How do I let users log in with Microsoft in a B2B app?

To let users log in with Microsoft in a B2B app, you typically use Microsoft Entra ID (Azure AD) sign-in with OpenID Connect/OAuth 2.0.

The common setup

1) Register your app in Microsoft Entra ID

In the Azure portal / Entra admin center:

• Go to Microsoft Entra ID → App registrations → New registration
• Choose who can sign in:
  • Single tenant: only users in your organization
  • Multitenant: users from any Microsoft 365/Entra tenant can sign in
  • Accounts in any org directory and personal Microsoft accounts if you also want consumer Microsoft accounts
• Add a redirect URI for your app (web/mobile/SPA as appropriate)

2) Use OpenID Connect sign-in

Your app should send users to Microsoft’s authorization endpoint, then handle the callback and exchange the code for tokens.

Typical auth flow:

1. User clicks “Sign in with Microsoft”
2. Redirect to Microsoft login
3. User authenticates and consents
4. Microsoft redirects back to your app with an auth code
5. Your app exchanges the code for:
   • ID token (who the user is)
   • Access token (to call APIs, if needed)
   • Refresh token (if applicable)

3) Decide how B2B users will be allowed

For B2B, you usually want one of these models:

• Invite-only
  • You invite external users into your tenant as guests
  • They sign in with their home Microsoft account
• Open to any tenant
  • Any organization user can sign in
  • You verify and authorize them in your app after login
• Federated / external IdP
  • If some customers use Microsoft Entra and others use different IdPs, you can support multiple identity providers

4) Validate and map users in your app

After login, use claims from the token such as:

• tid = tenant ID
• oid = object ID of the user
• email / preferred_username
• name

Then:

• Check whether the tenant is allowed
• Check whether the user exists in your app’s user database
• Assign roles/permissions
• Optionally require admin approval for first-time users

---

If you want customers from other companies to log in

Use multitenant app registration and authorization checks in your app.

Important:

• Authentication confirms identity
• Your app still must enforce authorization
• You may want to restrict by:
  • tenant ID allowlist
  • email domain
  • invitation token
  • admin approval workflow

---

If you want external users invited into your tenant

Use Entra ID B2B guest users.

Flow:

• Invite user to your tenant
• They accept via email
• They authenticate with their own Microsoft account or work account
• Your app treats them like external collaborators with guest access

---

Recommended libraries

Use Microsoft’s libraries for easier implementation:

• ASP.NET / .NET: Microsoft.Identity.Web
• Node.js: MSAL (@azure/msal-node or @azure/msal-browser)
• Python/Flask/Django: MSAL Python
• React/SPA: @azure/msal-browser + @azure/msal-react
• Mobile: MSAL for iOS/Android

---

High-level example

If you’re building a web app:

• Register the app in Entra ID
• Configure redirect URI: https://yourapp.com/auth/callback
• Use OIDC sign-in with the Microsoft identity platform
• On callback:
  • validate the token
  • get tenant/user identifiers
  • create or update a local user record
  • authorize based on tenant/domain/role

---

Security tips

• Use Authorization Code Flow with PKCE for public clients/SPAs
• Validate:
  • issuer
  • audience
  • signature
  • nonce/state
• Don’t trust email alone for authorization
• Prefer oid + tid as the stable user identifier
• Use HTTPS everywhere

---

If you tell me your stack (React, Next.js, ASP.NET, Node, Django, mobile, etc.), I can give you a concrete step-by-step implementation.