Aeion Auth + Microsoft (Entra ID) — Workforce SSO
Integrate Microsoft Entra ID (formerly Azure AD) for sign-in. Aeion's `microsoft` OAuth provider hits the `login.microsoftonline.com` `common` endpoint with PKCE; works for personal MSAs (outlook.com, hotmail.com, live.com) and Entra work / school accounts. Register your Azure app as single-tenant to lock the integration to your corporate workforce.
When This Integration Matters
Microsoft Entra ID is the IdP for ~80% of Fortune 500 companies — if your customers are buying enterprise software, half their workforce already lives in Entra.
Step 1 — Azure Portal App Registration
- Open portal.azure.com → search Microsoft Entra ID → App registrations → New registration
Step 2 — Aeion Auth Config
```bash
Token Flow Specifics
Microsoft's OAuth 2.0 + OIDC flow has a few quirks worth knowing.
Common Gotchas
- "AADSTS50194: Application is not configured as a multi-tenant application" — your app registration is single-tenant but a user from a different Entra tenant is trying to sign in. Reconfigure the app registration to multitenant in Azure Portal — Aeion itself doesn't have a tenant-restriction setting to fall back on.
FAQ
Not via configuration today — Aeion always authorizes against the `common` endpoint. Enforce tenant restriction in your own application logic if you need it (e.g., checking the user's email domain post-sign-in).
Microsoft renamed Azure AD to Entra ID in 2023. Same product, new name. All endpoints + APIs continue to work with the legacy `login.microsoftonline.com` host.
No — Aeion uses the standard client-secret token exchange (`client_secret` in the POST body) for all providers, including Microsoft.
Not via configuration today — Aeion requests the fixed default scope set (`openid`, `email`, `profile`, `User.Read`) and doesn't currently expose a way to add extra Graph delegated scopes per deployment.
Supported — the `common` endpoint Aeion always uses accepts both work/school and personal Microsoft accounts.