I am currently integrated Firebase into my website, allowing users to sign in using their Microsoft accounts through OAuth 2.0:
import {getAuth, signInWithRedirect, OAuthProvider} from "firebase/auth";
(...)
const provider = new OAuthProvider('microsoft.com');
const auth = getAuth();
signInWithRedirect(auth, provider);
This initiates the Microsoft Single Sign-on with a redirection process.
The authentication works smoothly with Firebase, except for one issue: After signing in with a Microsoft account on the web application, I find myself automatically signed into the complete Office 365 account and other related Microsoft sites in the background.
Therefore, if I open a new tab and access my Outlook 365 online mail, I am already logged in because of signing into the web application. If I happen to forget to log out of the web application, all my mailbox content, calendar details, and other Microsoft account information are left exposed.
Despite going through Azure Portal settings, including application/tenant id's, Scopes, and OAuth 2.0 parameters from Microsoft documentation, I couldn't find a solution to this concern.
While single sign-on is intended for user convenience, I would like to restrict it as a security measure in my case.
Is there a way to limit Microsoft sign-in to authenticate only within the web app/Firebase project, without affecting anything else?