Say on the Microsoft screen why accounts still wait for approval

Reported by Ricardo Cazati, who ticked "create an account on first
sign-in" and "approve those accounts automatically", named his domain,
and then found every colleague's account sitting in the approval queue
with nothing anywhere saying why.

The rule is right and stays: an address the provider has not confirmed
goes to the queue whatever the box says, because inside one Entra tenant
a colleague can present somebody else's address. What was missing is that
Microsoft confirms nothing until `xms_edov` is added to the app
registration — an administrator configuring their own company directory
reads "verified" as already true of it.

The tenant-ID field mentioned that claim, but only for the half about
never attaching to an existing account. The other half — that this is
also why auto-approval does nothing — now sits under the auto-approve
checkbox itself, where the promise is made, and only when the three
settings that produce the surprise are all on.

CHANGELOG.md

@@ -55,6 +55,10 @@ we did. It sits at the top of a release for that reason. Older entries call the
 
 **Fixed**
 
+- **The Microsoft sign-in settings now say why new accounts still wait for approval.** They wait
+  until the `xms_edov` optional claim is added to the app registration, because until then Microsoft
+  does not confirm that the person owns the address — which is a rule ProjectSend already had and
+  nothing on screen said. Reported by Ricardo Cazati.
 - **Someone who signs in with Microsoft, Google or another provider can now set a password.** The
   screen asked for the current one, which such an account never had — so it could not get a
   password, and therefore could not turn on two-factor authentication. Where two-factor is

lang/ca.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Crear una contrasenya",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Inicies la sessió amb un compte connectat. Tenir una contrasenya pròpia et permet entrar sense ell, i cal per activar la verificació en dos passos.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "La teva contrasenya la gestiona el directori de la teva organització, així que no es pot canviar aquí.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Un enllaç que qualsevol pot obrir, sense iniciar sessió. El pots revocar quan vulguis."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Un enllaç que qualsevol pot obrir, sense iniciar sessió. El pots revocar quan vulguis.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider només confirma una adreça quan el claim opcional \"xms_edov\" és al registre de la teva aplicació (Token configuration → optional claims → ID token). Fins que hi sigui, els comptes es creen igual, però tots queden esperant a Sol·licituds de compte, marquis el que marquis aquí."
 }

lang/cs.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Nastavit heslo",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Přihlašujete se přes propojený účet. Vlastní heslo vám umožní přihlásit se i bez něj a je potřeba k zapnutí dvoufázového ověření.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Vaše heslo spravuje adresář vaší organizace, takže ho tu nelze změnit.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Odkaz, který může kdokoli otevřít bez přihlášení. Kdykoli ho můžete zrušit."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Odkaz, který může kdokoli otevřít bez přihlášení. Kdykoli ho můžete zrušit.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider potvrdí adresu jen tehdy, když je v registraci vaší aplikace volitelný nárok „xms_edov\" (Token configuration → optional claims → ID token). Dokud tam není, účty se sice vytvoří, ale všechny čekají v Žádostech o účet, ať je toto pole nastavené jakkoli."
 }

lang/de.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Passwort festlegen",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Du meldest dich über ein verbundenes Konto an. Ein eigenes Passwort erlaubt dir die Anmeldung ohne dieses Konto und wird für die Zwei-Faktor-Authentifizierung benötigt.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Dein Passwort wird vom Verzeichnis deiner Organisation verwaltet und kann hier nicht geändert werden.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Ein Link, den jeder ohne Anmeldung öffnen kann. Du kannst ihn jederzeit widerrufen."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Ein Link, den jeder ohne Anmeldung öffnen kann. Du kannst ihn jederzeit widerrufen.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider bestätigt eine Adresse nur, wenn der optionale Anspruch „xms_edov\" in deiner App-Registrierung steht (Token configuration → optional claims → ID token). Solange er fehlt, werden Konten zwar angelegt, warten aber alle in den Kontoanfragen — egal, was hier angehakt ist."
 }

lang/es.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Crear una contraseña",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Inicias sesión con una cuenta conectada. Tener una contraseña propia te permite entrar sin ella, y hace falta para activar la verificación en dos pasos.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Tu contraseña la gestiona el directorio de tu organización, así que no se puede cambiar aquí.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Un enlace que cualquiera puede abrir, sin iniciar sesión. Puedes revocarlo cuando quieras."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Un enlace que cualquiera puede abrir, sin iniciar sesión. Puedes revocarlo cuando quieras.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider solo confirma una dirección cuando el claim opcional \"xms_edov\" está en el registro de tu aplicación (Token configuration → optional claims → ID token). Hasta que esté, las cuentas se crean igual, pero todas quedan esperando en Solicitudes de cuenta, marques lo que marques aquí."
 }

lang/fr.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Définir un mot de passe",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Vous vous connectez via un compte associé. Un mot de passe à vous permet de vous connecter sans lui, et il est nécessaire pour activer la double authentification.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Votre mot de passe est géré par l'annuaire de votre organisation : il ne peut pas être modifié ici.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Un lien que tout le monde peut ouvrir, sans se connecter. Vous pouvez le révoquer à tout moment."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Un lien que tout le monde peut ouvrir, sans se connecter. Vous pouvez le révoquer à tout moment.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider ne confirme une adresse que si la revendication facultative « xms_edov » figure dans votre inscription d'application (Token configuration → optional claims → ID token). Tant qu'elle manque, les comptes sont bien créés, mais ils attendent tous dans Demandes de compte, quelle que soit cette case."
 }

lang/id.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Buat kata sandi",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Anda masuk melalui akun yang terhubung. Kata sandi sendiri memungkinkan Anda masuk tanpa akun itu, dan diperlukan untuk mengaktifkan autentikasi dua faktor.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Kata sandi Anda dikelola oleh direktori organisasi Anda, jadi tidak bisa diubah di sini.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Tautan yang bisa dibuka siapa saja tanpa masuk. Anda bisa mencabutnya kapan saja."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Tautan yang bisa dibuka siapa saja tanpa masuk. Anda bisa mencabutnya kapan saja.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider hanya mengonfirmasi sebuah alamat bila klaim opsional \"xms_edov\" ada pada pendaftaran aplikasi Anda (Token configuration → optional claims → ID token). Sampai itu ada, akun tetap dibuat, tetapi semuanya menunggu di Permintaan akun, apa pun isi kotak ini."
 }

lang/it.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Imposta una password",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Accedi con un account collegato. Una password tua ti permette di accedere senza di esso ed è necessaria per attivare l'autenticazione a due fattori.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "La tua password è gestita dalla directory della tua organizzazione, quindi non può essere cambiata qui.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Un link che chiunque può aprire, senza accedere. Puoi revocarlo quando vuoi."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Un link che chiunque può aprire, senza accedere. Puoi revocarlo quando vuoi.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider conferma un indirizzo solo quando il claim facoltativo \"xms_edov\" è nella registrazione della tua app (Token configuration → optional claims → ID token). Finché non c'è, gli account vengono creati lo stesso, ma restano tutti in attesa in Richieste di account, qualunque cosa dica questa casella."
 }

lang/ja.json

@@ -2255,5 +2255,6 @@
     "Set a password": "パスワードを設定",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "連携アカウントでサインインしています。自分のパスワードがあれば連携なしでもサインインでき、二段階認証を有効にするにも必要です。",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "パスワードは組織のディレクトリで管理されているため、ここでは変更できません。",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "サインインなしで誰でも開けるリンクです。いつでも取り消せます。"
+    "A link anyone can open, without signing in. You can revoke it at any time.": "サインインなしで誰でも開けるリンクです。いつでも取り消せます。",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider は、アプリ登録にオプションの要求「xms_edov」がある場合にのみアドレスを確認します（Token configuration → optional claims → ID token）。追加されるまで、アカウントは作成されますが、このチェックの状態にかかわらずすべてアカウント申請で待機します。"
 }

lang/nl.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Wachtwoord instellen",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Je logt in met een gekoppeld account. Een eigen wachtwoord laat je inloggen zonder dat account en is nodig om tweestapsverificatie aan te zetten.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Je wachtwoord wordt beheerd door de directory van je organisatie en kan hier niet worden gewijzigd.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Een link die iedereen kan openen, zonder in te loggen. Je kunt hem altijd intrekken."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Een link die iedereen kan openen, zonder in te loggen. Je kunt hem altijd intrekken.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider bevestigt een adres alleen als de optionele claim \"xms_edov\" in je app-registratie staat (Token configuration → optional claims → ID token). Zolang die ontbreekt, worden accounts wel aangemaakt, maar wachten ze allemaal bij Accountaanvragen, wat hier ook is aangevinkt."
 }

lang/pl.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Ustaw hasło",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Logujesz się przez połączone konto. Własne hasło pozwala zalogować się bez niego i jest potrzebne do włączenia uwierzytelniania dwuskładnikowego.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Twoim hasłem zarządza katalog Twojej organizacji, więc nie można go tu zmienić.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Link, który każdy może otworzyć bez logowania. Możesz go w każdej chwili unieważnić."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Link, który każdy może otworzyć bez logowania. Możesz go w każdej chwili unieważnić.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider potwierdza adres tylko wtedy, gdy opcjonalne oświadczenie „xms_edov\" jest w rejestracji Twojej aplikacji (Token configuration → optional claims → ID token). Dopóki go nie ma, konta są tworzone, ale wszystkie czekają w Prośbach o konto, niezależnie od tego pola."
 }

lang/pt_BR.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Criar uma senha",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Você entra com uma conta conectada. Ter uma senha própria permite entrar sem ela e é necessária para ativar a verificação em duas etapas.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Sua senha é gerenciada pelo diretório da sua organização, então não pode ser alterada aqui.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Um link que qualquer pessoa pode abrir, sem entrar na conta. Você pode revogá-lo quando quiser."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Um link que qualquer pessoa pode abrir, sem entrar na conta. Você pode revogá-lo quando quiser.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": "O :provider só confirma um endereço quando a claim opcional \"xms_edov\" está no registro do seu aplicativo (Token configuration → optional claims → ID token). Até lá, as contas são criadas, mas todas ficam aguardando em Solicitações de conta, independentemente desta caixa."
 }

lang/ru.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Задать пароль",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Вы входите через подключённый аккаунт. Собственный пароль позволит входить без него и нужен для включения двухфакторной аутентификации.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Вашим паролем управляет каталог вашей организации, поэтому изменить его здесь нельзя.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Ссылка, которую может открыть любой без входа в систему. Вы можете отозвать её в любой момент."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Ссылка, которую может открыть любой без входа в систему. Вы можете отозвать её в любой момент.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider подтверждает адрес только тогда, когда в регистрации вашего приложения есть необязательное утверждение «xms_edov» (Token configuration → optional claims → ID token). Пока его нет, учётные записи создаются, но все ждут в Запросах на аккаунт, что бы ни стояло в этом поле."
 }

lang/sw.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Weka nenosiri",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Unaingia kwa akaunti iliyounganishwa. Nenosiri lako mwenyewe hukuruhusu kuingia bila akaunti hiyo, na linahitajika ili kuwasha uthibitishaji wa hatua mbili.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Nenosiri lako linasimamiwa na orodha ya shirika lako, kwa hiyo haliwezi kubadilishwa hapa.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Kiungo ambacho mtu yeyote anaweza kufungua bila kuingia. Unaweza kukibatilisha wakati wowote."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Kiungo ambacho mtu yeyote anaweza kufungua bila kuingia. Unaweza kukibatilisha wakati wowote.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider huthibitisha anwani pale tu dai la hiari \"xms_edov\" lipo kwenye usajili wa programu yako (Token configuration → optional claims → ID token). Hadi liwepo, akaunti bado huundwa, lakini zote hungoja katika Maombi ya akaunti, bila kujali kisanduku hiki."
 }

lang/tr.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Parola oluştur",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Bağlı bir hesapla oturum açıyorsunuz. Kendinize ait bir parola, o hesap olmadan da giriş yapmanızı sağlar ve iki adımlı doğrulamayı açmak için gereklidir.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Parolanız kuruluşunuzun dizini tarafından yönetiliyor, bu yüzden burada değiştirilemez.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Herkesin oturum açmadan açabileceği bir bağlantı. İstediğiniz zaman iptal edebilirsiniz."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Herkesin oturum açmadan açabileceği bir bağlantı. İstediğiniz zaman iptal edebilirsiniz.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider bir adresi yalnızca uygulama kaydınızda \"xms_edov\" isteğe bağlı talebi varsa doğrular (Token configuration → optional claims → ID token). O eklenene kadar hesaplar yine oluşturulur, ancak bu kutu ne olursa olsun hepsi Hesap isteklerinde bekler."
 }

lang/vi.json

@@ -2255,5 +2255,6 @@
     "Set a password": "Đặt mật khẩu",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "Bạn đăng nhập bằng tài khoản đã liên kết. Có mật khẩu riêng giúp bạn đăng nhập mà không cần tài khoản đó, và cần thiết để bật xác thực hai bước.",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "Mật khẩu của bạn do thư mục của tổ chức quản lý, nên không thể đổi tại đây.",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "Một liên kết ai cũng mở được mà không cần đăng nhập. Bạn có thể thu hồi bất cứ lúc nào."
+    "A link anyone can open, without signing in. You can revoke it at any time.": "Một liên kết ai cũng mở được mà không cần đăng nhập. Bạn có thể thu hồi bất cứ lúc nào.",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": ":provider chỉ xác nhận một địa chỉ khi khai báo tùy chọn \"xms_edov\" có trong đăng ký ứng dụng của bạn (Token configuration → optional claims → ID token). Cho đến khi có, tài khoản vẫn được tạo, nhưng tất cả đều chờ trong Yêu cầu tài khoản, dù ô này được đặt thế nào."
 }

lang/zh_CN.json

@@ -2255,5 +2255,6 @@
     "Set a password": "设置密码",
     "You sign in through a connected account. A password of your own lets you sign in without it, and is needed to turn on two-factor authentication.": "你通过关联账户登录。拥有自己的密码可以不依赖该账户登录，并且开启两步验证时需要它。",
     "Your password is managed by your organisation's directory, so it cannot be changed here.": "你的密码由所在组织的目录管理，因此无法在此更改。",
-    "A link anyone can open, without signing in. You can revoke it at any time.": "任何人无需登录即可打开的链接。你可以随时撤销它。"
+    "A link anyone can open, without signing in. You can revoke it at any time.": "任何人无需登录即可打开的链接。你可以随时撤销它。",
+    ":provider only confirms an address when the \"xms_edov\" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.": "只有当应用注册中包含可选声明“xms_edov”时，:provider 才会确认地址（Token configuration → optional claims → ID token）。在添加之前，账户仍会创建，但无论此处如何勾选，它们都会在账户申请中等待。"
 }

resources/js/pages/system/settings/social-login.tsx

@@ -281,6 +281,23 @@ function ProviderCard({ provider, open, onToggle }: { provider: ProviderSettings
                                 </div>
                             </div>
                         )}
+
+                        {/* The sentence above is the rule; this is what it
+                            means here. An administrator configuring a
+                            company directory reasonably reads "verified" as
+                            already true of it, ticks this, and then finds
+                            every account waiting in the queue with nothing
+                            on screen saying why. */}
+                        {provider.needs_tenant_id && form.data.auto_provision && form.data.auto_approve && form.data.require_verified_email && (
+                            <Alert className="ml-7">
+                                <AlertDescription>
+                                    {t(
+                                        ':provider only confirms an address when the "xms_edov" optional claim is on your app registration (Token configuration → optional claims → ID token). Until it is there, accounts are still created, but every one of them waits in Account requests however this box is set.',
+                                        { provider: provider.label },
+                                    )}
+                                </AlertDescription>
+                            </Alert>
+                        )}
                     </div>
 
                     <SaveButton processing={form.processing} recentlySuccessful={form.recentlySuccessful} />