Sign in with Microsoft
Engineers sign in with their own work account. Microsoft handles the password, MFA and Conditional Access; Rollout never sees a password. For this you create one app registration in your own Entra and link it to Supabase.
Scroll here or press play.
App registration "Rollout – Login"
- New registration
Entra → App registrations → New registration
- Name:
Rollout – Login - Supported account types: Accounts in this organizational directory only
- Redirect URI (Web):
https://<project-ref>.supabase.co/auth/v1/callback
The
<project-ref>is the part before.supabase.coin your Project URL. - Name:
- Create a client secret
Certificates & secrets → New client secret. Copy the Value (not the ID): you only see it once. This secret only goes to Supabase, nowhere else.
- Send the email address along
Token configuration → Add optional claim → ID →
email. If you later get a message about a missing or unverified email address, also addxms_edov. - Only let your engineers in (important)
Entra → Enterprise applications → Rollout – Login → Properties → Assignment required: Yes. Then under Users and groups, assign only the group with your engineers.
Without this step anyone in your tenant can sign in, including reception or an intern. They won't see any data, but it's an unnecessary door.
- Recommended: Conditional Access
Create a policy for this app: MFA required, managed devices only, and no sign-in from countries you don't work in.
Note the Application (client) ID and the Directory (tenant) ID.
Link it in Supabase
Authentication → Sign In / Providers → Azure:
| Field | Value |
|---|---|
| Application (client) ID | the application ID |
| Secret value | the value of the client secret |
| Azure Tenant URL | https://login.microsoftonline.com/<directory-id> |
Empty means: any Microsoft account in the world may sign in. With your own directory ID, only accounts from your tenant get in.
Authentication → URL Configuration: you fill this in at step 6, once your address is fixed. For local testing you can already add http://localhost:3000/auth/callback to the Redirect URLs.
Check
After step 4 (the app is online) check:
- Signing in with an account outside your tenant fails
- Signing in with an account in your tenant that is not assigned fails
- The first account (the address from
bootstrap_admin_email) can create the organization - A second account only sees Invitation code on first sign-in, not New organization