Oauth2 Azure Bundle Laravel Package

Product Decisions This Supports

• Enterprise SSO roadmap: This package is only relevant to one decision — "can we ship 'Sign in with Microsoft' / Entra ID (formerly Azure AD) for our Symfony-based admin or internal tools this quarter?" It is a thin Symfony bundle that wires thenetworg/oauth2-azure into Symfony's security/OAuth client stack, so it accelerates a narrow feature, not a platform.
• Build vs. buy (the real decision): The honest framing is three options, not two — (a) this bundle, (b) the underlying thenetworg/oauth2-azure library integrated directly, (c) hand-rolled OIDC against Entra's discovery endpoint. This bundle is not a buy decision; it's a "save an afternoon of Symfony wiring" decision. Its value is measured in hours, not dollars.
• Framework fit — critical caveat: The package is a Symfony bundle, not a Laravel package. If the roadmap item sits in a Laravel app, this is out of scope entirely and the equivalent decision is laravel/socialite + socialiteproviders/microsoft-azure, or league/oauth2-client with an Azure provider. Do not let "PHP package" in the brief collapse that distinction — it's the difference between a 2-day task and a rewrite.
• Use cases where it earns its keep: internal employee-facing portals on Symfony where the org already runs Microsoft 365; B2B SaaS "Sign in with Microsoft" for enterprise tenants; multi-tenant Entra apps needing tenant-aware token validation with minimal custom code.
• Portfolio/maintenance signal: 2 stars, 0 dependents, a single release in Feb 2024, and a low opportunity score all say this is a personal utility repo. That's fine as a reference implementation to copy from; it is a poor candidate for a dependency in anything with an SLA.
• Use cases where it does not help at all: SAML-only enterprise buyers, SCIM/HR-driven provisioning, group-to-role mapping at scale, or anything requiring vendor support and a security review trail.

When to Consider This Package

Consider it when all of the following hold:

• The codebase is genuinely Symfony, using the Security bundle and an OAuth2 client already in the stack.
• Scope is a single Entra ID login flow — no SCIM, no advanced claims transformation, no per-tenant branding.
• You are comfortable vendoring or forking it: pin the commit, read ~200 lines of wrapper code, and accept ownership of it. With 0 dependents you are the first canary, not the hundredth adopter.
• Timeline pressure dominates: the alternative is a few hours of manual wiring you'd rather not spend.
• You will still track thenetworg/oauth2-azure upstream directly for security fixes, because this wrapper's release cadence won't.

Look elsewhere when:

• The app is Laravel. Full stop — wrong framework, wrong bundle.
• You need enterprise support, an SBOM, or a security review with a named maintainer. Two stars and a single maintainer is an audit finding waiting to happen in a regulated environment.
• Requirements extend beyond login: SAML, SCIM provisioning, conditional access, multi-tenant admin consent flows, or fine-grained group claims. None of that lives here; you'd be building it on top of two layers of dependency you don't control.
• You want a maintained, versioned dependency. Prefer the underlying thenetworg/oauth2-azure directly, or a first-party provider from your framework's ecosystem, so you have one fewer hop between you and the fix.
• You're building a customer-facing auth surface where a break is revenue-affecting. Auth code with a bus factor of one and near-zero adoption is a liability, not leverage.

How to Pitch It (Stakeholders)

For executives: This is a small, MIT-licensed Symfony add-on that could shorten delivery of "Sign in with Microsoft" by a day or two. It is not a strategic dependency — it has negligible adoption (2 stars, no known dependents) and a single maintainer, so we would own it in practice. Recommendation: do not adopt it as a dependency. Either spend the extra day integrating the underlying OAuth2 Azure library directly, or use the equivalent provider for our actual framework. Same feature, lower long-term risk, effectively the same cost.

For engineering: Scope check first — this is a Symfony bundle; our Laravel services need socialiteproviders/microsoft-azure on top of Socialite instead. If we do have a Symfony surface to cover, treat this repo as a reference implementation to read and copy, not a package to require: pin it or fork it, track thenetworg/oauth2-azure upstream for security patches, and budget roughly 1–2 days including tenant config, claims mapping, and tests. Decision owner: platform/identity lead. Exit criteria: works across a single-tenant and a multi-tenant Entra app registration, with a documented fallback if the wrapper is abandoned.