A client-side endpoint (which can only be queried from the user's browser) that starts the Microsoft OAuth flow. This endpoint generates the Microsoft OAuth URL with all required fields and redirects the user to that URL. The user authenticates with Microsoft Account before getting redirected back to Stytch. After verifying the request, Stytch redirects the user back to the login_redirect_url or signup_redirect_url URL provided.
One of organization_id or slug is required to specify which organization the user is trying to access. If the organization that the user is trying to access is not yet known, use the Microsoft OAuth Discovery endpoint instead.
NOTE: The Stytch B2B product limits access to only verified Azure Active Directory accounts. Personal accounts, including personal Xbox Live, Skype, or Outlook accounts, are not allowed. Accounts managed by Azure Active Directory B2C are not allowed. By default, Stytch will deduplicate users by treating their UserPrincipalName as an email address. Reach out to firstname.lastname@example.org if you would like finer control over this behavior.
By default our Microsoft OAuth integration includes open_id, email, User.Read, and profile scopes. You may add any additional Microsoft API scopes (see here for a complete list) as a space separated list in the custom_scopes query parameter of /oauth/microsoft/start.
Once the user successfully authenticates with Microsoft, they'll be redirected to the redirect URL that you provided at the start of the OAuth flow with a Stytch OAuth token. Collect the token from the URL query parameters, and call Authenticate OAuth Token to complete authentication.