Weave Code
Microsoft Azure Laravel Package
socialiteproviders/microsoft-azure
Laravel Socialite provider for Microsoft Azure (Entra ID) OAuth login. Configure client ID, secret and tenant to sign users in, retrieve their id, name and email, support multiple tenants, and generate Azure logout URLs.
Microsoft Azure OAuth2 Provider for Laravel Socialite
Frequently asked questions about Microsoft Azure
- How do I install socialiteproviders/microsoft-azure in a Laravel app?
- Run composer require socialiteproviders/microsoft-azure, which pulls in laravel/socialite and socialiteproviders/manager if they are not already present. Then add an azure block to config/services.php with client_id, client_secret, redirect and tenant values, and register the SocialiteWasCalled listener. You also need the usual Socialite redirect and callback routes in your application.
- Which tenant value should I use: tenant ID, organizations, common or consumers?
- Use your directory (tenant) ID for single-tenant workforce SSO, organizations to allow any work or school account, common for work plus personal Microsoft accounts, and consumers for personal accounts only. The choice changes the token endpoint, who can sign in, and how you map and link accounts downstream. Treat it as an infrastructure-owned config value that varies per environment.
- Laravel Socialite already ships an azure driver, do I still need this package?
- Yes, laravel/socialite includes a first-party azure driver, so confirm what you need beyond core before adding another dependency. This provider adds extras such as an explicit tenant mode, an optional proxy, a configurable graph_url for sovereign clouds like GCC High or China, and registration through the SocialiteProviders manager. If core Socialite covers your requirement, the simplest decision is zero new dependencies.
- How do I register the Azure provider listener in Laravel 11?
- Laravel 11 removed the default EventServiceProvider, so add the listener in your AppServiceProvider boot method using Event::listen and call $event->extendSocialite('azure', \SocialiteProviders\Azure\Provider::class). On Laravel 10 and below, add \SocialiteProviders\Azure\AzureExtendSocialite::class.'@handle' to the SocialiteWasCalled entry in EventServiceProvider::$listen. Built-in Socialite drivers do not need this step.
- Can I support multiple Azure tenants or directories with one Laravel app?
- Yes, the same driver can be registered more than once with different tenant and credential configuration so each entry points at a different directory. In practice you resolve which tenant applies from the request or from an organization record before calling Socialite::driver. Store the tenant per environment or per customer rather than letting it be edited at runtime.
- How do I log users out of Azure as well as my Laravel session?
- Log out of the Laravel guard, flush the session, then call Socialite::driver('azure')->getLogoutUrl(route('login')) and redirect the user to the returned URL. That sends them to Microsoft's sign-out endpoint so the Entra ID session is cleared too. Passing your login route is what completes the round trip back into the app.
- Which user fields does the Azure provider return, and is email always present?
- The provider returns id, name and email by mapping the Microsoft Graph /me response. Email is not guaranteed: guest accounts and some personal accounts may not expose a mail claim, and the value may come from mail or userPrincipalName. Do not treat email as a stable identifier. For multi-tenant apps store oid plus tid, because sub is pairwise per application.
- How can I test Azure OAuth login in Laravel without hitting Microsoft?
- Point the graph_url config option at a mock endpoint that returns a canned /me payload, and stub the token exchange so the provider never calls login.microsoftonline.com. Only set graph_url to a trusted endpoint, because the access token is sent there. Exercise your mapping logic with guest, personal and multi-tenant claim shapes as fixtures.
- What is the graph_url option in this Azure Socialite provider?
- graph_url overrides the Microsoft Graph endpoint used to fetch the user profile and defaults to https://graph.microsoft.com/v1.0/me. It exists for sovereign clouds such as GCC High or China and for test doubles. Because the access token is sent to whatever URL you configure, it must be an infrastructure-owned value and never exposed to runtime or developer editing in production.
- Is socialiteproviders/microsoft-azure production-ready and well maintained?
- It is a thin, readable adapter of roughly one provider class with no migrations, queues or persistent state, so you can audit it, pin a commit and vendor a fork quickly if needed. However its public signals are thin: around 60 stars and no recorded dependents means little battle-testing, no CVE history and no SLA. Verify the release tag, changelog and diff before pinning, and validate the flow in staging rather than assuming maturity.
Weaver
How can I help you explore Laravel packages today?