PharmaGrade Peptides

Microsoft Sign-In — Credential Setup Guide

How to create the Microsoft credentials (Application ID + Client Secret) that switch on the “Continue with Microsoft” button on the login form. No coding involved — about 10 minutes.

⏱ ~10 minutes 👤 Any Microsoft account (personal or work) 💶 Free — nothing to pay 🔁 Done once for dev + live site

What you are creating

Microsoft requires every website that offers “Sign in with Microsoft” to be registered in the Microsoft Azure portal. That registration gives you two pieces of text — an Application (client) ID and a Client Secret — which you paste into the WordPress admin. The website handles everything else.

1

Sign in to the Azure portal

Open the portal and sign in with any Microsoft account:

https://portal.azure.com
First time with a personal account? Azure may ask a couple of one-time questions (country, company name) to create your free default directory. Accept the defaults — it is free and takes under a minute.
2

Open “App registrations” and start a new app

  1. In the search bar at the top of the portal, type App registrations and open it.
  2. Click + New registration (near the top).
3

Fill in the registration form most important step

  1. Name: anything you like, e.g. PharmaGrade Peptides Sign-In.
  2. Supported account types: select the third option — “Accounts in any organizational directory and personal Microsoft accounts (e.g. Skype, Xbox)”. This is what lets both personal and work accounts sign in.
  3. Redirect URI (optional): set the first dropdown to Web and paste the Authorized redirect URI exactly as it appears in the WordPress admin under Settings → PharmaGrade Access → Sign-In Providers → Microsoft.
  4. Click Register.

The redirect URI currently shown on the development site is:

http://localhost:10399/
Copy it exactly. The address must match character for character — same http/https, same domain, same port, and the trailing slash. Microsoft rejects the sign-in if even one character differs. When the site moves to its live domain, add the live address the same way (see the last section).
4

Copy the Application (client) ID

Right after registering, Azure shows the app’s Overview page. Find the field “Application (client) ID” and copy its value (a long code like 00001111-aaaa-2222-bbbb-3333cccc4444). Keep it for step 6.

5

Create the Client Secret

  1. In the left menu of your new app, click Certificates & secrets.
  2. On the Client secrets tab, click + New client secret.
  3. Description: e.g. PharmaGrade sign-in. Expires: choose 24 months (the longest option).
  4. Click Add. A new row appears with two columns: Value and Secret ID.
Copy the “Value” column now — it is shown only once. This is the password the website needs. The “Secret ID” column is just a label and will not work. If you leave the page without copying it, simply create a new secret.

Keep both pieces of text for the next step. Treat the secret like a password — share it only through a secure channel.

6

Paste the credentials into WordPress

  1. In the WordPress admin, go to Settings → PharmaGrade Access.
  2. Open the Sign-In Providers card → Microsoft tab.
  3. Paste the Application (client) ID into “Application (client) ID”.
  4. Paste the secret Value into “Client Secret (value)”.
  5. Leave “Directory (tenant) ID” as common.
  6. Click Save Settings.

The status line flips to “Microsoft sign-in is active” and the button appears on the login form automatically.

7

Test it

  1. Open the site’s login page (sign out first, or use a private/incognito window).
  2. Click Continue with Microsoft.
  3. The first time, Microsoft shows a short consent screen (“You are signing in to …”) — click Accept/Yes.
  4. You land back on the website, signed in. An account is created automatically with your Microsoft email if one does not exist yet.

When the website goes live

One app registration serves both development and production. After launch, add the live site’s address to the same app: open your app in Azure → Authentication → Add URI (platform Web) → paste the Authorized redirect URI shown on the live site’s settings page (it will look like https://your-domain.com/) → Save. Nothing else changes in WordPress.

Keeping it working

Client secrets expire (24 months at most). About a month before expiry, create a new secret (step 5), update the value in WordPress, and delete the old one. Microsoft also sends reminder emails to the account that owns the registration.

If something does not work

What you seeWhat it means and the fix
“redirect… does not match” (AADSTS50011) The Redirect URI registered in Azure differs from the one in the WordPress settings — check the trailing slash, http vs https, and the port. Re-copy it from the settings page.
Sign-in fails immediately, “invalid client” The secret is wrong — most often the Secret ID was pasted instead of the Value, or the secret was deleted. Create a fresh secret and paste the Value.
Button still says “needs setup” Both fields (ID and Secret) must be filled in and saved for the button to switch on.
A work/school user sees “Need administrator approval” Some companies require their IT admin to approve external sign-in apps once. Personal Microsoft accounts are not affected.