Provider Documentation: Micosoft Entra ID

[Br4v3St4rr]

What is the improvement or update you wish to see?

Hi,

Documentation for the Entra ID provider in the Setup -> Configuration -> NextJS section seems incorrect:

import NextAuth from "next-auth"
import MicrosoftEntraID from "next-auth/providers/microsoft-entra-id"

const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    MicrosoftEntraID({
      clientId: process.env.AUTH_MICROSOFT_ENTRA_ID_ID,
      clientSecret: process.env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
      issuer: process.env.AUTH_MICROSOFT_ENTRA_ID_ISSUER,
    }),
  ],
})

Should read:

import NextAuth from "next-auth"
import MicrosoftEntraID from "next-auth/providers/microsoft-entra-id"

const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    MicrosoftEntraID({
      clientId: process.env.AUTH_MICROSOFT_ENTRA_ID_ID,
      clientSecret: process.env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
      issuer: `https://login.microsoftonline.com/${process.env.AUTH_MICROSOFT_ENTRA_ID_ISSUER}/v2.0`,
    }),
  ],
})

Is there any context that might help us understand?

From the below it looks like the provider is expecting a URL in the issuer field.

See https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/microsoft-entra-id.ts Line 108

config.issuer ??= "https://login.microsoftonline.com/common/v2.0"

Does the docs page already exist? Please link to it.

https://authjs.dev/getting-started/providers/microsoft-entra-id

[graemen16]

Thanks - I got an error about url format when I changed the Entra definition following update from beta 22 to beta 25. Changing to the url definition resolved the error.

[jenewland1999]

@Br4v3St4rr Thank you for your posting this. You just saved me many more hours of pain. The docs really need to be updated to specify that the issuer is not just the tenantId but the full url with the tenantId within it (or common if you're using not using a specific directory)

[benhovinga]

The issuer variable needs more documentation. Users coming from Azure Active Directory might assume this is the "Directory (tenant) ID".

Putting the Tenant ID here instead of a URL will give you this error when trying to sign-in

[auth][error] TypeError: Invalid URL

@Br4v3St4rr's solution to change the provider config and assign the URL to issuer there will work. Another solution is to put this URL in your environment variables like below. Same result, just a different way to implement it and doesn't require changing the provider config.

AUTH_MICROSOFT_ENTRA_ID_ID="<Application (client) ID>"
AUTH_MICROSOFT_ENTRA_ID_SECRET="<Client secret (value)>"
AUTH_MICROSOFT_ENTRA_ID_TENANT="<Directory (tenant) ID>"
AUTH_MICROSOFT_ENTRA_ID_ISSUER="https://login.microsoftonline.com/$AUTH_MICROSOFT_ENTRA_ID_TENANT/v2.0"

[rogeriocassares]

THAAAAAAAAAANKSSSS!

Please update de Docs!

[benhovinga]

I'm working on it

[rixrix]

hey team, encountered this issue as well. Please update the docs. thanks

it's in the docs now, but wondering if that could be put in some sort of a special "info" section. anyway thanks for opening this ticket

[benhovinga]

@rixrix a rewrite of the Entra ID docs is done (PR #12616). Just waiting for approval and merge.

[rixrix]

@rixrix a rewrite of the Entra ID docs is done (PR #12616). Just waiting for approval and merge.

nice one, thanks @benhovinga