微软认证

[Discourse]

Hosted by us? This plugin is available on our Business and Enterprise plans. Amazon & Microsoft Logins | Discourse - Civilized Discussion

	Summary	Enable users to log in using their Microsoft accounts (aka Office 365 or Microsoft 365 accounts)
	Install Guide	This plugin is bundled with Discourse core. There is no need to install the plugin separately.

As this is an official plugin maintained by the Discourse team, Support, Bug, UX, and Feature requests can be made in the respective categories here on Meta, and tagged with the appropriate plugin tag. Click on a link below to get one started.

 Support  Bug  UX  Feature

Summary

Microsoft Authentication enables users to log in to your Discourse forum using their Microsoft accounts (also known as Office 365 or Microsoft 365 accounts). This simplifies the login process for organizations that use Microsoft services.

Features

• Allows users to log in with their Microsoft credentials
• Supports both multi-tenant and single-tenant configurations
• Integrates with Microsoft Azure Active Directory
• Simplifies user registration and login

Configuration

To set up Microsoft Authentication for your Discourse forum:

1. Visit Azure Portal’s App Registration page

2. Register a new application:

   • Choose a name (typically your site name)
   • Under “Supported account types,” select the most permissive option for your needs
   

3. Add your site as a Redirect URI for Web in this format:

   • https://your.discourse.forum/auth/microsoft_office365/callback
   

4. Save your changes

5. Visit Certificates & secrets in the left sidebar menu and click New client secret

   • Add a simple description
   • Choose 24 months under “Expires” (note: you’ll need to renew it)
   • Copy the Value (this is the Application Secret) and save it for your plugin settings

6. Visit Overview (in the left sidebar) and copy the Application (client ID)

7. In your Discourse admin area, go to Settings and search for “microsoft auth”

8. Enter the Application ID and Secret from the previous steps

Single-tenant authentication issues

If you’ve configured your Microsoft application as single_tenant, some users may experience issues when logging in. This happens because the emails used for login are considered untrusted, and the system cannot automatically link them to existing Discourse accounts.

To resolve this issue, users can:

1. Look for the “Already have an account?” section at the bottom of the signup form
2. Click the provided link to go through the account link-up process
3. Complete the authentication steps to connect their Microsoft account to their existing Discourse account

Another option is to enable the microsoft auth email verified site setting, if admins are confident that all your users have verified emails.This ensures that returning users with existing accounts don’t create duplicate accounts when authenticating through Microsoft.

Additional configuration options

You can update all Microsoft Authentication settings by visiting the Admin > Settings area and searching for “microsoft auth”.

For single-tenant setups, you’ll need your tenant ID, which you can find in the Azure Portal tenant properties.

Additional resources

• Potential account take over due to unverified emails from Microsoft Identity Platform · Advisory · discourse/discourse-microsoft-auth · GitHub

Last edited by @tobiaseigen 2025-07-16T21:37:09Z

Check document

Perform check on document:

[시온_강]

I'm trying to use microsoft oauth, but I'm having a problem

Since I am trying to build a discourse for internal use, I chose this organizational directory only. However, the article Microsoft Authentication talks about setting up multi-tenant. [image] An error page is displayed as above. Could the Supported account types setting be the problem? I currently don’t have an MPN ID, so I can’t try setting up multi-tenant.

我正在尝试使用该插件，但遇到了问题。
您能给我一些建议吗？

[nathank (Nathan Kershaw)]

由于我在更新此插件的配置时（又一次）遇到了麻烦，因此我创建了这个 PR：

Improve documentation and setting description

问题在于，Microsoft 应用面板为“Secret”提供了三个看起来很像的字段——Client ID、Value 和 Secret ID。在没有指导的情况下，我在两次处理这个问题时都选择了错误的字段，并且怀疑我不是唯一一个遇到这种情况的人！

[moggleif (Morgan Johansson)]

我刚试了这个插件，它对单租户不起作用。

为什么？

lib/omniauth-microsoft365.rb

option :client_options,
             site: "https://login.microsoftonline.com",
             authorize_url: "/common/oauth2/v2.0/authorize",
             token_url: "/common/oauth2/v2.0/token"

“common”这个词是问题所在。
似乎需要将其替换为单租户的租户 ID。
如果您有 Microsoft 帐户，可以在此处找到您的租户 ID：Microsoft Azure

我还没有尝试自己进行更改。也许我会。
如果不行，任何考虑将其用于单租户的人，都不必尝试了，目前它将不起作用。

请参阅下面的附图，了解您将看到的错误类型。

[moggleif (Morgan Johansson)]

好的，我以前从没用过 Ruby 编码，而且我有多年的编码和处理技术事务的经验。但现在已经完成了。它现在也适用于单租户设置。

Making Single Tenant work for the Microsoft auth plugin.

[pmusaraj (Penar Musaraj)]

抱歉这么晚才回复，上面的 PR 现已合并！

[moggleif (Morgan Johansson)]

太棒了！

这是我第一次为社区做贡献。我想，也不会是最后一次。

[tobiaseigen]

此插件现已作为 Bundling more popular plugins with Discourse core 的一部分，随 Discourse 核心一起提供。如果您是自托管用户并使用了此插件，则需要在下次升级前将其从您的 app.yml 中移除。