Provider strategy

vestibule_microsoft

Microsoft OAuth strategy using Microsoft Graph /me, with helpers for tenant-specific sign-in.

When to use it

Use Microsoft when users authenticate with Microsoft personal, work, or school accounts.

Default scopes: openid User.Read

Install

Until 1.0, install Vestibule packages from GitHub using the movingvestibule-v0.0 tag. This requires Gleam 1.18 or later because companion packages use git path dependencies.

[dependencies]
vestibule_microsoft = { git = "https://github.com/tylerbutler/vestibule.git", ref = "vestibule-v0.0", path = "packages/vestibule_microsoft" }

Setup

Create a Microsoft Entra ID app registration.
Choose supported account types that match your tenant behavior.
Add Web redirect URIs for development and production.
Copy the Application client ID and client secret value.

Usage

import vestibule/config
import vestibule_microsoft

let strategy = vestibule_microsoft.strategy()

let tenant_strategy =
  vestibule_microsoft.strategy_for_tenant(
    "72f988bf-86f1-41af-91ab-2d7cd011db47",
  )

let cfg =
  config.new(
    client_id: "microsoft-client-id",
    redirect_uri: "http://localhost:8000/auth/microsoft/callback",
    auth: config.ClientSecret("microsoft-client-secret"),
  )

What Vestibule handles

The default strategy uses /common and performs no tenant validation.
strategy_for_tenant targets tenant-specific endpoints.
Tenant validation checks the tid claim in the returned ID token.
userPrincipalName is exposed as nickname, not verified email.

What you handle

Pass the tenant GUID, not a verified domain, when restricting to one tenant.
Microsoft Graph /me does not include profile photos; fetch photos separately if needed.