# SEC-003 Microsoft tenant validation verification

Date: 2026-08-02  
Status: `VERIFIED LOCALLY`; JT-001 remains open pending SEC-004.

## Implemented boundary

- `Auth:MicrosoftTenant` supports an exact tenant GUID, `organizations`, `consumers`, or explicit `common`; Production requires a value when Microsoft sign-in is enabled.
- Tokens require GUID-shaped `tid` and `oid`, exact `https://login.microsoftonline.com/{tid}/v2.0` issuer agreement, allowed tenant mode, configured audience, valid signature and lifetime.
- The validator returns normalized tenant/object IDs and treats email-like claims as metadata (`EmailVerified=false`). `Subject` temporarily remains the normalized `oid` only for legacy controller compatibility until SEC-004.
- The undocumented raw Microsoft bearer scheme and smart-selector branch were removed. Microsoft identity tokens enter only through the exchange/link validator.
- The application sign-in tenant is explicitly separate from `Microsoft:TenantId` used for Graph mailbox OAuth.

## Commands and results

| Command/check | Result |
|---|---|
| focused Microsoft validator + auth controller tests | Pass; 42/42 |
| full backend Release suite | Pass; 491/491 |
| normalized deploy-shell syntax | Pass |
| production Compose config with synthetic `organizations` mode | Pass |
| source search for raw Microsoft bearer registration/selector | Removed; exchange validator is the remaining sign-in trust path |

The focused validator suite covers Production missing configuration, invalid mode, common,
organizations, consumers, exact single tenant, personal-account rejection/acceptance, missing and
non-GUID `tid`/`oid`, issuer/tenant mismatch, wrong audience, wrong signature, expiry, and identical
`oid` values in two tenants.

## Remaining risk and gates

- **JT-001 remains High / High / likely defect.** `ApplicationUser` still lacks canonical tenant/object columns and controller lookups still contain legacy subject/email behavior. This package validates identity input but does not claim safe account ownership.
- No Microsoft provider was contacted. Browser/provider success, cancellation, wrong-tenant and consent behavior are unverified.
- Production must inventory legacy link counts/collisions and alternate credentials before enabling the stricter policy.
- SEC-004 must add canonical pair persistence, collision-safe lookup and the approved legacy recovery ceremony. Until then Microsoft sign-in should remain disabled in production.
- Rollback can restore the prior validator binaries, but must not be used to re-enable raw bearer trust in production. No database change exists in this package.