Microsoft Login V2

Nepton's Microsoft Login (Single Sign-On) is moving to the OpenID Connect (OIDC) v2.0 endpoint as its primary authentication method, replacing the previous Microsoft Graph API integration.
Nepton is rolling out this change and migrating customers to OpenID Connect gradually. End users are not affected and the sign-in experience remains unchanged.

Authentication flow

• Primary: OIDC v2.0 endpoint — used for all sign-ins.
• Fallback: Microsoft Graph API — invoked automatically, and only when the id_token returned by Microsoft does not contain the user's email address.

Reason for the Change

This migration addresses Microsoft's updated Conditional Access enforcement policy:

• Before June 2026: Requests to https://graph.microsoft.com/v1.0/me using the User.Read scope could bypass Conditional Access policies when tenant-level exclusions were configured.
• After June 2026: Microsoft is expected to evaluate all requests against Conditional Access policies, including requests for basic user information. Tenant-level exclusions will no longer provide an exception.
• As part of this change, we are also migrating to the V2 endpoint of Microsoft Login

Prerequisites for the email Claim in ID Tokens

To ensure the email claim appears in ID tokens, two conditions must be met: the user's mail attribute must be populated, and the email domain must be verified in the tenant.

1. Populate the User's mail Attribute

• Do not use the "Contact info → Email" field in the Entra portal; this writes to otherMails, which is ignored for token claims.
• Recommended: Assign an Exchange Online/Microsoft 365 license. This automatically populates the mail attribute.
• Manual Alternative: Use Microsoft Graph PowerShell:

• Update-MgUser -UserId  -Mail "jane.doe@contoso.com"

• Note: If an Exchange license is assigned later, it may overwrite this manual value.

2. Verify the Email Domain

• Navigate to Entra admin center → Identity → Custom domain names.
• Ensure the domain in the user's mail address (e.g., contoso.com) is marked as Verified.
• Why: Microsoft excludes the email claim for unverified domains in multi-tenant scenarios to prevent security risks.

Setting the account type

Nepton app's account type in Microsoft Entra must match the setting in the Nepton admin section:

• In Microsoft Entra, open the Nepton app registration and check Supported account types ("Choose the account types that can use this application or access this API").
• In Nepton, go to the admin section and open the Microsoft login configuration. The Azure AD Account Type dropdown is only visible when the V2 hybrid login flow is activated for the deployment.
• Set the dropdown to the same value as the account type in Entra:

Note: with the V1 login flow the account type is fixed and the column is not shown — this setting only applies to V2.