27 ms·

Auth with MS accounts is a giant mess. When I was a city councillor I had a corporate O365 account from the council (used for council email and virtual meetings

Auth with MS accounts is a giant mess. When I was a city councillor I had a corporate O365 account from the council (used for council email and virtual meetings over teams) and simply trying to sign out of the thing or switch to another account was always fraught (I've got a personal account that's basically just to associate my windows license with and a work account used for azure access). You'd often end up in a state where teams would just refuse to sign in and you'd need to reinstall it to get it to work again. Trying to be actively signed out is also a mess. You can use the teams app to join teams meetings others have setup and invited you too without teams access yourself. Though of course if you have an MS account teams can see it ends up trying to use it and then saying you don't get teams access via that account and trying to sign out and join the meeting with an account associated with it often just doesn't work. A colleague actually ended up requesting he got an o365 account with teams associated with his corp email because of this issue as he had occasional meetings with external people over teams. We have a corp o365 setup for our ops/admin team that engineering normally doesn't touch but because he had a teams invite sent to his corp email he got dragged into it.

hexmiles 4y ago
We also have some (a lot) problem with Teams, to the point that I started recommending my colleagues to use it from a browser and nuke cookie and other data every time the authentication stopped working. Basically when we login we need to use the "personal account" but sometimes it will not ask what account to use and automatically choose the wrong one, and once it gets stuck in this state i didn't find a way to fix it.
barbazoo 4y ago
This gave me flashbacks I was happy to forget about. Microsoft's SSO is nuts, at least with the browsers I used at the time. Might work better with Edge.
somat 4y ago
Unfortunate, it sounds like a mess and a half. Does any one know. If I found myself in the same situation would creating different windows accounts, one for each teams/azureAD account help keep them separate?
theK 4y ago
Yeah, the identity side of MS products is really dysfunctional. Every time I try to use teams or azure it ends up in hours of finding out the right procedure to log in or switch an account effectively. And then you get the people asking naively "why are you getting so mad at them"...
- AtlasBarfed 4y ago
  This is a buyer beware of some security policies. I just want to point out that this entire described scenario, by a company with decades and decades of security products being shoehorned into "just good enough" cloud infrastructure.... Sure the security folks will say hardened infrastructure with fine grained least privilege is doable ... if you're at greenfield ... maybe. But the issue with lots of IT orgs is that they are MESSY, and fine grained least privilege is fragile. Messy + fragile = not good things. I agree with least privilege as an aspiration, but security is a top-down authoritarian entity in organizations, and fundamentally they don't care if their policies disrupt your daily work process. IMO this is because most security orgs don't provide solutions. Specifically, by solution I do not mean "picked an enterprise security product bam we have a solution", I mean you have a security architecture and then have the people with bandwidth to help boots on ground devs get the job done quickly so security isn't a blocker).
- ly3xqhl8g9 4y ago
  Solution: run Windows in a VM, one machine per account, nuke it from orbit when-not-if something goes awry. Hundreds of hours of frustration prevented from a system that is not even able to have the same UI across all its windows.
  - ccouzens 4y ago
    Or run apps like Teams in a web browser. Web browsers have good isolation techniques like Chrome's profiles and Firefox's containers. Teams is written using web technologies so you're getting the same experience as the app.
    - adamzochowski 4y ago
AstixAndBelix 4y ago
I mean, this sounds to me exactly like what happens when trying to mix normal Google accounts and Google Workspace ones, especially if the admin enabling all the service is not yourself. It's not just Microsoft, this is a problem all these service providers have because they can't cope with hybrid use
- vasco 4y ago
  With Google you change the ID in the URL and you're in whatever account you want. All the urls usually have /u/<id> where ID starts at 0 with the first account you're logged in into, 1 the second etc.
  - AstixAndBelix 4y ago
    But what happens when you are using a Google product not served from the browser?
- gchadwick 4y ago
  I've got a number of Google accounts, two work ones (associated with different domains with distinct permissions and access to things, using drive, gdocs, Gmail and GCP with both) and a number of personal ones (some of which are associated with a Google workspace that I use for email under my personal domain) and it all works just fine for the most part. Groups and GCP console can sometimes get stuck on one account but Chrome with profiles can side step that one. Doing the same thing with MS accounts has been an utter nightmare by comparison.
hdjjhhvvhga 4y ago
This is obviously done on purpose. In the same way that Google ties users to Android devices when you add a Gmail account, MS takes every opportunity to assign their online account whenever they catch you off guard (installing a local Teams app instead of joining through the browser, signing into Minecraft at your school etc.). At this point you need to go through all the steps of dissociating your account from these devices. Sometimes they will reassign them after an update, so you need to watch out. For that reason I never use MS online apps on my private devices and whenever I need to sign in online, I always use the private mode or a dedicated Firefox container.
- alentred 4y ago
  Although I agree that companies (Microsoft, Google, etc.) deliberately seek to authenticate you across the web, I do not think that the general mess with Microsoft authentication is on purpose. It looks like generations of implementations (and likely generations of product management and development teams) layering on top of each other, "replacing" the "old" systems only to do the half of it, and integrating with acquired products. Seen from outside, it just doesn't look like there exists a single team that understands the authentication and permission system end-to-end.
  - makeitdouble 4y ago
    > I do not think that the general mess with Microsoft authentication is on purpose. Microsoft has been dealing with online identity almost since the consumer web exists. MSN launched in 1995, Outlook was the poster child of webmail, ActiveDirectory is the behemoth of enterprise user management. I don’t see Hanlon’s razor relevant when it’s on one of their core competency. They at least committed to throw part of their users under the bus to pursue their goals.
    - gbear605 4y ago
      As I see it, Microsoft has become so incompetent as an organization that they can no longer be said to have core competencies.
  - 4y ago
isodev 4y ago
I have the same experience! In my case, my personal and professional Microsoft addresses are the same (same email, different accounts) which means that in many cases I end up in impossible situations when the login screen doesn’t correctly guess if I want to sign in personal or with my “work” account. I also do client work for organisations where I need to sign into their O365 and honestly the only way to manage all that is to keep a dedicated browser “per account”. Teams is a different story, I avoid account switching because exactly like you describe, sometimes I need to uninstall it in order to sign out.
- prmoustache 4y ago
  Using same email address is deliberately asking for problems.
  - motoboi 4y ago
    I once got enrolled to a school and they asked my email. Didn't know it was for teams access. Now, 4 years later I still get to choose wether I want to login in their tenant or mine everytime. Microsoft solution? Change my email on the personal account. Not kidding.
    - twodave 4y ago
      That sucks. If your email provider supports +suffixes you may be able to work around it that way.
    - Symbiote 4y ago
      Can you 'leave' the organization here? https://myaccount.microsoft.com/organizations https://myaccount.microsoft.com/organizations
- ragingroosevelt 4y ago
  A perfect use for Firefox container tabs! It's the only way I can keep my personal, work, and alma mater email separate and not falling into login loops.
mastazi 4y ago
> Auth with MS accounts is a giant mess. It is indeed a giant mess. If you go to live.com and click on the hamburger icon at the top, then under 'Apps' click on the "To-Do" app, you will be asked to enter the password for your work account, even though you are on live.com, not on office.com, and you are currently logged in with your personal account. The only way to get past this is to click "use another account" then log in again with your personal account (even though you are already logged in!!). This bug has been present for months now.
- smashah 4y ago
  This is partly because loginHint is broken on microsoft/azure sign in
- dybber 4y ago
  Same on Gmail. I’m not logged in on my private account as I don’t use it anymore, but it always suggests to log me in on the private account when accessing, even though I am logged in on a corporate account, which is the only one I’m actively using at the moment. Silly.
  - ncann 4y ago
    I don't get your scenario but I have to say I never had any issue with using multiple Google accounts on the same browser. I used to have 5+ accounts logged in at once (personal + work + school) and it always worked flawlessly, switching between accounts was always a breeze using the drop down menu on the top right, and not just for Gmail but any Google apps. Microsoft on the other hand gave me endless issues when trying to use just 1 personal account and 1 work account on the same browser.
- frankfrankfrank 4y ago
  First mistake is using any of the Microsoft knock off services whose primary purpose is to trick “deciders” in the C-suits and in halls of bureaucratic hell that can confirm that the box for things like “to do” functionality is checked on their list. Every single Microsoft service, including email, several decades later, is still deep into subpar.
alentred 4y ago
> Auth with MS accounts is a giant mess. I agree. It is surprising that we don't see similar issues more often. It is *so* confusing to both users and the developers, to the point where it's too easy to make some naive mistakes. And it is one of most critical parts of the systems!
brightball 4y ago
It’s much worse than just auth too. Microsoft’s security policy around email is so bad that using Office 365 email should be considered a security problem. They’re actively enabling phishing because they choose to rollback standards support. https://www.brightball.com/articles/how-microsoft-became-phishings-biggest-enabler https://www.brightball.com/articles/how-microsoft-became-phi... https://news.ycombinator.com/item?id=34911811 https://news.ycombinator.com/item?id=34911811
easton 4y ago
Because of a quirk of my employment, my AAD account was deleted and recreated, which means I now have two Azure DevOps accounts with the same email, one of which is unlicensed (and not attached to an AAD identity). It is fairly random which one it tries to sign me in with, and every once in a while clicking on a link in ADO will sign me out because it got confused about who I was. It’s insane, and there’s no way to nuke the old account.
- bouke 4y ago
  I have the same issue. I’ve had a support call with an engineer about this and they have no idea how to fix this. If you sort the user list ascending it lists the one account and if you sort descending it lists the other. So changing the sorting should at least show _some_ license.
roywashere 4y ago
My son has a personal Windows 11 Lenovo laptop and he is signed in with his personal Microsoft account. The laptop went away for repairs because the touchpad no longer worked. When it returned, it turned out they replaced the main board so the bit locker keys needed to be entered again. These are typically stored in your Micsosoft account only they were nowhere to be found. Some help article on the MS website explained that sometimes it could happen that the keys are migrated to a school account. He only ever used his school account from the Teams app. Sure enough, the bit locker keys were there!! If he would have graduated or otherwise no longer have access to his school account, he would never have been able to recover the drive. Of course he has his important files in cloud storage anyway but it’s very annoying nonetheless
- rsync 4y ago
  "... Of course he has his important files in cloud storage anyway but it’s very annoying nonetheless ..." That doesn't sound reassuring if the cloud storage is, itself, Microsoft connected ... or even using auth/login mechanisms that connect to the Microsoft account.
  - roywashere 4y ago
    It is Google Drive, actually
    - usr1106 4y ago
      So good luck with Google customer support when Google's algorithms decide that your login attempt is suspect or your usage violated whatever terms of services they might have buried in their legalize.
- Groxx 4y ago
  Bitlocker is such a freaking user-hostile mess. I know what I'm doing with it and I still screw it up - I have no idea how non-technical people are supposed to have any idea what's going on. They're either totally unprotected or constantly at risk of losing everything even with professional help.
Terretta 4y ago
Using Edge (Microsoft flavored Chrome) and the account personas will let you keep these M365/O365/Live identities separate, in the same way Chrome does a first class job of keeping Google Accounts separate. Arguably, if you're one of the 85% of SMBs in O365/M365 instead of Google Workspaces, or if your "Login with..." personal account is Microsoft instead of Google or Apple, you should be using Edge.
berniedurfee 4y ago
It’s not just MS, auth is a mess everywhere. Everyone wants to own your identity and we’ve ended up with an insane web of trust. The many standards around identity management makes the web more complex. Most of us have many identities and we end up with a multidimensional web of tokens and cookies. I think at some point something will have to give. This seems like a space where some more provider consolidation or collaboration would help. Security is so important to get right, yet too easy to get wrong.
- deleted 4y ago
  [deleted]
jaybrendansmith 4y ago
After spending three months trying to migrate legit accounts to MSFT Auth, I agree with this comment completely. Their account migration approach is broken from the start, but more importantly, there is absolutely no customer support. What should have been a 5 minute phone call turned into a 3 month long chat and email nightmare, with multiple support reps telling me there was nothing they could do. Apple is not really any better. God help you if you accidentally lock your Apple ID, you will be subject to a month-long wait before it can be fixed. Why that long? No idea. Nobody at Apple has any idea why it couldn't just be 2 days, and they will frankly admit to you that it makes no sense, then spout some meaningless 'because of GDPR regulations' nonsense that has absolutely nothing to do with GDPR regulation.
AtNightWeCode 4y ago
You have only seen the tip of an iceberg. Try working as an IT-consultant. You have a half trillion different accounts. You can't work in multiple spaces while using the app. So you have to use a browser. Then, the problem is that you get logged off more or less instantly if the tab is not active.
tenebrisalietum 4y ago
Only reliable way of multiple SSO for Microsoft stuff I've found is: - Use different browser profile for each account - 2nd and subsequent account - use Teams in the browser - in the respective browser profile (teams.office.com). Teams in the browser is not substantially different than the desktop app.

hexmiles 4y ago

We also have some (a lot) problem with Teams, to the point that I started recommending my colleagues to use it from a browser and nuke cookie and other data every time the authentication stopped working. Basically when we login we need to use the "personal account" but sometimes it will not ask what account to use and automatically choose the wrong one, and once it gets stuck in this state i didn't find a way to fix it.

barbazoo 4y ago

This gave me flashbacks I was happy to forget about. Microsoft's SSO is nuts, at least with the browsers I used at the time. Might work better with Edge.

somat 4y ago

Unfortunate, it sounds like a mess and a half. Does any one know. If I found myself in the same situation would creating different windows accounts, one for each teams/azureAD account help keep them separate?

theK 4y ago

Yeah, the identity side of MS products is really dysfunctional. Every time I try to use teams or azure it ends up in hours of finding out the right procedure to log in or switch an account effectively. And then you get the people asking naively "why are you getting so mad at them"...

AtlasBarfed 4y ago
This is a buyer beware of some security policies. I just want to point out that this entire described scenario, by a company with decades and decades of security products being shoehorned into "just good enough" cloud infrastructure.... Sure the security folks will say hardened infrastructure with fine grained least privilege is doable ... if you're at greenfield ... maybe. But the issue with lots of IT orgs is that they are MESSY, and fine grained least privilege is fragile. Messy + fragile = not good things. I agree with least privilege as an aspiration, but security is a top-down authoritarian entity in organizations, and fundamentally they don't care if their policies disrupt your daily work process. IMO this is because most security orgs don't provide solutions. Specifically, by solution I do not mean "picked an enterprise security product bam we have a solution", I mean you have a security architecture and then have the people with bandwidth to help boots on ground devs get the job done quickly so security isn't a blocker).
ly3xqhl8g9 4y ago
Solution: run Windows in a VM, one machine per account, nuke it from orbit when-not-if something goes awry. Hundreds of hours of frustration prevented from a system that is not even able to have the same UI across all its windows.
- ccouzens 4y ago
  Or run apps like Teams in a web browser. Web browsers have good isolation techniques like Chrome's profiles and Firefox's containers. Teams is written using web technologies so you're getting the same experience as the app.
  - adamzochowski 4y ago

AstixAndBelix 4y ago

I mean, this sounds to me exactly like what happens when trying to mix normal Google accounts and Google Workspace ones, especially if the admin enabling all the service is not yourself. It's not just Microsoft, this is a problem all these service providers have because they can't cope with hybrid use

vasco 4y ago
With Google you change the ID in the URL and you're in whatever account you want. All the urls usually have /u/<id> where ID starts at 0 with the first account you're logged in into, 1 the second etc.
- AstixAndBelix 4y ago
  But what happens when you are using a Google product not served from the browser?
gchadwick 4y ago
I've got a number of Google accounts, two work ones (associated with different domains with distinct permissions and access to things, using drive, gdocs, Gmail and GCP with both) and a number of personal ones (some of which are associated with a Google workspace that I use for email under my personal domain) and it all works just fine for the most part. Groups and GCP console can sometimes get stuck on one account but Chrome with profiles can side step that one. Doing the same thing with MS accounts has been an utter nightmare by comparison.

hdjjhhvvhga 4y ago

This is obviously done on purpose. In the same way that Google ties users to Android devices when you add a Gmail account, MS takes every opportunity to assign their online account whenever they catch you off guard (installing a local Teams app instead of joining through the browser, signing into Minecraft at your school etc.). At this point you need to go through all the steps of dissociating your account from these devices. Sometimes they will reassign them after an update, so you need to watch out. For that reason I never use MS online apps on my private devices and whenever I need to sign in online, I always use the private mode or a dedicated Firefox container.

alentred 4y ago
Although I agree that companies (Microsoft, Google, etc.) deliberately seek to authenticate you across the web, I do not think that the general mess with Microsoft authentication is on purpose. It looks like generations of implementations (and likely generations of product management and development teams) layering on top of each other, "replacing" the "old" systems only to do the half of it, and integrating with acquired products. Seen from outside, it just doesn't look like there exists a single team that understands the authentication and permission system end-to-end.
- makeitdouble 4y ago
  > I do not think that the general mess with Microsoft authentication is on purpose. Microsoft has been dealing with online identity almost since the consumer web exists. MSN launched in 1995, Outlook was the poster child of webmail, ActiveDirectory is the behemoth of enterprise user management. I don’t see Hanlon’s razor relevant when it’s on one of their core competency. They at least committed to throw part of their users under the bus to pursue their goals.
  - gbear605 4y ago
    As I see it, Microsoft has become so incompetent as an organization that they can no longer be said to have core competencies.
- 4y ago

isodev 4y ago

I have the same experience! In my case, my personal and professional Microsoft addresses are the same (same email, different accounts) which means that in many cases I end up in impossible situations when the login screen doesn’t correctly guess if I want to sign in personal or with my “work” account. I also do client work for organisations where I need to sign into their O365 and honestly the only way to manage all that is to keep a dedicated browser “per account”. Teams is a different story, I avoid account switching because exactly like you describe, sometimes I need to uninstall it in order to sign out.

prmoustache 4y ago
Using same email address is deliberately asking for problems.
- motoboi 4y ago
  I once got enrolled to a school and they asked my email. Didn't know it was for teams access. Now, 4 years later I still get to choose wether I want to login in their tenant or mine everytime. Microsoft solution? Change my email on the personal account. Not kidding.
  - twodave 4y ago
    That sucks. If your email provider supports +suffixes you may be able to work around it that way.
  - Symbiote 4y ago
    Can you 'leave' the organization here? https://myaccount.microsoft.com/organizations https://myaccount.microsoft.com/organizations
ragingroosevelt 4y ago
A perfect use for Firefox container tabs! It's the only way I can keep my personal, work, and alma mater email separate and not falling into login loops.

mastazi 4y ago

> Auth with MS accounts is a giant mess. It is indeed a giant mess. If you go to live.com and click on the hamburger icon at the top, then under 'Apps' click on the "To-Do" app, you will be asked to enter the password for your work account, even though you are on live.com, not on office.com, and you are currently logged in with your personal account. The only way to get past this is to click "use another account" then log in again with your personal account (even though you are already logged in!!). This bug has been present for months now.

smashah 4y ago
This is partly because loginHint is broken on microsoft/azure sign in
dybber 4y ago
Same on Gmail. I’m not logged in on my private account as I don’t use it anymore, but it always suggests to log me in on the private account when accessing, even though I am logged in on a corporate account, which is the only one I’m actively using at the moment. Silly.
- ncann 4y ago
  I don't get your scenario but I have to say I never had any issue with using multiple Google accounts on the same browser. I used to have 5+ accounts logged in at once (personal + work + school) and it always worked flawlessly, switching between accounts was always a breeze using the drop down menu on the top right, and not just for Gmail but any Google apps. Microsoft on the other hand gave me endless issues when trying to use just 1 personal account and 1 work account on the same browser.
frankfrankfrank 4y ago
First mistake is using any of the Microsoft knock off services whose primary purpose is to trick “deciders” in the C-suits and in halls of bureaucratic hell that can confirm that the box for things like “to do” functionality is checked on their list. Every single Microsoft service, including email, several decades later, is still deep into subpar.

alentred 4y ago

> Auth with MS accounts is a giant mess. I agree. It is surprising that we don't see similar issues more often. It is *so* confusing to both users and the developers, to the point where it's too easy to make some naive mistakes. And it is one of most critical parts of the systems!

brightball 4y ago

It’s much worse than just auth too. Microsoft’s security policy around email is so bad that using Office 365 email should be considered a security problem. They’re actively enabling phishing because they choose to rollback standards support. https://www.brightball.com/articles/how-microsoft-became-phishings-biggest-enabler https://www.brightball.com/articles/how-microsoft-became-phi... https://news.ycombinator.com/item?id=34911811 https://news.ycombinator.com/item?id=34911811

easton 4y ago

Because of a quirk of my employment, my AAD account was deleted and recreated, which means I now have two Azure DevOps accounts with the same email, one of which is unlicensed (and not attached to an AAD identity). It is fairly random which one it tries to sign me in with, and every once in a while clicking on a link in ADO will sign me out because it got confused about who I was. It’s insane, and there’s no way to nuke the old account.

bouke 4y ago
I have the same issue. I’ve had a support call with an engineer about this and they have no idea how to fix this. If you sort the user list ascending it lists the one account and if you sort descending it lists the other. So changing the sorting should at least show _some_ license.

roywashere 4y ago

My son has a personal Windows 11 Lenovo laptop and he is signed in with his personal Microsoft account. The laptop went away for repairs because the touchpad no longer worked. When it returned, it turned out they replaced the main board so the bit locker keys needed to be entered again. These are typically stored in your Micsosoft account only they were nowhere to be found. Some help article on the MS website explained that sometimes it could happen that the keys are migrated to a school account. He only ever used his school account from the Teams app. Sure enough, the bit locker keys were there!! If he would have graduated or otherwise no longer have access to his school account, he would never have been able to recover the drive. Of course he has his important files in cloud storage anyway but it’s very annoying nonetheless

rsync 4y ago
"... Of course he has his important files in cloud storage anyway but it’s very annoying nonetheless ..." That doesn't sound reassuring if the cloud storage is, itself, Microsoft connected ... or even using auth/login mechanisms that connect to the Microsoft account.
- roywashere 4y ago
  It is Google Drive, actually
  - usr1106 4y ago
    So good luck with Google customer support when Google's algorithms decide that your login attempt is suspect or your usage violated whatever terms of services they might have buried in their legalize.
Groxx 4y ago
Bitlocker is such a freaking user-hostile mess. I know what I'm doing with it and I still screw it up - I have no idea how non-technical people are supposed to have any idea what's going on. They're either totally unprotected or constantly at risk of losing everything even with professional help.

Terretta 4y ago

Using Edge (Microsoft flavored Chrome) and the account personas will let you keep these M365/O365/Live identities separate, in the same way Chrome does a first class job of keeping Google Accounts separate. Arguably, if you're one of the 85% of SMBs in O365/M365 instead of Google Workspaces, or if your "Login with..." personal account is Microsoft instead of Google or Apple, you should be using Edge.

berniedurfee 4y ago

It’s not just MS, auth is a mess everywhere. Everyone wants to own your identity and we’ve ended up with an insane web of trust. The many standards around identity management makes the web more complex. Most of us have many identities and we end up with a multidimensional web of tokens and cookies. I think at some point something will have to give. This seems like a space where some more provider consolidation or collaboration would help. Security is so important to get right, yet too easy to get wrong.

deleted 4y ago
[deleted]

jaybrendansmith 4y ago

After spending three months trying to migrate legit accounts to MSFT Auth, I agree with this comment completely. Their account migration approach is broken from the start, but more importantly, there is absolutely no customer support. What should have been a 5 minute phone call turned into a 3 month long chat and email nightmare, with multiple support reps telling me there was nothing they could do. Apple is not really any better. God help you if you accidentally lock your Apple ID, you will be subject to a month-long wait before it can be fixed. Why that long? No idea. Nobody at Apple has any idea why it couldn't just be 2 days, and they will frankly admit to you that it makes no sense, then spout some meaningless 'because of GDPR regulations' nonsense that has absolutely nothing to do with GDPR regulation.

AtNightWeCode 4y ago

You have only seen the tip of an iceberg. Try working as an IT-consultant. You have a half trillion different accounts. You can't work in multiple spaces while using the app. So you have to use a browser. Then, the problem is that you get logged off more or less instantly if the tab is not active.

tenebrisalietum 4y ago

Only reliable way of multiple SSO for Microsoft stuff I've found is: - Use different browser profile for each account - 2nd and subsequent account - use Teams in the browser - in the respective browser profile (teams.office.com). Teams in the browser is not substantially different than the desktop app.