Summary

• replace the deprecated Windows Live API and both login UIs with Microsoft Identity Platform v2 and Microsoft Graph through the OAuth2 library's MicrosoftClient
• add the modern Microsoft identity first, then remove a stored WindowsLive identity only after a successful Microsoft response for the authenticated user, an existing modern identity, or an exact-email match
• remove the bundled legacy client ID, retain blank MicrosoftId configuration slots, and expose the renamed public client-ID constant without logging OAuth secret values

This intentionally does not change self-hosting documentation, Kubernetes values, Docker Compose samples, the vendored Satellizer library, or unrelated HTTP samples.

Migration behavior

• Microsoft Graph IDs are not compatible with Windows Live IDs, so there is no bulk ID rewrite
• an authenticated account-link operation updates that user even when Microsoft returns a different email address
• an unauthenticated sign-in reuses an existing modern identity or exact-email match
• an unmatched unauthenticated email creates a separate user and leaves the legacy user unchanged
• provider failures do not modify stored identities

Microsoft setup

1. Create a Microsoft Entra app registration that supports accounts in any organizational directory and personal Microsoft accounts.
2. Register each Exceptionless UI origin as a Web redirect URI. The redirect URI is window.location.origin, so it must match the deployed origin exactly.
3. Add delegated Microsoft Graph User.Read and create a client secret.
4. Configure MicrosoftId=<client-id>;MicrosoftSecret=<secret>; in EX_ConnectionStrings__OAuth.

The server uses the OAuth2 library's Microsoft client: https://github.com/titarenko/OAuth2

Breaking changes

• removes POST /api/v2/auth/live and replaces it with POST /api/v2/auth/microsoft
• removes the bundled legacy Windows Live client ID; Microsoft login stays hidden until a new app registration is configured

Verification

• dotnet build --no-restore: 0 warnings, 0 errors
• focused authentication and API contract tests after merging current main: 56 passed
• Svelte validation: 0 errors and 0 warnings; unit tests: 326 passed; production build passed
• Angular lint and production build passed on Node 22
• both packaged config scripts were exercised with a fake client ID and secret; the client ID was emitted and the secret was not

Live Microsoft consent and callback verification remains pending a real client ID and secret.