehearsal Server of its own signs people in at its own address, so its redirect URI is listed too, marked Rehearsal.

Set it up in Microsoft Entra

You need a Microsoft account that can register apps. For personal accounts any Microsoft account works; for an organization, use an account in that organization (its IT department may have to do this part, or give you the right).

1. Open App registrations in the Microsoft Entra admin center and choose New registration. The name you give it is what people see when they sign in, so use your app’s real name.
2. Under Supported account types, pick Personal Microsoft accounts only or Accounts in this organizational directory only, to match what you chose in Sapilon.
3. Under Redirect URI, choose Web and paste the redirect URI Sapilon showed you. Click Register. If Sapilon showed you more than one, add the rest under Authentication afterwards.
4. On the app’s Overview, copy the Application (client) ID. For an organization, copy the Directory (tenant) ID too.
5. Under Certificates & secrets, choose New client secret. Copy its Value — not the Secret ID beside it. Microsoft shows the value only once.

Paste them back into Sapilon

Back on the Authentication page, paste the Application (client) ID, the Directory (tenant) ID if you chose one organization, and the Client secret value, then click Save.

The client secret is stored encrypted and is never shown again. Replace stores new values; Remove deletes them all.

Renew the secret before it expires

Microsoft client secrets expire — after six months by default, and two years at most. When the secret expires, the Microsoft button stops working. Note the date when you create it; before then, create a new secret in Entra, use Replace on the Authentication page, and publish.

Publish

Nothing changes on your live app until you publish. The Microsoft button is added to your sign-in screen as part of publishing. If Sign in with Microsoft is on but its values are missing, publishing stops and tells you so.

Pressing Apply on the Authentication page only saves the setting. The Publish page then lists it under What’s new for each server that doesn’t have it yet, and lets you publish even if nothing else in your app changed. Publish to Rehearsal and Live separately.

Questions people ask

Do I need a separate setup for the Rehearsal and Live servers? No. One app registration covers both — add the redirect URI marked Rehearsal to it as well.

Someone signed in with Microsoft — which group are they in? The default group you picked under Groups on the same page, exactly as if they had signed up with an email address.