fix(providers): Microsoft Entra ID multi-tenant issuer validation

[guustgoossens]

☕️ Reasoning

The Microsoft Entra ID provider has been documented as supporting
multi-tenant sign-in (/common, /organizations, /consumers) since
the v2 endpoint was introduced, but in practice the multi-tenant
configurations fail discovery validation right before the ID token
would be accepted.

Background

Microsoft's OIDC discovery document is templated — for every tenant
URL, the response is:

{
  "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0",
  ...
}

The [customFetch] hook in microsoft-entra-id.ts substitutes the
{tenantid} placeholder so the document can be processed by
oauth4webapi. Today that substitution reads the tenant from
config.issuer only, defaulting to "common":

const tenantRe = /microsoftonline\.com\/(\w+)\/v2\.0/
const tenantId = config.issuer?.match(tenantRe)?.[1] ?? "common"
const issuer = json.issuer.replace("{tenantid}", tenantId)

Why this breaks multi-tenant

handleOAuth() already understands that the issuer on the returned ID
token contains the actual tenant from the user that authenticated,
and re-runs discovery against that tenant
(callback.ts#L188-L224):

const { tid } = decodeJwt(responseJson.id_token)
if (typeof tid === "string") {
  const issuer = new URL(as.issuer.replace(tenantId, tid))
  const discoveryResponse = await o.discoveryRequest(issuer, {
    [o.customFetch]: provider[customFetch],
  })
  as = await o.processDiscoveryResponse(issuer, discoveryResponse)
}

That second discovery is issued against
https://login.microsoftonline.com/<actual-tid>/v2.0/.well-known/openid-configuration,
but the customFetch hook ignores the request URL and rewrites the
response issuer to https://login.microsoftonline.com/common/v2.0
(because config.issuer still points at /common).
processDiscoveryResponse then throws — the returned issuer does not
match the expected issuer URL it was asked to discover, so the ID token
is never validated.

A second, smaller bug: the regex \w+ does not match hyphens, so a
configured single-tenant issuer set to a real tenant GUID (e.g.
8a2a7b4d-1234-5678-9abc-def012345678) fails to match too and silently
falls back to "common". The relaxed [^/]+ covers both shapes.

Fix

Derive the tenant from the request URL first, so each discovery
response identifies the tenant it was actually fetched for. The
single-tenant path is unchanged. Existing re-discovery in
callback.ts now works as intended.

Before / After

Scenario	Configuration	Before	After
Multi-tenant default	issuer unset	Discovery re-run fails with "response" body "issuer" property does not match the expected value	ID token accepted, iss matches per-tenant issuer
/organizations	issuer: ".../organizations/v2.0"	Same as above	Works
/consumers	issuer: ".../consumers/v2.0"	Same as above	Works
Single-tenant GUID	issuer: ".../<tenant-guid>/v2.0"	Worked (only because the re-discovered URL happened to match; the regex would silently fall back to "common" if the customFetch path is exercised twice)	Works, regex now matches GUIDs explicitly

Reproduction

1. Configure MicrosoftEntraID without an issuer (the documented
   multi-tenant configuration).
2. Register the Entra application as multi-tenant.
3. Sign in with a user from any tenant that is not the application's
   home tenant.
4. The callback fails before the ID token is validated, with an OIDC
   discovery error about the issuer not matching the expected value.

Tests

Added packages/core/test/providers/microsoft-entra-id.test.ts:

• Default /common discovery rewrites issuer to /common/v2.0.
• A real tenant GUID URL rewrites issuer to that GUID.
• /organizations and /consumers URLs rewrite to their respective
  tenant strings.
• Single-tenant configuration (config.issuer set to a tenant GUID)
  is preserved through discovery.
• Non-discovery requests pass through to fetch unchanged.

All 152 existing tests in @auth/core still pass:

Test Files  13 passed (13)
     Tests  152 passed (152)

🧢 Checklist

• Documentation (JSDoc updated to mention /organizations and
  /consumers support and per-tenant issuer validation)
• Tests
• Ready to be merged

🎫 Affected issues

References:

• https://github.com/MicrosoftDocs/azure-docs/issues/113944 (Microsoft
  acknowledges the {tenantid} placeholder in the v2 discovery
  document)

📌 Resources

• Microsoft Identity Platform — v2.0 endpoints
• Microsoft Identity Platform — ID token claims (iss, tid)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auth-docs	Ready	Preview, Comment	May 28, 2026 12:25pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
next-auth-docs	Ignored	Preview	May 28, 2026 12:25pm

[vercel]

@guustgoossens is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.