feat: enable microsoft sign ups by retrogtx · Pull Request #20679 · calcom/cal.com

retrogtx · 2025-04-13T12:04:25Z

What does this PR do?

Enables Microsoft authentication for Cal.com, allowing users to sign up and log in using their Microsoft accounts (Azure AD). This builds upon #16873 by @hbjORbj.

The flow is exactly like google except for one case, in google we add google meet as a conferencing tool. however in microsoft we don't add a conferencing tool, mainly for two reasons: 1. it requires additional permissions unlike google meet 2. MS teams which is conferencing tool for microsoft is only available for school and org accounts unlike meet which is available for all accounts be it free or org.

Fixes #27060

Visual Demo:

Microsoft.login.with.onboarding.v3.mov

Key Changes

Authentication:

Azure AD OAuth provider via NextAuth
New IdentityProvider.AZUREAD enum value with database migration
xms_edov claim validation for email domain verification (handles work/school and personal accounts)
Proper identity provider mapping for azure-ad provider

UI:

"Continue with Microsoft" button on login and signup pages
Accessible Microsoft logo SVG with ARIA attributes

Profile Features:

Profile photo sync from Microsoft Graph API
Office 365 calendar auto-linking for org users during signup

Infrastructure:

New environment variables: OUTLOOK_LOGIN_ENABLED, OUTLOOK_API_CREDENTIALS, AZURE_AD_TENANT_ID
SSO route handling to map "microsoft" → signIn("azure-ad")
Onboarding E2E tests for AZUREAD

Environment Variables

OUTLOOK_LOGIN_ENABLED=false
OUTLOOK_API_CREDENTIALS=   # JSON credentials from Azure portal, the format is something like this {"web":{"client_id":"9b81......","client_secret":"wJT8Q~PH...."}}
AZURE_AD_TENANT_ID=        # Use "common" for multi-tenant

How to Test

Set up Azure AD app in Azure Portal
Configure redirect URI: {WEBAPP_URL}/api/auth/callback/azure-ad
Set environment variables and OUTLOOK_LOGIN_ENABLED=true
Verify the Microsoft button appears and OAuth flow works

vercel · 2025-04-13T12:04:30Z

@retrogtx is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

graphite-app · 2025-04-13T12:05:10Z

Graphite Automations

"Add consumer team as reviewer" took an action on this PR • (04/13/25)

1 reviewer was added to this PR based on Keith Williams's automation.

"Add community label" took an action on this PR • (04/13/25)

1 label was added to this PR based on Keith Williams's automation.

cubic-dev-ai

mrge found 16 issues across 16 files. View them in mrge.io

apps/web/public/microsoft-logo.svg

apps/web/modules/signup-view.tsx

apps/web/lib/signup/getServerSideProps.tsx

apps/web/server/lib/auth/login/getServerSideProps.tsx

apps/web/modules/auth/login-view.tsx

packages/features/auth/lib/next-auth-options.ts

apps/web/playwright/login.oauth.e2e.ts

packages/features/auth/lib/outlook.ts

packages/features/auth/lib/next-auth-options.ts

devin-ai-integration · 2026-02-17T09:32:16Z

Merge Conflict Resolution - Push Failed

I successfully resolved all merge conflicts between microsoft-auth and upstream/main:

Files resolved:

packages/lib/constants.ts - Merged new MICROSOFT_CALENDAR_SCOPES constant with upstream's formatting changes
apps/web/modules/signup-view.tsx - Merged Microsoft OAuth sign-up feature (Microsoft button, handleOAuthClick, isMicrosoftLoading state, isOutlookLoginEnabled prop) with upstream's accountUnderReview state, region selector, and UI restructuring

Validation passed: Merge commit shows exactly 23 files, matching the original PR file count.

However, I was unable to push the resolved merge to the fork. The DEVIN_ACTIONS_PAT does not have write access to retrogtx/cal.com. Multiple authentication methods were attempted (direct PAT, git-manager proxy, credential store, GIT_ASKPASS) - all returned authentication failures.

The PR author (@retrogtx) will need to resolve the conflicts manually or grant push access to the fork.

github-actions · 2026-02-18T08:27:03Z

Devin AI is resolving merge conflicts

This PR has merge conflicts with the main branch. A Devin session has been created to automatically resolve them.

View Devin Session

Devin will:

Merge the latest main into this branch
Resolve any conflicts intelligently
Run lint/type checks to ensure validity
Push the resolved changes

If you prefer to resolve conflicts manually, you can close the Devin session and handle it yourself.

devin-ai-integration · 2026-02-18T08:48:05Z

Merge Conflict Resolution Attempted

I successfully resolved the merge conflicts between the microsoft-auth branch and upstream main, but was unable to push the resolved changes to the fork repository (retrogtx/cal.com).

What was done:

Merged upstream/main into the microsoft-auth branch
Resolved conflicts in 2 files:
- packages/lib/constants.ts - Kept the PR's MICROSOFT_CALENDAR_SCOPES addition with upstream's formatting changes
- apps/web/modules/signup-view.tsx - Integrated the PR's Microsoft auth additions (isOutlookLoginEnabled, isMicrosoftLoading, handleOAuthClick, Microsoft button) with upstream's structural changes (accountUnderReview feature, data region selector, ShieldCheckIcon components)
Validation passed: merge commit shows exactly 23 files (matching the original PR)
Type check passed (tsc --noEmit for apps/web)
Lint check passed (no errors, only pre-existing warnings)

Why push failed:

Authentication failed when attempting to push to the fork repository retrogtx/cal.com. The available credentials do not have write access to this fork.

For the PR author (@retrogtx):

To resolve the conflicts yourself, you can run:

git fetch upstream main
git merge upstream/main

The two conflicts to resolve are:

packages/lib/constants.ts: Keep your MICROSOFT_CALENDAR_SCOPES and use upstream's single-line formatting for DIRECTORY_IDS_TO_LOG and SCANNING_WORKFLOW_STEPS
apps/web/modules/signup-view.tsx: The upstream added accountUnderReview state/UI, data region selector, and changed icons to use named components from @coss/ui/icons. Your Microsoft auth additions need to be integrated into this new structure.

cubic-dev-ai

2 issues found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/web/modules/signup-view.tsx">

<violation number="1">
P3: Use the centralized WEBAPP_URL constant instead of reading process.env.NEXT_PUBLIC_WEBAPP_URL directly so protocol normalization/fallbacks remain consistent.</violation>

<violation number="2">
P2: Microsoft signup entrypoint was removed from the signup UI. The component no longer accepts `isOutlookLoginEnabled` and only renders a Google OAuth button, so users have no way to start a Microsoft/Azure AD signup from this view.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

apps/web/modules/signup-view.tsx

cubic-dev-ai

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/web/modules/signup-view.tsx">

<violation number="1" location="apps/web/modules/signup-view.tsx:844">
P2: `searchQueryParams.set("email", prepopulateFormValues?.email)` can serialize to `email=undefined` when `token` is present but `prepopulateFormValues` is null, causing a bad login hint in the Microsoft SSO URL. Guard on a defined email before setting the param.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

apps/web/modules/signup-view.tsx

github-actions · 2026-02-19T08:49:04Z

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session

hbjORbj · 2026-02-19T19:00:05Z

packages/features/auth/lib/next-auth-options.ts

+      clientId: OUTLOOK_CLIENT_ID!,
+      clientSecret: OUTLOOK_CLIENT_SECRET!,
+      tenantId: process.env.AZURE_AD_TENANT_ID,
+      allowDangerousEmailAccountLinking: true,


is this ok? @Ryukemeister

i'm working on cleaning this up, but yes this is not okay

if you're talking about allowDangerousEmailAccountLinking: true then that is alright because we follow the same approach for GoogleProvider as well

hbjORbj · 2026-02-19T19:01:39Z

packages/features/auth/lib/next-auth-options.ts

+    AzureADProvider({
+      clientId: OUTLOOK_CLIENT_ID!,
+      clientSecret: OUTLOOK_CLIENT_SECRET!,
+      tenantId: process.env.AZURE_AD_TENANT_ID,


is this a required field? if not, I wouldn't even introduce such an env var

i'm working on cleaning this up, but yes this is not okay

Ryukemeister

think we'll just close this one and go with #28080 instead

retrogtx added 17 commits April 1, 2025 13:48

fix: trigger lingo.dev by removing duplicate value

755a5c0

Merge branch 'calcom:main' into main

2b8e944

Merge branch 'calcom:main' into main

eb090a1

Merge branch 'calcom:main' into main

7bfe71f

Merge branch 'calcom:main' into main

6b8b832

Merge branch 'calcom:main' into main

00942e6

Merge branch 'calcom:main' into main

d6dda16

Merge branch 'calcom:main' into main

0c43f23

Merge branch 'calcom:main' into main

5374610

Merge branch 'calcom:main' into main

c3e016d

Merge branch 'calcom:main' into main

3612d5a

Merge branch 'calcom:main' into main

1147eb4

Merge branch 'calcom:main' into main

e79dd41

Merge branch 'calcom:main' into main

f10db66

under progress

1f72789

wow this worked

34e439b

migrate schema

c64d20d

retrogtx requested a review from a team as a code owner April 13, 2025 12:04

github-actions bot added ❗️ migrations contains migration files ❗️ .env changes contains changes to env variables labels Apr 13, 2025

graphite-app bot added the community Created by Linear-GitHub Sync label Apr 13, 2025

graphite-app bot requested a review from a team April 13, 2025 12:04

keithwillcode added the community-interns The team responsible for reviewing, testing and shipping low/medium community PRs label Apr 13, 2025

dosubot bot added the authentication area: authentication, auth, google sign in, password, SAML, password reset, can't log in label Apr 13, 2025

cubic-dev-ai bot reviewed Apr 13, 2025

View reviewed changes

retrogtx added the ready-for-e2e label Apr 13, 2025

retrogtx added 2 commits April 13, 2025 20:18

fix types

7e47f53

fix import for google login

eb56070

Ryukemeister added devin-conflict-resolution and removed devin-conflict-resolution labels Feb 18, 2026

Ryukemeister removed Medium priority Created by Linear-GitHub Sync devin-conflict-resolution labels Feb 19, 2026

Ryukemeister and others added 3 commits February 19, 2026 12:32

fix: merge conflicts

7195d80

chore: revert signup view changes

b35a746

Merge branch 'main' into microsoft-auth

ad0dbb3

cubic-dev-ai bot reviewed Feb 19, 2026

View reviewed changes

apps/web/modules/signup-view.tsx Show resolved Hide resolved

apps/web/modules/signup-view.tsx Show resolved Hide resolved

fixup: bring back reverted changes because of merge conflicts

c816305

cubic-dev-ai bot reviewed Feb 19, 2026

View reviewed changes

apps/web/modules/signup-view.tsx Outdated Show resolved Hide resolved

Ryukemeister added ready-for-e2e run-ci Approve CI to run for external contributors labels Feb 19, 2026

fix: disable email input when microsoft sign in is in progress

6513e71

Ryukemeister removed ready-for-e2e run-ci Approve CI to run for external contributors labels Feb 19, 2026

Ryukemeister added ready-for-e2e run-ci Approve CI to run for external contributors and removed ready-for-e2e run-ci Approve CI to run for external contributors labels Feb 19, 2026

chore: implement cubic feedback

c55f9bb

Ryukemeister added ready-for-e2e run-ci Approve CI to run for external contributors labels Feb 19, 2026

hbjORbj requested changes Feb 19, 2026

View reviewed changes

Ryukemeister reviewed Feb 27, 2026

View reviewed changes

Ryukemeister closed this Feb 27, 2026

Conversation

retrogtx commented Apr 13, 2025 • edited by Ryukemeister Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Visual Demo:

Key Changes

Environment Variables

How to Test

Uh oh!

vercel bot commented Apr 13, 2025

Uh oh!

graphite-app bot commented Apr 13, 2025

Graphite Automations

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot commented Feb 17, 2026

Merge Conflict Resolution - Push Failed

Uh oh!

github-actions bot commented Feb 18, 2026

Devin AI is resolving merge conflicts

Uh oh!

devin-ai-integration bot commented Feb 18, 2026

Merge Conflict Resolution Attempted

What was done:

Why push failed:

For the PR author (@retrogtx):

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 19, 2026

Devin AI is addressing Cubic AI's review feedback

Uh oh!

hbjORbj Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Ryukemeister Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Ryukemeister Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

hbjORbj Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Ryukemeister Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Ryukemeister left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

retrogtx commented Apr 13, 2025 •

edited by Ryukemeister

Loading