Security changes to the sign-in proxy, requested in the review for the HACS default catalog.
- The sign-in callback only accepts its own flow. It now needs the token issued for that sign-in, and the flow must belong to this integration.
- Home Assistant's security filter is no longer modified. Sign-in addresses the filter would refuse now cross Home Assistant in an encoded form and are restored before they reach Microsoft.
- Only the Microsoft sign-in pages are served through Home Assistant. Other Microsoft addresses load directly in your browser. If a sign-in gets stuck, the log names the host it left for (
Microsoft auth redirect leaves the proxy). - Ready for Home Assistant 2026.12: reconfiguring and signing in again no longer use a reload helper that stops working in that version.
- Documented the "Work or school account / Personal account" page: pick Personal account.