You can let your users authenticate with Firebase using OAuth providers likeMicrosoft Azure Active Directory by integrating web-based generic OAuth Logininto your app using the Firebase SDK to carry out the end to end sign-in flow.

Before you begin

To sign in users using Microsoft accounts (Azure Active Directory and personalMicrosoft accounts), you must first enable Microsoft as a sign-in provider foryour Firebase project:

1. Add Firebase to your Android project.

2. In theFirebase console, open theAuth section.
3. On theSign in method tab, enable theMicrosoft provider.
4. Add theClient ID andClient Secret from that provider's developer console to the provider configuration:
   1. To register a Microsoft OAuth client, follow the instructions in Quickstart: Register an app with the Azure Active Directory v2.0 endpoint. Note that this endpoint supports sign-in using Microsoft personal accounts as well as Azure Active Directory accounts.Learn more about Azure Active Directory v2.0.
   2. When registering apps with these providers, be sure to register the*.firebaseapp.com domain for your project as the redirect domain for your app.
5. ClickSave.

6. If you haven't yet specified your app's SHA-1 fingerprint, do so from theSettings pageof theFirebase console. Refer toAuthenticating Your Clientfor details on how to get your app's SHA-1 fingerprint.

Handle the sign-in flow with the Firebase SDK

If you are building an Android app, the easiest way to authenticate your userswith Firebase using their Microsoft accounts is to handle the entire sign-inflow with the Firebase Android SDK.

To handle the sign-in flow with the Firebase Android SDK, follow these steps:

1. Construct an instance of anOAuthProvider using itsBuilder with theprovider IDmicrosoft.com.

   Kotlin

   valprovider=OAuthProvider.newBuilder("microsoft.com")
   GenericIdpActivity.kt

   Java

   OAuthProvider.Builderprovider=OAuthProvider.newBuilder("microsoft.com");
   GenericIdpActivity.java

2. Optional: Specify additional custom OAuth parameters that you want tosend with the OAuth request.

   Kotlin

   // Target specific email with login hint.// Force re-consent.provider.addCustomParameter("prompt","consent")// Target specific email with login hint.provider.addCustomParameter("login_hint","user@firstadd.onmicrosoft.com")
   GenericIdpActivity.kt

   Java

   // Target specific email with login hint.// Force re-consent.provider.addCustomParameter("prompt","consent");// Target specific email with login hint.provider.addCustomParameter("login_hint","user@firstadd.onmicrosoft.com");
   GenericIdpActivity.java

   For the parameters Microsoft supports, see theMicrosoft OAuth documentation.Note that you can't pass Firebase-required parameters withsetCustomParameters(). These parameters areclient_id,response_type,redirect_uri,state,scope andresponse_mode.

   To allow only users from a particular Azure AD tenant to signinto the application, either the friendly domain name of the Azure AD tenantor the tenant's GUID identifier can be used. This can be done by specifyingthe "tenant" field in the custom parameters object.

   Kotlin

   // Optional "tenant" parameter in case you are using an Azure AD tenant.// eg. '8eaef023-2b34-4da1-9baa-8bc8c9d6a490' or 'contoso.onmicrosoft.com'// or "common" for tenant-independent tokens.// The default value is "common".provider.addCustomParameter("tenant","TENANT_ID")
   GenericIdpActivity.kt

   Java

   // Optional "tenant" parameter in case you are using an Azure AD tenant.// eg. '8eaef023-2b34-4da1-9baa-8bc8c9d6a490' or 'contoso.onmicrosoft.com'// or "common" for tenant-independent tokens.// The default value is "common".provider.addCustomParameter("tenant","TENANT_ID");
   GenericIdpActivity.java

3. Optional: Specify additional OAuth 2.0 scopes beyond basic profile thatyou want to request from the authentication provider.

   Kotlin

   // Request read access to a user's email addresses.// This must be preconfigured in the app's API permissions.provider.scopes=listOf("mail.read","calendars.read")
   GenericIdpActivity.kt

   Java

   // Request read access to a user's email addresses.// This must be preconfigured in the app's API permissions.List<String>scopes=newArrayList<String>(){{add("mail.read");add("calendars.read");}};provider.setScopes(scopes);
   GenericIdpActivity.java

   To learn more, refer to theMicrosoft permissions and consent documentation.

4. Authenticate with Firebase using the OAuth provider object. Note that unlikeother FirebaseAuthoperations, this will take control of your UI by popping up aCustom Chrome Tab.As a result, do not reference your Activity in theOnSuccessListenerandOnFailureListener that you attach as they will immediately detach whenthe operation starts the UI.

   You should first check if you've already received a response. Signing in viathis method puts your Activity in the background, which means that it can bereclaimed by the system during the sign in flow. In order to make sure thatyou don't make the user try again if this happens, you should check if aresult is already present.

   To check if there is a pending result, callgetPendingAuthResult:

   Kotlin

   valpendingResultTask=firebaseAuth.pendingAuthResultif(pendingResultTask!=null){// There's something already here! Finish the sign-in for your user.pendingResultTask.addOnSuccessListener{// User is signed in.// IdP data available in// authResult.getAdditionalUserInfo().getProfile().// The OAuth access token can also be retrieved:// ((OAuthCredential)authResult.getCredential()).getAccessToken().// The OAuth secret can be retrieved by calling:// ((OAuthCredential)authResult.getCredential()).getSecret().}.addOnFailureListener{// Handle failure.}}else{// There's no pending result so you need to start the sign-in flow.// See below.}
   GenericIdpActivity.kt

   Java

   Task<AuthResult>pendingResultTask=firebaseAuth.getPendingAuthResult();if(pendingResultTask!=null){// There's something already here! Finish the sign-in for your user.pendingResultTask.addOnSuccessListener(newOnSuccessListener<AuthResult>(){@OverridepublicvoidonSuccess(AuthResultauthResult){// User is signed in.// IdP data available in// authResult.getAdditionalUserInfo().getProfile().// The OAuth access token can also be retrieved:// ((OAuthCredential)authResult.getCredential()).getAccessToken().// The OAuth secret can be retrieved by calling:// ((OAuthCredential)authResult.getCredential()).getSecret().}}).addOnFailureListener(newOnFailureListener(){@OverridepublicvoidonFailure(@NonNullExceptione){// Handle failure.}});}else{// There's no pending result so you need to start the sign-in flow.// See below.}
   GenericIdpActivity.java

   To start the sign in flow, callstartActivityForSignInWithProvider:

   Kotlin

   firebaseAuth.startActivityForSignInWithProvider(activity,provider.build()).addOnSuccessListener{// User is signed in.// IdP data available in// authResult.getAdditionalUserInfo().getProfile().// The OAuth access token can also be retrieved:// ((OAuthCredential)authResult.getCredential()).getAccessToken().// The OAuth secret can be retrieved by calling:// ((OAuthCredential)authResult.getCredential()).getSecret().}.addOnFailureListener{// Handle failure.}
   GenericIdpActivity.kt

   Java

   firebaseAuth.startActivityForSignInWithProvider(/* activity= */this,provider.build()).addOnSuccessListener(newOnSuccessListener<AuthResult>(){@OverridepublicvoidonSuccess(AuthResultauthResult){// User is signed in.// IdP data available in// authResult.getAdditionalUserInfo().getProfile().// The OAuth access token can also be retrieved:// ((OAuthCredential)authResult.getCredential()).getAccessToken().// The OAuth secret can be retrieved by calling:// ((OAuthCredential)authResult.getCredential()).getSecret().}}).addOnFailureListener(newOnFailureListener(){@OverridepublicvoidonFailure(@NonNullExceptione){// Handle failure.}});
   GenericIdpActivity.java

   On successful completion, the OAuth access token associated with theprovider can be retrieved from theOAuthCredential object returned.

   Using the OAuth access token, you can call theMicrosoft Graph API.

   Unlike other providers supported by Firebase Auth, Microsoft does notprovide a photo URL and instead, the binary data for a profile photo has tobe requested viaMicrosoft Graph API.

   In addition to the OAuth access token, the user's OAuthID tokencan also be retrieved from theOAuthCredential object. Thesub claim in the ID token is app-specific and will not match the federateduser identifier used by Firebase Auth and accessible viauser.getProviderData().get(0).getUid(). Theoid claim field should beused instead.When using a Azure AD tenant to sign-in, theoid claim will be an exactmatch.However for the non-tenant case, theoid field is padded. For a federatedID4b2eabcdefghijkl, theoid will have have a form00000000-0000-0000-4b2e-abcdefghijkl.

5. While the above examples focus on sign-in flows, you also have theability to link a Microsoft provider to an existing user usingstartActivityForLinkWithProvider. For example, you can link multipleproviders to the same user allowing them to sign in with either.

   Kotlin

   // The user is already signed-in.valfirebaseUser=firebaseAuth.currentUser!!firebaseUser.startActivityForLinkWithProvider(activity,provider.build()).addOnSuccessListener{// Provider credential is linked to the current user.// IdP data available in// authResult.getAdditionalUserInfo().getProfile().// The OAuth access token can also be retrieved:// authResult.getCredential().getAccessToken().// The OAuth secret can be retrieved by calling:// authResult.getCredential().getSecret().}.addOnFailureListener{// Handle failure.}
   GenericIdpActivity.kt

   Java

   // The user is already signed-in.FirebaseUserfirebaseUser=firebaseAuth.getCurrentUser();firebaseUser.startActivityForLinkWithProvider(/* activity= */this,provider.build()).addOnSuccessListener(newOnSuccessListener<AuthResult>(){@OverridepublicvoidonSuccess(AuthResultauthResult){// Provider credential is linked to the current user.// IdP data available in// authResult.getAdditionalUserInfo().getProfile().// The OAuth access token can also be retrieved:// authResult.getCredential().getAccessToken().// The OAuth secret can be retrieved by calling:// authResult.getCredential().getSecret().}}).addOnFailureListener(newOnFailureListener(){@OverridepublicvoidonFailure(@NonNullExceptione){// Handle failure.}});
   GenericIdpActivity.java

6. The same pattern can be used withstartActivityForReauthenticateWithProvider which can be used to retrievefresh credentials for sensitive operations that require recent login.

   Kotlin

   // The user is already signed-in.valfirebaseUser=firebaseAuth.currentUser!!firebaseUser.startActivityForReauthenticateWithProvider(activity,provider.build()).addOnSuccessListener{// User is re-authenticated with fresh tokens and// should be able to perform sensitive operations// like account deletion and email or password// update.}.addOnFailureListener{// Handle failure.}
   GenericIdpActivity.kt

   Java

   // The user is already signed-in.FirebaseUserfirebaseUser=firebaseAuth.getCurrentUser();firebaseUser.startActivityForReauthenticateWithProvider(/* activity= */this,provider.build()).addOnSuccessListener(newOnSuccessListener<AuthResult>(){@OverridepublicvoidonSuccess(AuthResultauthResult){// User is re-authenticated with fresh tokens and// should be able to perform sensitive operations// like account deletion and email or password// update.}}).addOnFailureListener(newOnFailureListener(){@OverridepublicvoidonFailure(@NonNullExceptione){// Handle failure.}});
   GenericIdpActivity.java

Next steps

After a user signs in for the first time, a new user account is created andlinked to the credentials—that is, the user name and password, phonenumber, or auth provider information—the user signed in with. This newaccount is stored as part of your Firebase project, and can be used to identifya user across every app in your project, regardless of how the user signs in.

• In your apps, you can get the user's basic profile information from theFirebaseUser object. SeeManage Users.

• In yourFirebase Realtime Database andCloud StorageSecurity Rules, you can get the signed-in user's unique user ID from theauth variable, and use it to control what data a user can access.

You can allow users to sign in to your app using multiple authenticationproviders bylinking auth provider credentials to anexisting user account.

To sign out a user, callsignOut:

Firebase.auth.signOut()
MainActivity.kt

FirebaseAuth.getInstance().signOut();
MainActivity.java