Repository navigation
OP2-81: Support personal Microsoft accounts (outlook.com, hotmail, live) - #17
Merged
Merged
Conversation
Personal accounts get their own sign-in path on /consumers, chosen up front in the add-connection dialog. Work sign-ins stay on /organizations, so Microsoft's picker never shows a work and a personal account with the same address side by side (the wrong-mailbox trap /organizations exists to avoid). - EntraOptions.PersonalAccounts (off by default; needs the app registration's signInAudience = AzureADandPersonalMicrosoftAccount) and ConsumerAuthority. - The authority follows the account on authorize, code redemption and every silent refresh. - Personal accounts are not asked for work-only scopes (User.ReadBasic.All, Calendars.Read.Shared, Chat.Read, ChatMessage.Send). - Pending sign-ins are marked personal with tenant hint "consumers", or the consumer tenant id on reconnect, so there is no schema change. Reconnecting an existing personal connection still works after the switch is turned off. - Graceful degradation: Teams tools and the resolver say Microsoft does not offer the feature to personal accounts instead of asking for a reconnect; find_person skips the directory; suggest_meeting_times prefers a work calendar on fan-out and explains otherwise; the connections page labels these "Not available on personal Microsoft accounts". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7auris7aiG4VxGYpBMpuT
suggest_meeting_times was handled; check_availability was left to find out at Graph, and the PR listed it as an unticked box. Microsoft's permissions table for calendar: getSchedule settles it — "Delegated (personal Microsoft account) | Not supported." — so a personal connection would have met an error where its sibling explains itself. Same shape as suggest_meeting_times: a personal account is last choice on a fan-out rather than first, and a lone personal connection is told Microsoft keeps other people's free/busy times to work or school accounts. Also checked the other half of that question, since it would have been the next surprise: /me/mailboxSettings IS supported for personal accounts, so exact times print the account's own zone. Its format is whatever Microsoft returns with no administrator to set one, and CalendarService.TryResolve (OP2-285) already tries both the IANA and Windows spellings, so nothing is needed there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7aurjxxqEYmeNDuAinHyQ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements YouTrack OP2-81: let users connect personal Microsoft accounts (outlook.com, hotmail.com, live.com), not just work or school accounts.
Approach
Personal accounts get a separate sign-in path through
/consumers. The user picks the kind of account up front in the add-connection dialog. Work sign-ins stay on/organizations. Switching to/commonwould have brought back the picker where a work account and a personal account with the same address look identical, which is how a past connection ended up on the wrong mailbox.EntraOptions.PersonalAccounts(ENTRA_PERSONAL_ACCOUNTS, off by default). It needs the app registration'ssignInAudienceset toAzureADandPersonalMicrosoftAccount. Until it's on, the option isn't shown./consumers.consumers, or the consumer tenant id on reconnect.Handling features personal accounts don't have
User.ReadBasic.All,Calendars.Read.Shared,Chat.Read,ChatMessage.Send.find_person: skips the company directory lookup for personal accounts.suggest_meeting_times: uses a work calendar when one is available, and otherwise explains why it can't help.Testing
PersonalMicrosoftAccountTests(12 tests) covers which sign-in each account type uses, which permissions are requested, no domain hint for personal accounts, the on/off setting including reconnect, account-type detection, and the messages shown to users.Web.*page tests, which need the dev Vault on:8200. That wasn't available, and they fail the same way onmain. The dialog and connections-page changes have been compiled but not exercised by those tests.Before merging
ENTRA_PERSONAL_ACCOUNTS=truecheck_availability(getSchedule) works for a personal account. It's unchanged here.Web.*tests with Vault upGenerated by Claude Code