Add "Continue with Microsoft" sign in for GitHub

[TylerLeonhardt]

Lets someone already signed in to Microsoft reach Copilot without a second trip through the browser. The microsoft provider already holds an Entra token; this trades it for a GitHub one.

How the flow works

Two exchanges, on purpose.

The first buys a read:user discovery token, just enough to call GET /user and find out which GitHub account the Entra identity maps to. That account is shown to the user, and nothing is published until they confirm it. The second exchange then mints the scopes the caller actually asked for.

The discovery token is never persisted and never published as a session. Neither token is ever logged.

What survives a reload

Entra-brokered sessions live in memory for the life of the window and never touch the Keychain. What persists is the user's consent: a row in global state holding the GitHub account label, the Microsoft account label, and the GitHub user id. A fresh window mints the session again from that row without prompting, re-running discovery to confirm the row still points at the same account.

Rows are keyed by GitHub account label, because that is what VS Code itself keys an account by. getAccounts collapses sessions by label and the account preference is stored by label. A session read back from the Keychain can carry a placeholder id, an old numeric one, or one from a lookup that failed, so the id is no way to tell two accounts apart. The id has exactly one job here: checking that the token GitHub just returned belongs to the account the row names, which a label cannot do because logins get renamed and freed logins get taken.

Signing out

Signing out of GitHub drops the row. Signing out of Microsoft drops the sessions, since nothing can renew them, but deliberately leaves the rows alone.

That asymmetry matters. The Microsoft account list is a per-window cache that legitimately reads empty for a moment while it repopulates, and the rows are global state shared by every window. Acting on a blink of that list would sign the user out everywhere with no way back. Dropping only the in-memory sessions self-heals: the next read mints them again from the row that is still there. Getting it wrong costs one round trip instead of the account.

Testing

37 unit tests pass across accountLinks.test.ts, entraTokenExchange.test.ts, flows.test.ts, plus the workbench tests in chatSetup.test.ts and defaultAccount.test.ts. End to end this was exercised through sign in, window reload, cross-window sign in from the Agents window, and both sign-out paths.

Note for reviewers

extensions/github-authentication/src/config.ts is intentionally untouched here. The client secret this endpoint requires lives in vscode-distro, not in this repo.

Draft while the endpoint registration is finalized.

🤖 Generated with Claude Code

[github-actions]

Screenshot Changes

Base: 7a0d4c7f Current: 59524771

Added (2)

sessions/signInDialog/sessionsSignInDialog/SignInWithMicrosoft/Dark

sessions/signInDialog/sessionsSignInDialog/SignInWithMicrosoft/Light

[Copilot]

Pull request overview

Adds Microsoft-backed GitHub authentication by exchanging Entra tokens for temporary GitHub sessions.

Changes:

• Adds token exchange, renewal, account-link persistence, and session restoration.
• Adds the Microsoft option to Copilot sign-in UI behind an experimental setting.
• Adds UI fixtures, icons, and unit coverage.

Show a summary per file

File	Description
sessionsSignInDialog.fixture.ts	Adds Microsoft sign-in fixture.
defaultAccount.test.ts	Tests additive sign-in scopes.
chatSetup.test.ts	Tests Microsoft setup UI and routing.
microsoft-light.svg	Adds light Microsoft icon.
microsoft-dark.svg	Adds dark Microsoft icon.
chatSetup.css	Styles Microsoft provider icon.
chatSetupRunner.ts	Adds Microsoft button and strategy.
chatSetupProviders.ts	Adds provider fallback metadata.
chatSetupController.ts	Adds provider fallback metadata.
chatSetup.ts	Defines Microsoft setup strategy.
chat.shared.contribution.ts	Registers the experimental setting.
chatSettings.ts	Defines the setting identifier.
product.ts	Extends product provider configuration.
product.json	Configures provider and trusted access.
testMemento.ts	Adds in-memory test storage.
flows.test.ts	Tests provider validation.
entraTokenExchange.test.ts	Tests exchange and renewal behavior.
accountLinks.test.ts	Tests persisted account mappings.
httpClient.ts	Adds injectable HTTP implementation.
githubServer.ts	Integrates Microsoft token exchange.
github.ts	Manages transient sessions and restoration.
flows.ts	Adds Microsoft provider typing.
entraTokenExchange.ts	Implements two-stage token exchange.
microsoftAuthentication.ts	Wraps Microsoft authentication APIs.
http.ts	Defines HTTP abstractions.
gitHubAccount.ts	Extracts GitHub account lookup.
accountLinks.ts	Persists Microsoft–GitHub mappings.

Review details

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (2)

extensions/github-authentication/src/github.ts:380

• A successful ID check can return a renamed GitHub login. The session is then stored under the new label while the link remains keyed by the old label, so every later unscoped getSessions considers that row missing and performs another exchange, accumulating duplicate transient sessions. Rewrite the link when the verified login changed before publishing the restored session.

		const session = this.sessionFor(renewed.account, renewed.token, [...renewed.scopes]);
		this._transientSessions.set(session.id, { session, expiresAt: Date.now() + renewed.expiresIn * 1000 });

extensions/github-authentication/src/github.ts:507

• The renewal deliberately returns the freshly verified account, but spreading the old session discards it. If the GitHub login or avatar changed while the numeric ID stayed the same, the published session and account-link row remain stale, contrary to the ID-based rename handling. Update the session account and rewrite the link from renewed.account before firing changed.

		// The same session with a new token, so it keeps its id and is reported as changed rather
		// than as one session going away and another arriving.
		const next: vscode.AuthenticationSession = { ...session, accessToken: renewed.token };
		this._transientSessions.set(next.id, { session: next, expiresAt: Date.now() + renewed.expiresIn * 1000 });

• Files reviewed: 25/27 changed files
• Comments generated: 7
• Review effort level: Balanced