Set up "Sign in with Microsoft"

This is the full version of the wizard in the dashboard. It takes about ten minutes, and costs nothing. You'll copy an application ID and a client secret into JSONPad, and one URL from JSONPad into Microsoft.

If you haven't read it yet, signing in with Google, GitHub and others explains how the whole flow works.

1. Register an app

1. Open the Microsoft Entra admin center and go to App registrations → New registration. (The same pages appear in the Azure portal, under Microsoft Entra ID.)
2. Give the app a name. People see it on the sign-in screen.
3. Choose who can sign in under Supported account types:
   • Accounts in any organizational directory and personal Microsoft accounts is the usual choice for a consumer app, and matches the common tenant.
   • Accounts in this organizational directory only limits sign-ins to your own organization. Put your tenant ID or domain in the Tenant field in JSONPad as well.
4. Under Redirect URI, choose Web and paste the URL from the next step, then click Register.

2. Which redirect URIs to add

Straight back to your app is the default for Microsoft: it allows several Web redirect URIs, including http://localhost with any port, so each of your environments can have its own.

If you pick through JSONPad instead, register this one URL and nothing else:

https://api.jsonpad.io/identities/oauth/callback

3. Create a client secret

1. Copy the Application (client) ID from the app's overview page.
2. Go to Certificates & secrets → New client secret, choose an expiry, and add it.
3. Copy the secret's Value immediately — not the Secret ID. The value is only shown once.

4. Paste the credentials into JSONPad

1. Open your identity group in the dashboard, find Microsoft under Sign-in providers, and click Set up.
2. Choose the callback mode, and add your app's return pages.
3. Paste the application ID and secret. Leave Tenant empty unless you're limiting sign-ins to one organization.
4. Run a test sign-in, then turn Microsoft on with Enable.

5. Email addresses

JSONPad never trusts a Microsoft email address. An administrator can set any address on an account in their own tenant, including someone else's, so treating it as proof would let them take over an identity with that address. (This is the "nOAuth" problem.)

Identities created by signing in with Microsoft have no email address until they add one, and JSONPad matches accounts by Microsoft's own account id instead. If your identity group requires an email address, ask for one in your app.

Troubleshooting