> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-microsoft.md). # Sign in with Microsoft Connect a Microsoft account once and let Agent Cake use it to sign in to apps that offer Microsoft login. Some apps let users sign in with a Microsoft account. For those apps, Agent Cake can sign in with a connected Microsoft account instead of an app username and password. Cakewalk drives Microsoft's own sign in page with the account's password and a code from an authenticator app. It is not an OAuth consent screen, so the requirements below apply. #### Requirements The Microsoft account must: * Be able to sign in with a password. Accounts that only accept passkeys or passwordless sign in will not work. * Have an **authenticator app** registered as a way to sign in. Agent Cake enters the six digit code. It cannot approve a phone prompt or match a number, so when Microsoft offers one first, Agent Cake switches to the code. * Have the permissions needed to create users and assign roles in the target app. The guidance in [Set up Service Accounts](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/set-up-service-accounts.md) still applies. Use a dedicated account rather than a person's own login. #### Get the account's MFA secret Cakewalk needs the secret key behind the authenticator app, not a code from someone's phone. 1. Sign in to [Security info](https://mysignins.microsoft.com/security-info) as the account. 2. Click `Add sign-in method` and choose `Microsoft Authenticator`. 3. Select `I want to use a different authenticator app`. 4. Choose the option to enter the code manually instead of scanning the QR code, and copy the secret key. 5. Keep this page open. You finish it with the one time password Cakewalk shows when you connect the account. {% hint style="info" %} If `I want to use a different authenticator app` is missing, your company's Microsoft admin has not allowed software authenticator apps. They can turn it on under Authentication methods in the Microsoft Entra admin center. {% endhint %} #### Connect a Microsoft account 1. Go to `Settings` > `Account` > `Auto provisioning`. 2. On the **Sign in with Microsoft** card, click `Connect`. 3. Enter the account email and password, then click `Continue`. 4. Paste the secret key into **MFA Secret**. 5. Cakewalk shows a one time password and a countdown to the next code. Enter it on the Microsoft page to finish the authenticator setup. 6. Click `Verify & connect`. You can connect more than one account. Use `New` on the card to add another. #### Use a connected account for an app 1. Go to `App governance` and open the app. 2. Click `Provisioning`, then `Configure` next to Cakewalk. 3. On the **Sign-in method** step, choose **Sign in with Microsoft**. 4. Pick the account you want to use, then click `Continue`. 5. Set the access options, then click `Save & Enable`. Microsoft configurations do not use an inbox, so `Sign in with Microsoft` stays available even when `Username and password` is greyed out. An app can enforce its own two factor authentication on top of the Microsoft sign in. That second secret belongs to the app and is entered on the account step, the same way as for Google. See [Apps with their own two-factor authentication](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-google.md#apps-with-their-own-two-factor-authentication). #### Manage connected accounts Each account on the **Sign in with Microsoft** card shows its status and the apps using it. Changing the password, deleting an account and the `Active` and `Error` statuses work the same as for Google. See [Manage connected accounts](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-google.md#manage-connected-accounts). #### Learn more * [Microsoft: How to add your accounts to Microsoft Authenticator](https://support.microsoft.com/en-us/account-billing/how-to-add-your-accounts-to-microsoft-authenticator) * [Microsoft: OATH tokens authentication method](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-oath-tokens) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-microsoft.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.