Microsoft Azure AD

Overview

Microsoft Azure AD (now rebranded as Microsoft Entra ID) is a cloud-based identity and access management service that provides single sign-on (SSO), multi-factor authentication, and directory services for web applications. When detected on websites, Azure AD handles user authentication flows — allowing visitors to sign in with their organizational Microsoft accounts or personal Microsoft accounts. It is the identity backbone for Microsoft 365 applications and is widely adopted by enterprise web applications for workforce and customer-facing (B2C) authentication.

What This Script Does

Azure AD authentication integrates through the Microsoft Authentication Library (MSAL) and OAuth 2.0/OpenID Connect protocol flows.

• Scripts loaded: The Microsoft Authentication Library (msal-browser.js from alcdn.msauth.net or bundled into the application) handles token acquisition, refresh, and session management. The login flow redirects to login.microsoftonline.com for credential entry.
• Authentication flow: Users click a sign-in button, triggering either a redirect to login.microsoftonline.com or a popup window. After entering credentials and completing any multi-factor authentication, Azure AD returns an ID token and access token to the application.
• Cookies set:
  • Session cookies on login.microsoftonline.com for maintaining the authentication state during the sign-in flow
  • ESTSAUTH, ESTSAUTHPERSISTENT — Microsoft authentication cookies that maintain SSO state across Microsoft services, enabling seamless sign-in without re-entering credentials
  • buid, fpc — Azure AD cookies for browser and device identification during the login flow
  • First-party session cookies set by the application to maintain the authenticated state after login
• Token storage: MSAL stores access tokens and refresh tokens in the browser's sessionStorage or localStorage (configurable) to maintain the session and silently refresh tokens without user interaction.
• No tracking: Azure AD authentication scripts do not track browsing behavior or set advertising cookies. All data processing is related to identity verification and session management.

Consent & Compliance

Microsoft Azure AD falls under the essential consent category.

Under GDPR and ePrivacy, authentication cookies and token storage are strictly necessary for providing the sign-in service explicitly requested by the user. The ePrivacy Directive exempts cookies that are essential for a service the user has asked for. GDPR legal basis is Article 6(1)(b) — processing necessary for the performance of a contract (user account access). The ESTSAUTH cookies on login.microsoftonline.com maintain SSO state and are integral to the authentication flow.

Under CCPA/CPRA, identity data processed during authentication (email, name, directory attributes) is collected to provide the requested sign-in service. This does not constitute a "sale" or "sharing" of personal information for advertising purposes.

Microsoft Entra ID offers data residency options for EU tenants and operates under Microsoft's data processing addendum.

Should You Block This Without Consent?

No. Azure AD is an authentication service that users explicitly invoke to sign into the website. Blocking it would prevent users from logging in and accessing their accounts. All cookies set are directly related to the authentication flow and session management, qualifying as strictly necessary under all major privacy frameworks.