Microsoft

Microsoft single sign-on (SSO) lets visitors join your website or app with the Microsoft account they already use for work or at home, instead of creating a new username and password. This article explains how it works and when it's worth offering, then walks you through connecting your own Microsoft app so visitors see your brand when they click "Continue with Microsoft".

In short: When a visitor clicks "Continue with Microsoft", Microsoft confirms who they are and shares their name and email address with your site, so you never see or store their password. It works for both work accounts (Microsoft 365, managed by an organization in Microsoft Entra ID) and personal accounts (Outlook.com, Hotmail, Xbox). Bread & Butter supports Microsoft out of the box in Sandbox Mode. To show your own brand, register an app in the Azure portal that accepts any organization's accounts plus personal accounts, create a client secret, then paste the Client ID and Client Secret into Settings, then Global Conversion Methods, in Bread & Butter. To limit sign-in to one company's employees, use an enterprise connection instead.

Need a hand? Setting up developer credentials can feel a bit overwhelming. We offer a free 15-minute onboarding session to help you get this configured. Book your session with a specialist here.

What is Microsoft SSO?

Microsoft SSO lets people use their Microsoft account to sign in to other websites and apps. It's built on OpenID Connect, the same open standard used by Google and LinkedIn sign-in.

  1. A visitor clicks Continue with Microsoft on your site.
  2. Microsoft asks them to confirm they want to share their details with you.
  3. Microsoft confirms who they are and sends your site their name and email address.
  4. Bread & Butter creates a verified profile for them, and returning visitors are recognized with the same click.

Why offer Microsoft sign-in?

  • Your audience already has an account. If your visitors work in Microsoft 365, they're signed in to Microsoft most of the day.
  • Less friction. Some people leave rather than fill in another sign-up form. A familiar button is an easy yes.
  • No passwords to manage. You don't handle password resets, and there's no password database to protect.
  • Safer for visitors. People asked to create a new password often reuse an old one. Signing in with a work account they already protect is the safer choice.
  • Some organizations require it. Many companies ask employees to use their Microsoft work account wherever they can.

Microsoft works especially well for B2B software, professional services and anything used alongside Microsoft 365. Offer it alongside Google and LinkedIn, and put the option your audience uses most at the top.

Social sign-in or an enterprise connection?

This article sets up Microsoft as a social sign-in, open to anyone with a Microsoft account. If a customer's IT team wants sign-in limited to their own employees, under their own rules, set up an enterprise connection instead. See Microsoft Entra ID enterprise connection (OpenID Connect or SAML)

Why connect your own Microsoft app?

When you first install Bread & Butter, the Microsoft 1-click connection is pre-configured in Sandbox Mode. This allows you to instantly test your widgets, but it means visitors will see Bread & Butter's name on the Microsoft connection screen instead of yours.

To maximize user trust and prevent conversion drop-off, you must transition Microsoft out of the sandbox. By setting up an application in your Azure Portal, you can generate your own credentials so buyers see your brand when they click "Continue with Microsoft."

Here is how to set it up in five steps.

Step 1: Create Your Azure App Registration

(If you don't have an account yet, you will need to sign up for Microsoft Azure https://azure.microsoft.com/en-ca/free/).

  • Under "Azure services," click on App registrations. If it is not immediately visible, click "more services" and search for it.
  • Click New Registration.

Step 2: Configure Your Application

This dictates who is allowed to connect to your widgets.

  • Enter a Name for your application, ideally using your organization's name.
  • For supported account types, select Any Entra ID Tenant + Personal Microsoft accounts.

⚠️ Important: This is crucial. Selecting one of the "Multitenant" options allows any standard Microsoft user to authenticate and sign in. "Single Tenant" restricts login access strictly to employees on your own domain.

  • Set the Redirect URI dropdown to Web and paste the following exact link: https://api.breadbutter.io/callback  

    • Click Register.
    • Once created, copy and save the Application (client) ID—you will need this for the final setup step.

Step 3: Generate Your App Credentials

    • In the left menu under Manage, click on Certificates & secrets, then click New client secret.
    • Enter a description, set your desired expiration timeframe, and click Add.

⚠️ Important: Copy and store the Secret Value immediately. If you navigate away, the value will be hidden forever and you will have to generate a new secret. Also, be sure to set a calendar reminder to replace this secret before it expires, otherwise, your users will suddenly lose the ability to log in.

Step 4: Add Your Branding

  • In the left menu, click on Branding & properties.
  • Enter your Privacy Policy URL, Terms of Service URL, and any other branding options you would like displayed to your users.
  • On the same page, add your Partner One ID (formerly called the MPN ID) to verify yourself as the publisher. (Note: You can come back and complete this step later, but your app will display a scary "Unverified" warning to your users until you do).

For more information on joining, check out Microsoft's Partner Program: https://partner.microsoft.com/.

Step 5: Link Your Credentials to Bread & Butter

  • Log in to your Bread & Butter dashboard.
  • https://app.breadbutter.io
  • Go to Settings in the left menu, then navigate to your Global Conversion Methods tab.
  • Locate your Microsoft connection and edit the settings to switch from Sandbox to Production Mode, then click Create New.
  • Enter a custom name and description for your reference.
  • Paste the Client ID and Client Secret you generated in Azure.
  • Click Save, and ensure the checkbox next to your new Microsoft provider is enabled.

Final Polish: Complete Your White-Label Setup

You have successfully added your brand name to the Microsoft consent screen! However, visitors may still see breadbutter.io   listed in the URL routing during the connection process.

To completely remove our branding and keep visitors fully within your own domain ecosystem, navigate to the Custom Auth Domain tab in your Bread & Butter settings to set up your Custom Auth Domain.

Sources

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.