{"id":1777,"date":"2026-10-27T06:19:17","date_gmt":"2026-10-27T06:19:17","guid":{"rendered":"https:\/\/help.mecard.my\/?post_type=docs&#038;p=1777"},"modified":"2026-10-27T06:33:10","modified_gmt":"2026-10-27T06:33:10","slug":"microsoft-oauth-2-explained","status":"publish","type":"docs","link":"https:\/\/help.mecard.my\/zh\/docs\/microsoft-oauth-2-explained\/","title":{"rendered":"Microsoft OAuth 2.0"},"content":{"rendered":"<!-- MeCard Help \/ WordPress Custom HTML. Self-contained HTML, CSS and screenshots; no JavaScript. -->\n<style>\n.mc-doc{max-width:1000px;margin:auto;color:#171717;font:16px\/1.65 Arial,Helvetica,sans-serif;overflow-wrap:break-word}\n.mc-doc *{box-sizing:border-box}.mc-doc h1,.mc-doc h2,.mc-doc h3{font-family:inherit;color:#111;line-height:1.3}\n.mc-doc h1{font-size:36px;margin:0 0 10px}.mc-doc h2{font-size:25px;margin:28px 0 12px}.mc-doc h3{font-size:19px;margin:0 0 10px}\n.mc-doc p{margin:0 0 12px}.mc-doc ul,.mc-doc ol{margin:8px 0 14px;padding-left:22px}.mc-doc li{margin:6px 0}\n.mc-doc a{color:#151515;text-decoration:underline;text-underline-offset:3px}.mc-doc strong{font-weight:700}\n.mc-doc .mc-hero{padding:28px 30px;background:#111;color:white;border-radius:14px}.mc-doc .mc-hero h1{color:white}.mc-doc .mc-hero p{color:#d6d6d6;margin:0}\n.mc-doc .mc-eyebrow{font-size:12px!important;font-weight:700;letter-spacing:2px;text-transform:uppercase;margin-bottom:10px!important}\n.mc-doc .mc-nav{display:flex;flex-wrap:wrap;gap:8px;padding:14px 0;margin-bottom:14px;border-bottom:1px solid #dedede}\n.mc-doc .mc-nav a{padding:7px 12px;border:1px solid #ccc;border-radius:7px;text-decoration:none;font-size:13px;font-weight:bold;background:#f7f7f7}\n.mc-doc .mc-nav a[aria-current=page]{background:#111;color:#fff;border-color:#111}\n.mc-doc .mc-card{border:1px solid #d5d5d5;background:#fff;border-radius:12px;padding:18px 20px;margin:14px 0}\n.mc-doc .mc-soft{background:#f4f4f4;border:1px solid #e0e0e0;border-radius:10px;padding:15px 18px;margin:15px 0}\n.mc-doc .mc-step{border:1px solid #ddd;border-radius:12px;padding:18px 20px;margin:13px 0}\n.mc-doc .mc-step-num{display:inline-block;color:#fff;background:#111;border-radius:5px;font-size:13px;font-weight:bold;padding:3px 10px;margin-bottom:10px}\n.mc-doc figure{margin:15px 0 6px;padding:12px;border:1px solid #ddd;border-radius:10px;background:#f7f7f7;text-align:center}\n.mc-doc figure img{max-width:100%;width:auto;height:auto;border:1px solid #dedede;background:white}\n.mc-doc figcaption{font-size:13px;color:#555;text-align:left;margin-top:7px}\n.mc-doc .mc-two{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:13px}\n.mc-doc .mc-three{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:11px}\n.mc-doc .mc-flow{padding:15px 12px;border:1px solid #ddd;background:#f5f5f5;border-radius:10px;margin:12px 0}\n.mc-doc .mc-flow strong{display:block;margin-bottom:5px}\n.mc-doc .mc-table-scroll{overflow-x:auto;margin:14px 0;border:1px solid #d6d6d6;border-radius:10px}\n.mc-doc table{border-collapse:collapse;width:100%;min-width:560px;font-size:14px;margin:0}.mc-doc th,.mc-doc td{padding:10px 12px;border-bottom:1px solid #ddd;text-align:left;vertical-align:top}\n.mc-doc th{background:#efefef;color:#111}.mc-doc tr:last-child td{border-bottom:0}\n.mc-doc .mc-muted{font-size:14px;color:#626262}.mc-doc .mc-footer{margin-top:30px;border-top:1px solid #ddd;padding-top:15px;font-size:14px;color:#555}\n.mc-doc code{background:#f0f0f0;padding:2px 5px;border-radius:4px;font-size:.92em}\n@media(max-width:650px){.mc-doc{font-size:15px}.mc-doc h1{font-size:29px}.mc-doc h2{font-size:22px}.mc-doc .mc-hero{padding:22px 18px}.mc-doc .mc-two,.mc-doc .mc-three{grid-template-columns:1fr}.mc-doc .mc-step{padding:16px}.mc-doc .mc-nav a{font-size:12px;padding:6px 9px}.mc-doc figure{padding:7px}}\n<\/style>\n<div class=\"mc-doc\">\n  <header class=\"mc-hero\"><p class=\"mc-eyebrow\">MeCard \u00d7 Microsoft Entra ID<\/p><h1>Microsoft sign-in &#038; OAuth 2.0<\/h1><p>Understand secure Microsoft login, IT approval and approved employee information updates.<\/p><\/header>\n  <nav class=\"mc-nav\" aria-label=\"Related MeCard guides\"><a href=\"https:\/\/help.mecard.my\/zh\/docs\/microsoft-company-admin-guide\/\">Company Admin A\u2013Z<\/a><a href=\"https:\/\/help.mecard.my\/zh\/docs\/microsoft-oauth-2-explained\/\" aria-current=\"page\">OAuth 2.0 explained<\/a><a href=\"https:\/\/help.mecard.my\/zh\/docs\/microsoft-multiple-profiles-attributes\/\">Multiple profiles &#038; attributes<\/a><\/nav>\n  <section><h2>What connects to what?<\/h2>\n<div class=\"mc-three\"><div class=\"mc-flow\"><strong>Microsoft Entra ID<\/strong>Employee identity, sign-in, Security Groups and approved attributes.<\/div><div class=\"mc-flow\"><strong>OAuth 2.0 + OIDC<\/strong>Secure authorization and a signed employee identity token.<\/div><div class=\"mc-flow\"><strong>Microsoft Graph<\/strong>Read-only access to approved employee and group information.<\/div><\/div>\n<\/section><section><h2>1. Employee Microsoft sign-in<\/h2>\n<div class=\"mc-three\"><div class=\"mc-flow\"><strong>1. Employee<\/strong>Enters the Company Code supplied by their Company Admin and selects <strong>Login With Microsoft<\/strong> \u4e8e <a href=\"https:\/\/my.mecard.my\/\">my.mecard.my<\/a>.<\/div><div class=\"mc-flow\"><strong>2. Microsoft<\/strong>Authenticates the employee and applies company MFA and sign-in policies.<\/div><div class=\"mc-flow\"><strong>3. MeCard<\/strong>Verifies the signed ID token, tenant and already approved employee identity.<\/div><\/div>\n<p><strong>OAuth 2.0<\/strong> is used for the authorization-code exchange. <strong>OpenID Connect (OIDC)<\/strong> adds the verified identity token. MeCard uses the authorization-code flow with <strong>PKCE<\/strong>, state and nonce. A matching email alone cannot link an unauthorized Microsoft user to a MeCard account.<\/p>\n<div class=\"mc-soft\">The Company Code selects the correct organization; it is not a password and does not grant access. The employee enters Microsoft credentials on Microsoft&#8217;s sign-in service, not in MeCard.<\/div>\n<\/section><section><h2>2. Employee data and group verification<\/h2>\n<p>Employee information sync is separate from sign-in. The approved server connection uses OAuth 2.0 <strong>client credentials<\/strong> to obtain a Microsoft Graph access token. MeCard reads approved employee attributes and direct membership of selected Security Groups.<\/p>\n<div class=\"mc-three\"><div class=\"mc-flow\"><strong>Microsoft IT<\/strong>Approves permitted groups and read-only directory access.<\/div><div class=\"mc-flow\"><strong>\u516c\u53f8\u7ba1\u7406\u5458<\/strong>Reviews eligible staff, purchased cards and selected fields.<\/div><div class=\"mc-flow\"><strong>MeCard<\/strong>Publishes approved changes only to the mapped cards.<\/div><\/div>\n<p>A Microsoft Security Group answers <strong>who is eligible<\/strong>. MeCard profile\/role groups determine <strong>which cards, roles, markets and languages<\/strong> each approved employee receives.<\/p>\n<\/section><section><h2>3. What permissions are requested?<\/h2>\n<div class=\"mc-table-scroll\"><table><thead><tr><th>Purpose<\/th><th>Typical approved Graph application permission<\/th><\/tr><\/thead><tbody>\n<tr><td>Employee attributes<\/td><td><code>User.Read.All<\/code><\/td><\/tr><tr><td>Direct Security Group membership<\/td><td><code>GroupMember.ReadBasic.All<\/code> or an existing approved <code>GroupMember.Read.All<\/code><\/td><\/tr>\n<tr><td>Optional group-name discovery<\/td><td><code>Group.ReadBasic.All<\/code> or another approved supported read permission<\/td><\/tr>\n<tr><td>Optional profile photos<\/td><td><code>ProfilePhoto.Read.All<\/code> when separately approved<\/td><\/tr>\n<\/tbody><\/table><\/div><p>Microsoft IT reviews the actual Microsoft app permissions before consent. MeCard does not need broad directory write permissions for the documented flow. Client secrets stay in protected server configuration, not in a customer-facing page.<\/p>\n<\/section><section><h2>4. What stays under your control?<\/h2>\n<ul><li><strong>Company Admin:<\/strong> eligible employees, account\/card allocation, login method, profile fields, preview\/approval and translation reviews.<\/li>\n<li><strong>Microsoft IT:<\/strong> tenant\/application configuration, consent, approved groups and source attributes.<\/li>\n<li><strong>Employees:<\/strong> access only their linked MeCard account and assigned digital cards.<\/li><\/ul>\n<div class=\"mc-card\"><h3>Is legacy MS AD Sync needed?<\/h3><p>No. Microsoft Integration is the separate feature used for SSO and approved employee-data synchronization.<\/p><\/div>\n<div class=\"mc-card\"><h3>Will every card be changed automatically?<\/h3><p>No. Updates require approved sources, selected destinations and publication approval. Missing Microsoft values are not treated as instructions to erase existing card text.<\/p><\/div>\n<div class=\"mc-card\"><h3>Can one Microsoft employee have multiple digital cards?<\/h3><p>Yes. One verified Microsoft identity can be assigned multiple MeCard profiles for different roles, markets and languages. <a href=\"https:\/\/help.mecard.my\/zh\/docs\/microsoft-multiple-profiles-attributes\/\">See the attributes guide<\/a>.<\/p><\/div>\n<p class=\"mc-muted\">Official Microsoft references: <a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity-platform\/v2-oauth2-auth-code-flow\">OAuth authorization code + PKCE<\/a> \u00b7 <a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity-platform\/v2-protocols-oidc\">OIDC<\/a> \u00b7 <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/auth-v2-service\">Graph application access<\/a>.<\/p>\n<\/section>\n  <footer class=\"mc-footer\">MeCard: <a href=\"https:\/\/my.mecard.my\/\">my.mecard.my<\/a> \u00b7 More guides: <a href=\"https:\/\/help.mecard.my\/zh\/docs\/\">help.mecard.my\/docs\/<\/a><\/footer>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>MeCard \u00d7 Microsoft Entra ID Microsoft sign-in &#038; OAuth 2.0 Understand secure Microsoft login, IT approval and approved employee information [&hellip;]<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"doc_category":[15],"doc_tag":[],"class_list":["post-1777","docs","type-docs","status-publish","hentry","doc_category-azure-sso"],"_links":{"self":[{"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/docs\/1777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/comments?post=1777"}],"version-history":[{"count":2,"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/docs\/1777\/revisions"}],"predecessor-version":[{"id":1782,"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/docs\/1777\/revisions\/1782"}],"wp:attachment":[{"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/media?parent=1777"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/doc_category?post=1777"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/help.mecard.my\/zh\/wp-json\/wp\/v2\/doc_tag?post=1777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}