Can't sign in with FIDO2 key on office.com

I use FreeOTP with it just fine.

I use Keepass with it just fine.

Works fine with 1Password One Time password.

I use it with 1Password?

There's a "use different authenticator app" button, but it can be disabled by the domain admin and that might be the default depending on when your Azure AD domain was set up.

The fact that you can set a domain to MSA/TOTP or MSA-only, but not TOTP-only, is an incredibly scummy, but incredibly predictable move by MS.

Fortinet do the same, you need their own app to generate the codes. Infuriating.

Those ms-msa URLs are for bootstrapping the system formerly know as PhoneFactor. It's not a TOTP at all, it's a two-way random value challenge. Microsoft supports TOTP as well, but Authenticator push challenges are more resistant to several types of attacks than TOTP, so some Azure AD admins may make it the only option. There's also a convenience factor since manually entering numbers isn't necessarily required.

The latest madness is that logging on to Azure Portal with Firefox requires about ten clicks on the user name.

As in: I log in, jump through the MFA hoops, and then it goes back to the list of user names to make me re-select the account I just used to log in.

Mind you, it always did this, which meant that I couldn’t just open a Portal link in a new tab — I’d have to select my account (again) for each tab.

But now I have to click at least ten times!

It’s broken.

Authentication is broken and there’s no one at the wheels.

I have spent weeks just trying to log onto Teams to communicate with an MS contracting shop. I still have not managed to log in. It is infuriating beyond belief.

> You get bounced between a half-dozen domains

At work one of the cdn domains they use fails to resolve until it suddenly works. Haven't bothered to look into it yet, but generally takes about 10-15 minutes to sign into anything related to Azure AD / Office365.

Can resolve it just fine on the command line, just in the browser where it doesn't work.

Same with the Azure Portal, I can regularly DoS microsoft by opening the portal from a bookmark in Edge, or by switching Azure tenants (via the official button, which has also seen three different locations in the past year). It signs in, loads the intended page, then redirects to the home page, which performs the sign-in again, then redirects to the Azure portal welcome screen, which redirects to the home page, which performs the sign-in again -- at which points Microsoft usually "solves" the redirect loop by informing me that I've tried to login too many times and I should try again in five minutes.

With the additional bonus that even after things miraculously stabilize, I'm not on the page I wanted to go but on the welcome screen. Pasting the intended link again in the browser bar seems to have a 10% chance of triggering the redirect loop again. It's so comically bad, I'm glad my employer is paying me for my time and not my productivity.

And the domains look ancient or shady as well. Live.com, aka.ms, msn.com…if you didn’t already know they were genuine Microsoft accounts you’d be smart to assume you were being scammed.

They also introduced 2F verification pop ups that don’t show up in the task bar and are therefore not selectable when they are behind another window.

Also some of that bouncing around involves passing your email into the URL (?account=you@outlook.com) which is just bizarre in current day (tm).

My AAD account is permanently screwed up because I left and rejoined the company I’m at (intern conversion, so I got a new AAD account with the same email).

I get signed out constantly, especially on mobile where my coworkers do not. Trying to sign into ADO sends me to a screen prompting me to configure a new org because it gets confused by two accounts existing with the same email in the same org even though one of them was deleted along with the underlying AAD account. It also just 500s sometimes when trying to login saying there’s something weird happening during authentication, I have to restart the browser to make it work.

As far as I know there’s no way to fix any of it, so I’m stuck with half working SSO.

Random stuff breaking or things not working quite right is to be expected with Microsoft products.

> integration tests of any kind

No!

Microsoft famously fired their entire QA team. Also… their technical writing team. And then they outsourced both support and the bulk of their development to India.

You get what you pay for, and right now Microsoft is variously paying either zero or very little.

Microsoft devs have a reputation of being quite sub par.

Now that you mention malice, here's a smoking gun, from the linked bug report:

> (it's not an issue with Firefox's implementation. This can be demonstrated by spoofing the useragent as a Chromium-based browser and attempting the same login flow […]).

Humble Bundle seems to have started doing that to me at times with a Firefox on Linux user agent. Support just gaslights me about clearing cookies and checking I typed the password correctly, even though it will work if I use Chrome or just wait a few days.

If you filter by status, there's nothing in that feedback channel that's had its status changed for several months, and none of the issues there are marked fixed, so there's probably some other way this sort of thing is meant to be reported. According to their help page in outlook.com:

"Microsoft 365 subscriptions include premium customer support, so if you need to contact Microsoft for help, you'll get our highest level of service."

> Why should they care about Firefox?

Maybe that's a question for them to answer since they actively block it with user agent checks

If they truely did not care about Firefox, it would have worked.

They care enough to make to it specifically /not/ work on Firefox, because it works if Firefox lies about what it is.

They actually went out of their way to block Firefox here. The authentication protocol is a standard supported by all browsers, and if you change the user–agent string to look like Chrome’s then magically it starts working again.

So I guess Safari would go too?

6% of 5 billion is disregarding about 300 million users.

Should MS care enough about 300 megausers to make sure their login flow works? Uh, yeah.

My personal opinion, as a foss developer who does more than 90% of the commits on a relatively complicated Web aplication, is: NEVER. I have committed myself to supporting every browser in every configuration, because anything less is non-inclusive and assumptive about the user's abilities and capabilities. I will always bend over backwards to accommodate every user, because I want the experience of visiting my websites to be like that of a luxury hotel that caters to every need, rather than project housing or prison that forces to conform. I also think it is rather rude to assume that the user can change anything about their setup. I think of this type of accommodation as wheelchair ramps, which serve only a small demographic, but are pretty much universally agreed upon as being necessary.

And yes, I support Internet Explorer, Lynx, and NetSurf.

> Is reasonable to expect a company to go out of their way to spend resources fixing something that works fine for 94% of their users, using any of several alternate browsers?

Out of their way implies they have to do anything more than implement the standard and don't do browser sniffing, which has always been a bad practice and especially since feature testing has become more widespread. A sibling comment highlighted the part that it works if the user-agent is changed to Chrome.

So, here's my take to your original question: If a feature has a backing standard, companies, especially those above a certain size, should be forced to follow the standard for that feature and not include any kind of "only allow using this feature if we have tested it in the browser" code. If the company states they cannot do that (cause they have a policy to only allow features in browsers they've tested or whatever), they should be forced to support everyone.

Another good reason to force support for everyone should be if the company has their own browser.

I would say that there's a moral imperative to support Firefox for as long as it remains the only major open source alternative implementation of HTML/CSS/JS to Blink. We've been there before, and monocultures are just bad all around, so it's important for something like this to exist and be supported for the eventual inevitable day it will be needed.