# 微软单点登录提供商

> Source: https://strapi.nodejs.cn/cms/configurations/sso-providers/microsoft

🌐 Microsoft provider SSO configuration

使用 `passport-azure-ad-oauth2` 配置 Microsoft SSO 提供程序，以允许用户通过他们的 Microsoft 账户登录和注册你的 Strapi 管理面板。

🌐 Configure the Microsoft SSO provider using `passport-azure-ad-oauth2` to allow users to sign in and sign up to your Strapi admin panel via their Microsoft accounts.

本页面说明了如何为[单点登录 (SSO) 功能](/cms/features/sso) 设置 Microsoft 提供程序。

🌐 The present page explains how to setup the Microsoft provider for the [Single Sign-On (SSO) feature](/cms/features/sso).

:::prerequisites

你已阅读[如何配置 SSO 指南](/cms/configurations/guides/configure-sso)。

🌐 You have read the [How to configure SSO guide](/cms/configurations/guides/configure-sso).

:::

## 安装 {#installation}

🌐 Installation

安装 [passport-azure-ad-oauth2](https://github.com/auth0/passport-azure-ad-oauth2#readme)：

```sh
yarn add passport-azure-ad-oauth2 jsonwebtoken
```

```sh
npm install --save passport-azure-ad-oauth2 jsonwebtoken
```

## 配置示例 {#configuration-example}

🌐 Configuration example

Microsoft SSO 提供程序在 [`config/admin` 文件](/cms/configurations/admin-panel) 的 `auth.providers` 数组中配置：

🌐 The Microsoft SSO provider is configured in the `auth.providers` array of [the `config/admin` file](/cms/configurations/admin-panel):

```js title="/config/admin.js"

const AzureAdOAuth2Strategy = require("passport-azure-ad-oauth2");
const jwt = require("jsonwebtoken");

module.exports = ({ env }) => ({
  auth: {
    // ...
    providers: [
      {
        uid: "azure_ad_oauth2",
        displayName: "Microsoft",
        icon: "https://upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/320px-Microsoft_logo_%282012%29.svg.png",
        createStrategy: (strapi) =>
          new AzureAdOAuth2Strategy(
            {
              clientID: env("MICROSOFT_CLIENT_ID", ""),
              clientSecret: env("MICROSOFT_CLIENT_SECRET", ""),
              scope: ["user:email"],
              tenant: env("MICROSOFT_TENANT_ID", ""),
              callbackURL:
                strapi.admin.services.passport.getStrategyCallbackURL(
                  "azure_ad_oauth2"
                ),
            },
            (accessToken, refreshToken, params, profile, done) => {
              let waadProfile = jwt.decode(params.id_token, "", true);
              done(null, {
                email: waadProfile.email,
                username: waadProfile.email,
                firstname: waadProfile.given_name, // optional if email and username exist
                lastname: waadProfile.family_name, // optional if email and username exist
              });
            }
          ),
      },
    ],
  },
});
```

```ts title="/config/admin.ts"

  auth: {
    // ...
    providers: [
      {
        uid: "azure_ad_oauth2",
        displayName: "Microsoft",
        icon: "https://upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/320px-Microsoft_logo_%282012%29.svg.png",
        createStrategy: (strapi) =>
          new AzureAdOAuth2Strategy(
            {
              clientID: env("MICROSOFT_CLIENT_ID", ""),
              clientSecret: env("MICROSOFT_CLIENT_SECRET", ""),
              scope: ["user:email"],
              tenant: env("MICROSOFT_TENANT_ID", ""),
              callbackURL:
                strapi.admin.services.passport.getStrategyCallbackURL(
                  "azure_ad_oauth2"
                ),
            },
            (accessToken, refreshToken, params, profile, done) => {
              let waadProfile = jwt.decode(params.id_token, "", true);
              done(null, {
                email: waadProfile.email,
                username: waadProfile.email,
                firstname: waadProfile.given_name, // optional if email and username exist
                lastname: waadProfile.family_name, // optional if email and username exist
              });
            }
          ),
      },
    ],
  },
});
```