noiwid/HAFamilySafety v2.0.0

v2.0.0 - Native Microsoft authentication

on GitHub

This release adds a native, browser-assisted Microsoft sign-in built into Home Assistant. The separate Playwright auth add-on is no longer required for a normal setup. It stays available as a legacy fallback.

Highlights

• Sign in to Microsoft directly from the Home Assistant config flow. A temporary in-process proxy captures the OAuth redirect and establishes the Family web session, then the credentials are persisted and setup completes.
• Screen-time schedule reads and writes now go through Microsoft's private Family web API directly from Home Assistant, with no add-on and no headless browser.
• Reauthentication uses the same native flow.
• The Playwright add-on remains supported as a legacy fallback, selected automatically when a config entry was set up that way.
• New per-day schedule end-time entities (time.*_end), so both the start and the end of each allowed window are exposed.

Breaking change: entity IDs renamed

Entity IDs now carry the account name as a prefix. For example:

number.firstname_sunday_limit       ->  number.firstname_lastname_family_safety_firstname_sunday_limit
switch.firstname_lock               ->  switch.firstname_family_safety_firstname_lock
button.firstname_approve_request    ->  button.firstname_family_safety_firstname_approve_request

After updating, review any dashboards, automations, scripts, and templates that reference the old entity IDs and update them to the new names.

Reliability fixes included in this release

• Proxy routes are exempted from Home Assistant's HTTP security filter, which was rejecting Microsoft's silent SSO redirects (URLs containing epctrc=/w/...) with a bare 400 and could make setup fail intermittently.
• The Family web session is now established server-side first when possible, falling back to the browser only when Microsoft requires an interactive hop.
• The account-lock restore point is hardened: it no longer accepts a policy belonging to a different child, and no longer treats a null allowance as a valid schedule.
• A stale-device roster error from Microsoft (Family.UnableToFindTargetResource / RosterError) is no longer reported as an authentication failure. It now shows a clear message pointing at the fix (remove the old device at account.microsoft.com/family), instead of sending users into a reauth and reinstall loop.
• The standalone add-on documentation now covers the API_KEY environment variable, which is required when Home Assistant runs on a different host than the add-on and must match the integration's Legacy add-on API key option.

Notes and limitations

• Home Assistant must be reachable over HTTPS for the native flow. A local-HTTP option exists for testing only.
• There is no autonomous renewal of the web session. When the Microsoft session expires (typically after a few weeks), Home Assistant raises a notification and the flow must be run again.
• Microsoft session cookies are stored in Home Assistant's storage in clear text. Protect your Home Assistant backups accordingly.
• Microsoft Family Safety has no documented public API. This integration relies on unofficial web and mobile endpoints that may change.

The integration and the auth add-on are both at 2.0.0.