Add option to disable email verification check in authentication settings

[songsid]

Description

The email verification check added in #12605 (v1.8.1) breaks sign-in for Azure AD accounts that lack the mail attribute — common with external/contractor accounts in enterprise tenants.

Problem

We use Azure AD SSO with contractor accounts. These accounts don't have the mail attribute set in Azure AD, so Microsoft returns
xms_edov = false. Combined with our allowed domains configuration, this causes the new check in userProvisioner to reject sign-in.

The Azure AD admin cannot modify the mail attribute for these external accounts. Other accounts with the mail attribute set work fine — only
those without it are affected.

Proposal

Add a toggle in Settings → Authentication to allow workspace admins to disable the email verification requirement:

• "Require verified email for sign-in" — enabled by default (preserving current security behavior), can be disabled per workspace.

This would be consistent with how allowed domains is already configurable in the admin UI.

Environment

• Outline version: v1.8.1 (self-hosted, Docker)
• Authentication provider: Azure AD (Microsoft Entra ID)

[EddieTx]

I'm having an issue with new user provisioning due to this issue, but it's all users, not just guests. I do have an allowed domain and it's connected to entra, issue just started after 1.8.1 and the error is "Your email address has not been verified by Microsoft. Please verify your email an try signing in again." so it's related to the same change. The Mail attribute is set on my user accounts in Entra. I double checked the https://docs.getoutline.com/s/dfa77e56-d4d2-4b51-8ff8-84ea6608faa4 to see if there were any changes that needed to be done, but I don't see anything different than what I have setup.

@songsid, is provisioning for non-guest accounts working for you still?

[songsid]

@EddieTx For non-guest accounts on my end, provisioning still works fine — only accounts without the mail attribute set in Azure AD are affected.

My workaround was to modify the email verification check directly in the Docker container (/opt/outline/build/server/commands/userProvisioner.js) — bypassing the xms_edov check introduced in PR #12605 (v1.8.1).

[EddieTx]

Thanks @songsid, it was missing the xms_edov claim, but even after adding that claim it wasn't working, so I had to add the optional email claim as well to get it to work.

I did have the standard api permissions per the Outline Entra help setup article (email, offline_access, profile) and it's been working for a year and a half, so those 2 optional claims made it work with this update to v1.8.1. I added them both via Token configuration > add optional caim > ID (email and xms_edov). I think the https://docs.getoutline.com/s/dfa77e56-d4d2-4b51-8ff8-84ea6608faa4 should be updated.

Thanks for the help!

[songsid]

Thanks @EddieTx! Good find on the optional claims. We'll try adding xms_edov + email in Token configuration on our end as well.

[tommoor]

Please try the v1.8.2-0 prerelease build and let me know if this re-enables login for your team

[songsid]

Confirmed — v1.8.2-0 resolves the sign-in issue. Guest accounts can now log in successfully. Thanks for the quick fix!