adamfowlerit / msportals.io

MSPortals.io - Microsoft Administrator Sites, Training, and Licensing Resources
https://msportals.io/
251 stars 100 forks source link

[BUG] Some links don't work if signed into Personal MS Account and Work Account #70

Open PsychoData opened 3 years ago

PsychoData commented 3 years ago

Describe the bug Some links may not work if you are signed into multiple accounts - particularly signed into an MS Account and a Work/School account.

To Reproduce Steps to reproduce the behavior:

  1. Start a new Incognito/InPrivate session to avoid existing sessions interfering
  2. Sign in to your work/school - I used myapps.microsoft.com/domain.com to trigger it for me
  3. Sign in to your Microsoft Account - I find that account.microsoft.com/profile > Sign In is a good site to use to force a Microsoft Account sign in
  4. Confirm that both myapps.microsoft.com/domain.com and account.microsoft.com/profile take you through to a page in the correct work/school or personal account without prompting for a fresh sign in
  5. Try this link from the End User page - End User - Sharepoint
  6. This either signed me into the Microsoft Account directly, which dumped me at www.office.com because there was no SharePoint app for the Personal account, or at best prompted me for which account I wanted to use like below image

Expected behavior Ideally, this would either force you to select from a list of current AzureAD Accounts only when you clicked on SharePoint, or sign you into your only AzureAD Account if you were only signed into one AAD Account.

Additional Context The above End User - Sharepoint link works by redirecting you to https://www.office.com/launch/sharepoint, but Office.com can accept Personal/Microsoft accounts (MSA) and Work/Azure AD (AAD) accounts as well. I believe issue should also hold true for most of the *.office.com links - at least the www.office.com links. For example, in two different browsers I am signed into my Work and Personal accounts, but www.office.com/launch/onenote takes me to my Work account in one and my Personal account in the other.

ivandretvic commented 2 years ago

This is going to be more of an issue on the Microsoft side, and could only be remedies if there is a URI parameter that can be passed in. I have not come across any that may target work/school accounts, and if they do, its usually specific to a tenant like https://passwordreset.microsoftonline.com/?whr=contoso.com

The recommendation we always have is to separate accounts using browser profiles.

PsychoData commented 2 years ago

the issue follows more when you have something like "login_hint" or if you are hitting with "office.com" links rather than "Office365.com" or "Microsoft.com" links

However, I couldn't find a link that would send you to SharePoint without sending by way of "Office.com" - like the above Link which attempts to redirect you to https://www.office.com/launch/sharepoint The main trouble I would fine with this was that the sharepoint links were tenant-specific, like tenantname.sharepoint.com or possibly https://www.office.com/launch/sharepoint?whr=tenant.com would work - but either way - to keep it generic for all tenants, I haven't found a good link/route that will force Work Account and then send to Sharepoint.

for a bit I thought I might be able to with login.microsoft.com/common/ sort of links - similar to how you could make a login.microsoft.com/consumer/ link to some things to force "Microsoft" account but not "Work/School" account - but without constructing an app that supports explicitly WORK accounts, but not PERSONAL accounts (and possibly requiring people to approve permissions?)- I'm not sure this is possible with the current tools available

adamfowlerit commented 1 week ago

Is this still an issue @PsychoData ?