passport-microsoft

passport-microsoft is a Passport.js authentication strategy built on passport-oauth2 that implements the OAuth 2.0 flow for Microsoft accounts, exchanging an authorization code for an access token and fetching the user’s profile from the Microsoft Graph API. Applications supply a verify callback that receives the access token, refresh token, and normalized profile, and returns the application’s own user object — the same pattern used by every other Passport strategy.

The strategy handles Microsoft-specific details (the Graph API profile endpoint, scope defaults, and error mapping via InternalOAuthError) so integrating “Sign in with Microsoft” only requires supplying a client ID, client secret, and callback URL rather than implementing the OAuth 2.0 exchange by hand.

What You Get

• A Strategy class extending passport-oauth2’s OAuth2Strategy for Microsoft’s specific OAuth endpoints
• Automatic profile fetching from the Microsoft Graph API after token exchange
• A verify(accessToken, refreshToken, profile, done) callback pattern consistent with every other Passport strategy
• Sensible defaults for Microsoft OAuth scopes, reducing required configuration to clientID/clientSecret/callbackURL
• Structured OAuth error mapping via InternalOAuthError for consistent failure handling

Common Use Cases

• Adding a “Sign in with Microsoft” button to a Node.js/Express application already using Passport for other providers
• Authenticating enterprise users whose organizations use Microsoft 365 / Azure AD accounts
• Building single sign-on flows that need to read basic Microsoft Graph profile data (name, email) at login time
• Standardizing multiple OAuth providers (Google, GitHub, Microsoft) behind one Passport-based auth layer

Under The Hood

Architecture - the entire strategy is implemented in lib/strategy.js (143 lines), which subclasses passport-oauth2’s OAuth2Strategy via util.inherits, overriding userProfile() to call the Microsoft Graph API endpoint and normalize the response into Passport’s standard profile shape, while lib/index.js re-exports the Strategy class as the package’s public API. Tech Stack - plain CommonJS JavaScript with passport-oauth2 as its sole strategy dependency, no build step, and a test/ directory using a bootstrap file (test/bootstrap/node.js) to configure the test environment. Code Quality - test/strategy.test.js and test/package.test.js cover the strategy’s OAuth behavior and package metadata respectively; the library is small and stable but shows low recent commit activity, consistent with a mature, feature-complete OAuth strategy that needs infrequent changes. API Design - the API deliberately matches the conventions of every other Passport strategy (new Strategy(options, verify), registered via passport.use()), so any developer already familiar with passport-google-oauth20 or similar strategies can adopt it with essentially zero new concepts.