feat: enable microsoft sign ups #20679

retrogtx · 2025-04-13T12:04:25Z

What does this PR do?

Enables Microsoft authentication for Cal.com, allowing users to sign up and log in using their Microsoft accounts (Azure AD). This builds upon #16873 by @hbjORbj.

The flow is exactly like google except for one case, in google we add google meet as a conferencing tool. however in microsoft we don't add a conferencing tool, mainly for two reasons: 1. it requires additional permissions unlike google meet 2. MS teams which is conferencing tool for microsoft is only available for school and org accounts unlike meet which is available for all accounts be it free or org.

Fixes #27060

Visual Demo:

signin.with.outlook.flow.mov

Key Changes

Authentication:

Azure AD OAuth provider via NextAuth
New IdentityProvider.AZUREAD enum value with database migration
xms_edov claim validation for email domain verification (handles work/school and personal accounts)
Proper identity provider mapping for azure-ad provider

UI:

"Continue with Microsoft" button on login and signup pages
Accessible Microsoft logo SVG with ARIA attributes

Profile Features:

Profile photo sync from Microsoft Graph API
Office 365 calendar auto-linking for org users during signup

Infrastructure:

New environment variables: OUTLOOK_LOGIN_ENABLED, OUTLOOK_API_CREDENTIALS, AZURE_AD_TENANT_ID
SSO route handling to map "microsoft" → signIn("azure-ad")
Onboarding E2E tests for AZUREAD

Environment Variables

OUTLOOK_LOGIN_ENABLED=false
OUTLOOK_API_CREDENTIALS=   # JSON credentials from Azure portal, the format is something like this {"web":{"client_id":"9b81......","client_secret":"wJT8Q~PH...."}}
AZURE_AD_TENANT_ID=        # Use "common" for multi-tenant

How to Test

Set up Azure AD app in Azure Portal
Configure redirect URI: {WEBAPP_URL}/api/auth/callback/azure-ad
Set environment variables and OUTLOOK_LOGIN_ENABLED=true
Verify the Microsoft button appears and OAuth flow works

-- Added by @sean-brydon

Enable microsoft SALM google etc

Figma: https://www.figma.com/design/wleA2SR6rn60EK7ORxAfMy/Cal.com-New-Features?node-id=12-61094&m=dev

vercel · 2025-04-13T12:04:30Z

@retrogtx is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

graphite-app · 2025-04-13T12:05:10Z

Graphite Automations

"Add consumer team as reviewer" took an action on this PR • (04/13/25)

1 reviewer was added to this PR based on Keith Williams's automation.

"Add community label" took an action on this PR • (04/13/25)

1 label was added to this PR based on Keith Williams's automation.

cubic-dev-ai

mrge found 16 issues across 16 files. View them in mrge.io

cubic-dev-ai · 2025-04-13T12:08:16Z

apps/web/public/microsoft-logo.svg

@@ -0,0 +1,6 @@
+<svg width="100" height="100" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg">


SVG lacks accessibility attributes (title and description) that would make it accessible to screen readers

cubic-dev-ai · 2025-04-13T12:08:16Z

apps/web/modules/signup-view.tsx

+                        {t("continue_with_google")}
+                      </Button>
+                    ) : null}
+                    {/* TODO replace true with isMicrosoftLoginEnabled */}


Hardcoded 'true' value instead of using the isMicrosoftLoginEnabled prop

cubic-dev-ai · 2025-04-13T12:08:17Z

apps/web/modules/signup-view.tsx

+                        {t("continue_with_google")}
+                      </Button>
+                    ) : null}
+                    {/* TODO replace true with isMicrosoftLoginEnabled */}


TODO comment left in production code

apps/web/lib/signup/getServerSideProps.tsx

apps/web/server/lib/auth/login/getServerSideProps.tsx

apps/web/modules/auth/login-view.tsx

packages/features/auth/lib/next-auth-options.ts

apps/web/playwright/login.oauth.e2e.ts

packages/features/auth/lib/outlook.ts

packages/features/auth/lib/next-auth-options.ts

…rg for outlook

Ryukemeister · 2026-01-22T06:26:25Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-01-22T06:26:30Z

@cubic-dev-ai review this PR

@Ryukemeister I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

3 issues found across 19 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/features/auth/lib/next-auth-options.ts">

<violation number="1" location="packages/features/auth/lib/next-auth-options.ts:998">
P1: Rule violated: **Avoid Logging Sensitive Information**

Logging the entire `user` object exposes PII (email) in error logs. Error-level logs are captured in production and could leak sensitive user information. Consider logging only non-PII identifiers or hashing the email for log correlation.</violation>

<violation number="2" location="packages/features/auth/lib/next-auth-options.ts:1250">
P1: Security: Missing SAML tenant validation when converting from GOOGLE to SAML. Other SAML conversions in this file validate that the SAML IdP has domain authority via `validateSamlAccountConversion()`. Without this check, any SAML provider could potentially hijack a Google-authenticated account.</violation>
</file>

<file name="apps/web/modules/auth/login-view.tsx">

<violation number="1" location="apps/web/modules/auth/login-view.tsx:44">
P3: Localize the Microsoft icon alt text instead of hardcoding English so it respects the app’s i18n requirements.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/features/auth/lib/next-auth-options.ts

apps/web/modules/auth/login-view.tsx

Ryukemeister · 2026-01-22T06:57:13Z

@cubic-dev-ai can you update the PR description?

cubic-dev-ai · 2026-01-22T06:58:14Z

I've reviewed the PR changes and prepared an updated description. Since I cannot directly modify the GitHub PR body, here's a comprehensive updated description you can copy to replace the current one:

What does this PR do?

Enables Microsoft authentication for Cal.com, allowing users to sign up and log in using their Microsoft accounts (Azure AD). This builds upon #16873 by @hbjORbj.

Key Changes

Authentication:

Azure AD OAuth provider via NextAuth
New IdentityProvider.AZUREAD enum value with database migration
xms_edov claim validation for email domain verification (handles work/school and personal accounts)
Proper identity provider mapping for azure-ad provider

UI:

"Continue with Microsoft" button on login and signup pages
Accessible Microsoft logo SVG with ARIA attributes

Profile Features:

Profile photo sync from Microsoft Graph API
Office 365 calendar auto-linking for org users during signup

Infrastructure:

New environment variables: OUTLOOK_LOGIN_ENABLED, OUTLOOK_API_CREDENTIALS, OUTLOOK_CLIENT_ID, OUTLOOK_CLIENT_SECRET, AZURE_AD_TENANT_ID
SSO route handling to map "microsoft" → signIn("azure-ad")
Onboarding E2E tests for AZUREAD

Environment Variables

OUTLOOK_LOGIN_ENABLED=false
OUTLOOK_API_CREDENTIALS=   # JSON credentials from Azure portal
OUTLOOK_CLIENT_ID=
OUTLOOK_CLIENT_SECRET=
AZURE_AD_TENANT_ID=        # Use "common" for multi-tenant

How to Test

Set up Azure AD app in Azure Portal
Configure redirect URI: {WEBAPP_URL}/api/auth/callback/azure-ad
Set environment variables and OUTLOOK_LOGIN_ENABLED=true
Verify the Microsoft button appears and OAuth flow works

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/features/auth/lib/next-auth-options.ts">

<violation number="1" location="packages/features/auth/lib/next-auth-options.ts:877">
P1: Rule violated: **Avoid Logging Sensitive Information**

Do not log the full `existingUser` object because it includes PII (email, name, etc.). Log only non-sensitive identifiers instead.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/features/auth/lib/next-auth-options.ts

Ryukemeister · 2026-01-22T08:06:21Z

packages/features/auth/lib/next-auth-options.ts

          orgRole = membership?.role;
        }

+        // Don't spread ...token here - it may contain large OAuth tokens (access_token, refresh_token, id_token)


this was causing outlook login to crash because of cookie overload

Ryukemeister · 2026-01-22T08:07:46Z

packages/features/auth/lib/next-auth-options.ts

            return `/auth/error?error=wrong-provider&provider=${existingUserWithEmail.identityProvider}`;
          } else if (
            existingUserWithEmail.identityProvider === IdentityProvider.GOOGLE &&
-            idP === IdentityProvider.SAML


cubic rightly pointed out this was a bug

hbjORbj

Putting to draft as it needs some design refinements discussed internally

retrogtx added 17 commits April 1, 2025 13:48

fix: trigger lingo.dev by removing duplicate value

755a5c0

Merge branch 'calcom:main' into main

2b8e944

Merge branch 'calcom:main' into main

eb090a1

Merge branch 'calcom:main' into main

7bfe71f

Merge branch 'calcom:main' into main

6b8b832

Merge branch 'calcom:main' into main

00942e6

Merge branch 'calcom:main' into main

d6dda16

Merge branch 'calcom:main' into main

0c43f23

Merge branch 'calcom:main' into main

5374610

Merge branch 'calcom:main' into main

c3e016d

Merge branch 'calcom:main' into main

3612d5a

Merge branch 'calcom:main' into main

1147eb4

Merge branch 'calcom:main' into main

e79dd41

Merge branch 'calcom:main' into main

f10db66

under progress

1f72789

wow this worked

34e439b

migrate schema

c64d20d

retrogtx requested a review from a team as a code owner April 13, 2025 12:04

github-actions bot added ❗️ migrations contains migration files ❗️ .env changes contains changes to env variables labels Apr 13, 2025

graphite-app bot added the community Created by Linear-GitHub Sync label Apr 13, 2025

graphite-app bot requested a review from a team April 13, 2025 12:04

keithwillcode added the community-interns The team responsible for reviewing, testing and shipping low/medium community PRs label Apr 13, 2025

dosubot bot added the authentication area: authentication, auth, google sign in, password, SAML, password reset, can't log in label Apr 13, 2025

cubic-dev-ai bot reviewed Apr 13, 2025

View reviewed changes

retrogtx added the ready-for-e2e label Apr 13, 2025

retrogtx added 2 commits April 13, 2025 20:18

fix types

7e47f53

fix import for google login

eb56070

pull-request-size bot added the size/XL label Jan 20, 2026

calcom-bot removed the devin-conflict-resolution label Jan 20, 2026

Ryukemeister and others added 8 commits January 20, 2026 12:13

Merge branch 'main' into microsoft-auth

d07977c

Merge branch 'main' into microsoft-auth

4b971f5

fixup

a154e46

Merge branch 'main' into microsoft-auth

574ffa5

chore: standardize naming

c01d689

chore: add primary calendar for outlook, verify email and auto link o…

d271a70

…rg for outlook

chore: helper fns

be51d44

Merge branch 'main' into microsoft-auth

948e761

Ryukemeister marked this pull request as ready for review January 22, 2026 06:26

cubic-dev-ai bot reviewed Jan 22, 2026

View reviewed changes

packages/features/auth/lib/next-auth-options.ts Outdated Show resolved Hide resolved

packages/features/auth/lib/next-auth-options.ts Show resolved Hide resolved

apps/web/modules/auth/login-view.tsx Outdated Show resolved Hide resolved

chore: implement cubic feedback

727c4e2

cubic-dev-ai bot reviewed Jan 22, 2026

View reviewed changes

packages/features/auth/lib/next-auth-options.ts Show resolved Hide resolved

Ryukemeister and others added 3 commits January 22, 2026 12:43

cleanup

ac8ad67

chore: implement cubic feedback again

6c09010

Merge branch 'main' into microsoft-auth

3cb4b11

Ryukemeister requested a review from hbjORbj January 22, 2026 07:58

Ryukemeister reviewed Jan 22, 2026

View reviewed changes

hbjORbj marked this pull request as draft January 22, 2026 10:43

hbjORbj requested changes Jan 22, 2026

View reviewed changes

sean-brydon added 2 commits January 22, 2026 12:31

WIP design#

6cee727

feat: login design

3db1388

pull-request-size bot added size/XXL and removed size/XL labels Jan 22, 2026

		@@ -0,0 +1,6 @@
		<svg width="100" height="100" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg">

feat: enable microsoft sign ups #20679

Are you sure you want to change the base?

feat: enable microsoft sign ups #20679

Uh oh!

Conversation

retrogtx commented Apr 13, 2025 • edited by CarinaWolli Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Visual Demo:

Key Changes

Environment Variables

How to Test

Uh oh!

vercel bot commented Apr 13, 2025

Uh oh!

graphite-app bot commented Apr 13, 2025

Graphite Automations

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Apr 13, 2025

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Apr 13, 2025

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Apr 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ryukemeister commented Jan 22, 2026

Uh oh!

cubic-dev-ai bot commented Jan 22, 2026

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ryukemeister commented Jan 22, 2026

Uh oh!

cubic-dev-ai bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Key Changes

Environment Variables

How to Test

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Ryukemeister Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Ryukemeister Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hbjORbj left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

retrogtx commented Apr 13, 2025 •

edited by CarinaWolli

Loading

cubic-dev-ai bot commented Jan 22, 2026 •

edited

Loading

Ryukemeister Jan 22, 2026 •

edited

Loading