From 1ff268479ed9e5c912c1123abe64c05ba387a436 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Tue, 14 Nov 2023 09:45:55 +0100
Subject: [PATCH 01/14] Added the possibility to use custom scopes for
 performing login with Microsoft EntraID.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 .changeset/rotten-lemons-cry.md                              | 5 +++++
 docs/auth/microsoft/provider.md                              | 4 ++++
 plugins/auth-backend-module-microsoft-provider/config.d.ts   | 1 +
 .../src/authenticator.ts                                     | 5 ++++-
 4 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/rotten-lemons-cry.md

diff --git a/.changeset/rotten-lemons-cry.md b/.changeset/rotten-lemons-cry.md
new file mode 100644
index 0000000000..7664eadf2b
--- /dev/null
+++ b/.changeset/rotten-lemons-cry.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-microsoft-provider': minor
+---
+
+Added the possibility to use custom scopes for performing login with Microsoft EntraID.
diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md
index 999e1f40d2..a6081382e5 100644
--- a/docs/auth/microsoft/provider.md
+++ b/docs/auth/microsoft/provider.md
@@ -28,6 +28,7 @@ On the **API permissions** tab, click on `Add Permission`, then add the followin
 - `openid`
 - `profile`
 - `User.Read`
+- Optional custom permissions you defined in the configuration file
 
 Your company may require you to grant [admin consent](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/user-admin-consent-overview) for these permissions.
 Even if your company doesn't require admin consent, you may wish to do so as it means users don't need to individually consent the first time they access backstage.
@@ -54,6 +55,8 @@ auth:
         clientSecret: ${AZURE_CLIENT_SECRET}
         tenantId: ${AZURE_TENANT_ID}
         domainHint: ${AZURE_TENANT_ID}
+        scope:
+          - user.read
 ```
 
 The Microsoft provider is a structure with three mandatory configuration keys:
@@ -65,6 +68,7 @@ The Microsoft provider is a structure with three mandatory configuration keys:
   Leave blank if your app registration is multi tenant.
   When specified, this reduces login friction for users with accounts in multiple tenants by automatically filtering away accounts from other tenants.
   For more details, see [Home Realm Discovery](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy)
+- `scope` (optional): List of scopes for the App Registration. The default and mandatory value is ['user.read'].
 
 ## Adding the provider to the Backstage frontend
 
diff --git a/plugins/auth-backend-module-microsoft-provider/config.d.ts b/plugins/auth-backend-module-microsoft-provider/config.d.ts
index aa78f72271..91fffc2361 100644
--- a/plugins/auth-backend-module-microsoft-provider/config.d.ts
+++ b/plugins/auth-backend-module-microsoft-provider/config.d.ts
@@ -28,6 +28,7 @@ export interface Config {
           clientSecret: string;
           domainHint?: string;
           callbackUrl?: string;
+          scope?: string[];
         };
       };
     };
diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
index 52ef1ddd90..8446881a4d 100644
--- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
@@ -31,6 +31,9 @@ export const microsoftAuthenticator = createOAuthAuthenticator({
     const clientSecret = config.getString('clientSecret');
     const tenantId = config.getString('tenantId');
     const domainHint = config.getOptionalString('domainHint');
+    const scope: string[] = config.getOptionalStringArray('scope') || [
+      'user.read',
+    ];
 
     const helper = PassportOAuthAuthenticatorHelper.from(
       new ExtendedMicrosoftStrategy(
@@ -39,7 +42,7 @@ export const microsoftAuthenticator = createOAuthAuthenticator({
           clientSecret: clientSecret,
           callbackURL: callbackUrl,
           tenant: tenantId,
-          scope: ['user.read'],
+          scope: scope,
         },
         (
           accessToken: string,

From abfaf8c5024cede9010b0820fcbbd660a663664d Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Wed, 15 Nov 2023 07:18:13 +0100
Subject: [PATCH 02/14] Changed the configuration property to additionalScopes
 and added a tested helper function to combine lists of scopes.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 docs/auth/microsoft/provider.md               |  4 +-
 .../config.d.ts                               |  2 +-
 .../src/authenticator.ts                      |  8 +--
 .../src/scopes.test.ts                        | 50 +++++++++++++++++++
 .../src/scopes.ts                             | 30 +++++++++++
 5 files changed, 88 insertions(+), 6 deletions(-)
 create mode 100644 plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts
 create mode 100644 plugins/auth-backend-module-microsoft-provider/src/scopes.ts

diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md
index a6081382e5..efddcbb9ea 100644
--- a/docs/auth/microsoft/provider.md
+++ b/docs/auth/microsoft/provider.md
@@ -55,8 +55,8 @@ auth:
         clientSecret: ${AZURE_CLIENT_SECRET}
         tenantId: ${AZURE_TENANT_ID}
         domainHint: ${AZURE_TENANT_ID}
-        scope:
-          - user.read
+        additionalScopes:
+          - Mail.Send
 ```
 
 The Microsoft provider is a structure with three mandatory configuration keys:
diff --git a/plugins/auth-backend-module-microsoft-provider/config.d.ts b/plugins/auth-backend-module-microsoft-provider/config.d.ts
index 91fffc2361..df63e9ccf4 100644
--- a/plugins/auth-backend-module-microsoft-provider/config.d.ts
+++ b/plugins/auth-backend-module-microsoft-provider/config.d.ts
@@ -28,7 +28,7 @@ export interface Config {
           clientSecret: string;
           domainHint?: string;
           callbackUrl?: string;
-          scope?: string[];
+          additionalScopes?: string[];
         };
       };
     };
diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
index 8446881a4d..93058b7eec 100644
--- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
@@ -21,6 +21,7 @@ import {
   PassportProfile,
 } from '@backstage/plugin-auth-node';
 import { ExtendedMicrosoftStrategy } from './strategy';
+import { scopeHelper } from './scopes';
 
 /** @public */
 export const microsoftAuthenticator = createOAuthAuthenticator({
@@ -31,9 +32,10 @@ export const microsoftAuthenticator = createOAuthAuthenticator({
     const clientSecret = config.getString('clientSecret');
     const tenantId = config.getString('tenantId');
     const domainHint = config.getOptionalString('domainHint');
-    const scope: string[] = config.getOptionalStringArray('scope') || [
-      'user.read',
-    ];
+    const scope = scopeHelper(
+      ['user.read'],
+      config.getOptionalStringArray('additionalScopes'),
+    );
 
     const helper = PassportOAuthAuthenticatorHelper.from(
       new ExtendedMicrosoftStrategy(
diff --git a/plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts b/plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts
new file mode 100644
index 0000000000..412f87a601
--- /dev/null
+++ b/plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { scopeHelper } from './scopes';
+
+describe('microsoftScopeHelper', () => {
+  it('default scope only with undefined additional scopes', () => {
+    const scopeResult = scopeHelper(['default']);
+    expect(scopeResult.length).toBe(1);
+    expect(scopeResult).toEqual(expect.arrayContaining(['default']));
+  });
+
+  it('default scope only with empty additional scopes', () => {
+    const scopeResult = scopeHelper(['default'], []);
+    expect(scopeResult.length).toBe(1);
+    expect(scopeResult).toEqual(expect.arrayContaining(['default']));
+  });
+
+  it('default scope with mutually exclusive additional scopes', () => {
+    const scopeResult = scopeHelper(['default'], ['secondScope', 'thirdScope']);
+    expect(scopeResult.length).toBe(3);
+    expect(scopeResult).toEqual(
+      expect.arrayContaining(['default', 'secondScope', 'thirdScope']),
+    );
+  });
+
+  it('default scope with overlapping additional scopes', () => {
+    const scopeResult = scopeHelper(
+      ['default', 'secondScope'],
+      ['default', 'secondScope', 'thirdScope'],
+    );
+    expect(scopeResult.length).toBe(3);
+    expect(scopeResult).toEqual(
+      expect.arrayContaining(['default', 'secondScope', 'thirdScope']),
+    );
+  });
+});
diff --git a/plugins/auth-backend-module-microsoft-provider/src/scopes.ts b/plugins/auth-backend-module-microsoft-provider/src/scopes.ts
new file mode 100644
index 0000000000..2165180382
--- /dev/null
+++ b/plugins/auth-backend-module-microsoft-provider/src/scopes.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Combine two arrays of scopes without duplicates
+ * @param defaultScopes Default scopes
+ * @param additionalScopes Optional additional scopes
+ * @returns List of scopes
+ * @public
+ */
+export const scopeHelper = function (
+  defaultScopes: string[],
+  additionalScopes?: string[],
+): string[] {
+  const scope: string[] = defaultScopes.concat(additionalScopes || []);
+  return scope.filter((value, index) => scope.indexOf(value) === index);
+};

From 4248af8b474c994076ee9a9e40c1ea37b2331d42 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Wed, 15 Nov 2023 08:53:22 +0100
Subject: [PATCH 03/14] Fixed yarn lint error.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 plugins/auth-backend-module-microsoft-provider/src/scopes.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/auth-backend-module-microsoft-provider/src/scopes.ts b/plugins/auth-backend-module-microsoft-provider/src/scopes.ts
index 2165180382..f70f69c01f 100644
--- a/plugins/auth-backend-module-microsoft-provider/src/scopes.ts
+++ b/plugins/auth-backend-module-microsoft-provider/src/scopes.ts
@@ -21,10 +21,10 @@
  * @returns List of scopes
  * @public
  */
-export const scopeHelper = function (
+export const scopeHelper = (
   defaultScopes: string[],
   additionalScopes?: string[],
-): string[] {
+): string[] => {
   const scope: string[] = defaultScopes.concat(additionalScopes || []);
   return scope.filter((value, index) => scope.indexOf(value) === index);
 };

From 6ecec4282b41ea2731d293310398592881748095 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Thu, 16 Nov 2023 10:39:09 +0100
Subject: [PATCH 04/14] Adapt new configuration key name to the documentation.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 docs/auth/microsoft/provider.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md
index efddcbb9ea..46da74cc31 100644
--- a/docs/auth/microsoft/provider.md
+++ b/docs/auth/microsoft/provider.md
@@ -68,7 +68,7 @@ The Microsoft provider is a structure with three mandatory configuration keys:
   Leave blank if your app registration is multi tenant.
   When specified, this reduces login friction for users with accounts in multiple tenants by automatically filtering away accounts from other tenants.
   For more details, see [Home Realm Discovery](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy)
-- `scope` (optional): List of scopes for the App Registration. The default and mandatory value is ['user.read'].
+- `additionalScopes` (optional): List of scopes for the App Registration. The default and mandatory value is ['user.read'].
 
 ## Adding the provider to the Backstage frontend
 

From ab8ad0f9830057b7d71fbd44857ac40b03740ed1 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Thu, 23 Nov 2023 10:10:37 +0100
Subject: [PATCH 05/14] Extended test cases to validate the use of
 additionalScopes

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 .../src/authenticator.test.ts                                  | 1 +
 .../auth-backend-module-microsoft-provider/src/module.test.ts  | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts
index 35d35c464c..21a60a229b 100644
--- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts
+++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts
@@ -113,6 +113,7 @@ describe('microsoftAuthenticator', () => {
         tenantId: 'tenantId',
         clientId: 'clientId',
         clientSecret: 'clientSecret',
+        additionalScopes: ['User.Read.All'],
       }),
     });
   });
diff --git a/plugins/auth-backend-module-microsoft-provider/src/module.test.ts b/plugins/auth-backend-module-microsoft-provider/src/module.test.ts
index 21f9a7e845..2ef92c0b44 100644
--- a/plugins/auth-backend-module-microsoft-provider/src/module.test.ts
+++ b/plugins/auth-backend-module-microsoft-provider/src/module.test.ts
@@ -38,6 +38,7 @@ describe('authModuleMicrosoftProvider', () => {
                     clientId: 'my-client-id',
                     clientSecret: 'my-client-secret',
                     tenantId: 'my-tenant-id',
+                    additionalScopes: ['User.Read.All'],
                   },
                 },
               },
@@ -66,7 +67,7 @@ describe('authModuleMicrosoftProvider', () => {
     expect(startUrl.pathname).toBe('/my-tenant-id/oauth2/v2.0/authorize');
     expect(Object.fromEntries(startUrl.searchParams)).toEqual({
       response_type: 'code',
-      scope: 'user.read',
+      scope: 'user.read User.Read.All',
       client_id: 'my-client-id',
       redirect_uri: `http://localhost:${server.port()}/api/auth/microsoft/handler/frame`,
       state: expect.any(String),

From 8462a2e3d0b32a72bf4e428158b7243b0e04150a Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Tue, 5 Dec 2023 13:07:03 +0100
Subject: [PATCH 06/14] Use loadash instead of own implementation and fixed
 documentation.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 docs/auth/microsoft/provider.md               |  2 +-
 .../src/authenticator.ts                      |  4 +-
 .../src/scopes.test.ts                        | 50 -------------------
 .../src/scopes.ts                             | 30 -----------
 4 files changed, 3 insertions(+), 83 deletions(-)
 delete mode 100644 plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts
 delete mode 100644 plugins/auth-backend-module-microsoft-provider/src/scopes.ts

diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md
index 46da74cc31..245e3ffe75 100644
--- a/docs/auth/microsoft/provider.md
+++ b/docs/auth/microsoft/provider.md
@@ -28,7 +28,7 @@ On the **API permissions** tab, click on `Add Permission`, then add the followin
 - `openid`
 - `profile`
 - `User.Read`
-- Optional custom permissions you defined in the configuration file
+- Optional custom scopes you defined in the app-config.yaml file.
 
 Your company may require you to grant [admin consent](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/user-admin-consent-overview) for these permissions.
 Even if your company doesn't require admin consent, you may wish to do so as it means users don't need to individually consent the first time they access backstage.
diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
index 93058b7eec..1b6eb87fae 100644
--- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts
@@ -21,7 +21,7 @@ import {
   PassportProfile,
 } from '@backstage/plugin-auth-node';
 import { ExtendedMicrosoftStrategy } from './strategy';
-import { scopeHelper } from './scopes';
+import { union } from 'lodash';
 
 /** @public */
 export const microsoftAuthenticator = createOAuthAuthenticator({
@@ -32,7 +32,7 @@ export const microsoftAuthenticator = createOAuthAuthenticator({
     const clientSecret = config.getString('clientSecret');
     const tenantId = config.getString('tenantId');
     const domainHint = config.getOptionalString('domainHint');
-    const scope = scopeHelper(
+    const scope = union(
       ['user.read'],
       config.getOptionalStringArray('additionalScopes'),
     );
diff --git a/plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts b/plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts
deleted file mode 100644
index 412f87a601..0000000000
--- a/plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { scopeHelper } from './scopes';
-
-describe('microsoftScopeHelper', () => {
-  it('default scope only with undefined additional scopes', () => {
-    const scopeResult = scopeHelper(['default']);
-    expect(scopeResult.length).toBe(1);
-    expect(scopeResult).toEqual(expect.arrayContaining(['default']));
-  });
-
-  it('default scope only with empty additional scopes', () => {
-    const scopeResult = scopeHelper(['default'], []);
-    expect(scopeResult.length).toBe(1);
-    expect(scopeResult).toEqual(expect.arrayContaining(['default']));
-  });
-
-  it('default scope with mutually exclusive additional scopes', () => {
-    const scopeResult = scopeHelper(['default'], ['secondScope', 'thirdScope']);
-    expect(scopeResult.length).toBe(3);
-    expect(scopeResult).toEqual(
-      expect.arrayContaining(['default', 'secondScope', 'thirdScope']),
-    );
-  });
-
-  it('default scope with overlapping additional scopes', () => {
-    const scopeResult = scopeHelper(
-      ['default', 'secondScope'],
-      ['default', 'secondScope', 'thirdScope'],
-    );
-    expect(scopeResult.length).toBe(3);
-    expect(scopeResult).toEqual(
-      expect.arrayContaining(['default', 'secondScope', 'thirdScope']),
-    );
-  });
-});
diff --git a/plugins/auth-backend-module-microsoft-provider/src/scopes.ts b/plugins/auth-backend-module-microsoft-provider/src/scopes.ts
deleted file mode 100644
index f70f69c01f..0000000000
--- a/plugins/auth-backend-module-microsoft-provider/src/scopes.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright 2023 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Combine two arrays of scopes without duplicates
- * @param defaultScopes Default scopes
- * @param additionalScopes Optional additional scopes
- * @returns List of scopes
- * @public
- */
-export const scopeHelper = (
-  defaultScopes: string[],
-  additionalScopes?: string[],
-): string[] => {
-  const scope: string[] = defaultScopes.concat(additionalScopes || []);
-  return scope.filter((value, index) => scope.indexOf(value) === index);
-};

From 78c0190eb024b4190f0bb9c6a95bfc8fa32f2b60 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Tue, 5 Dec 2023 13:35:21 +0100
Subject: [PATCH 07/14] Added loadash to plugin package.json.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 .../auth-backend-module-microsoft-provider/package.json   | 1 +
 yarn.lock                                                 | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/plugins/auth-backend-module-microsoft-provider/package.json b/plugins/auth-backend-module-microsoft-provider/package.json
index 4b94acbbbf..082ca6246b 100644
--- a/plugins/auth-backend-module-microsoft-provider/package.json
+++ b/plugins/auth-backend-module-microsoft-provider/package.json
@@ -28,6 +28,7 @@
     "@backstage/plugin-auth-node": "workspace:^",
     "express": "^4.18.2",
     "jose": "^4.6.0",
+    "loadash": "^1.0.0",
     "node-fetch": "^2.6.7",
     "passport": "^0.6.0",
     "passport-microsoft": "^1.0.0"
diff --git a/yarn.lock b/yarn.lock
index 6534e7d908..8a35a2a062 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4994,6 +4994,7 @@ __metadata:
     "@types/passport-microsoft": ^1.0.0
     express: ^4.18.2
     jose: ^4.6.0
+    loadash: ^1.0.0
     msw: ^1.0.0
     node-fetch: ^2.6.7
     passport: ^0.6.0
@@ -33780,6 +33781,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"loadash@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "loadash@npm:1.0.0"
+  checksum: 05a105fa9773a7c15963ea783507daa4d488a7a5b782ba77d84dbfaa40b01eb6a3a6cb1a160e67c4af339c7aa9209f9bfb8ef35eefffe98838930f05752ea550
+  languageName: node
+  linkType: hard
+
 "loader-runner@npm:^4.2.0":
   version: 4.2.0
   resolution: "loader-runner@npm:4.2.0"

From 17e7834724458c32c69b5434ef347e72c13e354d Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Wed, 6 Dec 2023 06:58:42 +0100
Subject: [PATCH 08/14] Added loadash to plugin package.json the correct way.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 package.json                                             | 3 ++-
 .../auth-backend-module-microsoft-provider/package.json  | 1 -
 yarn.lock                                                | 9 +--------
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/package.json b/package.json
index a13b7463f2..a676d2c2d3 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,8 @@
     "@backstage/errors": "workspace:^",
     "@changesets/changelog-github": "^0.4.8",
     "@manypkg/get-packages": "^1.1.3",
-    "@useoptic/optic": "^0.50.10"
+    "@useoptic/optic": "^0.50.10",
+    "lodash": "^4.17.21"
   },
   "devDependencies": {
     "@backstage/cli": "workspace:*",
diff --git a/plugins/auth-backend-module-microsoft-provider/package.json b/plugins/auth-backend-module-microsoft-provider/package.json
index 082ca6246b..4b94acbbbf 100644
--- a/plugins/auth-backend-module-microsoft-provider/package.json
+++ b/plugins/auth-backend-module-microsoft-provider/package.json
@@ -28,7 +28,6 @@
     "@backstage/plugin-auth-node": "workspace:^",
     "express": "^4.18.2",
     "jose": "^4.6.0",
-    "loadash": "^1.0.0",
     "node-fetch": "^2.6.7",
     "passport": "^0.6.0",
     "passport-microsoft": "^1.0.0"
diff --git a/yarn.lock b/yarn.lock
index 8a35a2a062..6c8f6e2b0f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4994,7 +4994,6 @@ __metadata:
     "@types/passport-microsoft": ^1.0.0
     express: ^4.18.2
     jose: ^4.6.0
-    loadash: ^1.0.0
     msw: ^1.0.0
     node-fetch: ^2.6.7
     passport: ^0.6.0
@@ -33781,13 +33780,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"loadash@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "loadash@npm:1.0.0"
-  checksum: 05a105fa9773a7c15963ea783507daa4d488a7a5b782ba77d84dbfaa40b01eb6a3a6cb1a160e67c4af339c7aa9209f9bfb8ef35eefffe98838930f05752ea550
-  languageName: node
-  linkType: hard
-
 "loader-runner@npm:^4.2.0":
   version: 4.2.0
   resolution: "loader-runner@npm:4.2.0"
@@ -41327,6 +41319,7 @@ __metadata:
     fs-extra: 10.1.0
     husky: ^8.0.0
     lint-staged: ^15.0.0
+    lodash: ^4.17.21
     minimist: ^1.2.5
     node-gyp: ^10.0.0
     prettier: ^2.2.1

From ba3a413525a256a17ca21de0a165424b7f039c47 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz
 <136574802+LichtBlick-PENG-Daniel@users.noreply.github.com>
Date: Mon, 11 Dec 2023 09:44:22 +0100
Subject: [PATCH 09/14] Change from minor update to patch

Co-authored-by: Philipp Hugenroth <tudi2d@users.noreply.github.com>
Signed-off-by: Daniel Doberenz <136574802+LichtBlick-PENG-Daniel@users.noreply.github.com>
---
 .changeset/rotten-lemons-cry.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changeset/rotten-lemons-cry.md b/.changeset/rotten-lemons-cry.md
index 7664eadf2b..2bcc4c2ea7 100644
--- a/.changeset/rotten-lemons-cry.md
+++ b/.changeset/rotten-lemons-cry.md
@@ -1,5 +1,5 @@
 ---
-'@backstage/plugin-auth-backend-module-microsoft-provider': minor
+'@backstage/plugin-auth-backend-module-microsoft-provider': patch
 ---
 
 Added the possibility to use custom scopes for performing login with Microsoft EntraID.

From 14e01166323e55d78536c64a97f0c4fa18832843 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Tue, 19 Dec 2023 06:48:06 +0100
Subject: [PATCH 10/14] Installed loadash to plugin

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 plugins/auth-backend-module-microsoft-provider/package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/plugins/auth-backend-module-microsoft-provider/package.json b/plugins/auth-backend-module-microsoft-provider/package.json
index 4b94acbbbf..027d112c0d 100644
--- a/plugins/auth-backend-module-microsoft-provider/package.json
+++ b/plugins/auth-backend-module-microsoft-provider/package.json
@@ -30,7 +30,8 @@
     "jose": "^4.6.0",
     "node-fetch": "^2.6.7",
     "passport": "^0.6.0",
-    "passport-microsoft": "^1.0.0"
+    "passport-microsoft": "^1.0.0",
+    "lodash": "^4.17.21"
   },
   "devDependencies": {
     "@backstage/backend-defaults": "workspace:^",

From 133858966bc960f75d0287dcbf5427363c5c8f4b Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Tue, 19 Dec 2023 06:56:13 +0100
Subject: [PATCH 11/14] Specified allowed scopes in the documentation

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 docs/auth/microsoft/provider.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md
index 245e3ffe75..bb8a7db6e4 100644
--- a/docs/auth/microsoft/provider.md
+++ b/docs/auth/microsoft/provider.md
@@ -28,7 +28,7 @@ On the **API permissions** tab, click on `Add Permission`, then add the followin
 - `openid`
 - `profile`
 - `User.Read`
-- Optional custom scopes you defined in the app-config.yaml file.
+- Optional custom scopes of the `Microsoft Graph` API defined in the app-config.yaml file.
 
 Your company may require you to grant [admin consent](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/user-admin-consent-overview) for these permissions.
 Even if your company doesn't require admin consent, you may wish to do so as it means users don't need to individually consent the first time they access backstage.

From 1dcaccf5d3b77442cf9e4c8d12970551ba7600d0 Mon Sep 17 00:00:00 2001
From: Daniel Doberenz <daniel.doberenz@lichtblick.de>
Date: Mon, 15 Jan 2024 10:09:45 +0100
Subject: [PATCH 12/14] Installed loadash to plugin

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>
---
 plugins/auth-backend-module-microsoft-provider/package.json | 4 ++--
 yarn.lock                                                   | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/plugins/auth-backend-module-microsoft-provider/package.json b/plugins/auth-backend-module-microsoft-provider/package.json
index 027d112c0d..8ed7533463 100644
--- a/plugins/auth-backend-module-microsoft-provider/package.json
+++ b/plugins/auth-backend-module-microsoft-provider/package.json
@@ -28,10 +28,10 @@
     "@backstage/plugin-auth-node": "workspace:^",
     "express": "^4.18.2",
     "jose": "^4.6.0",
+    "lodash": "^4.17.21",
     "node-fetch": "^2.6.7",
     "passport": "^0.6.0",
-    "passport-microsoft": "^1.0.0",
-    "lodash": "^4.17.21"
+    "passport-microsoft": "^1.0.0"
   },
   "devDependencies": {
     "@backstage/backend-defaults": "workspace:^",
diff --git a/yarn.lock b/yarn.lock
index 6c8f6e2b0f..9b0479ea9b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4994,6 +4994,7 @@ __metadata:
     "@types/passport-microsoft": ^1.0.0
     express: ^4.18.2
     jose: ^4.6.0
+    lodash: ^4.17.21
     msw: ^1.0.0
     node-fetch: ^2.6.7
     passport: ^0.6.0

From f8a20c560cb1acaa03c4d38f1d40b3c396d5ab0e Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Sun, 21 Jan 2024 13:53:52 +0100
Subject: [PATCH 13/14] Update package.json

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 package.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 4edc266ba1..483e02fdb5 100644
--- a/package.json
+++ b/package.json
@@ -60,8 +60,7 @@
   "dependencies": {
     "@backstage/errors": "workspace:^",
     "@manypkg/get-packages": "^1.1.3",
-    "@useoptic/optic": "^0.50.10",
-    "lodash": "^4.17.21"
+    "@useoptic/optic": "^0.50.10"
   },
   "devDependencies": {
     "@backstage/cli": "workspace:*",

From 87773788c8b2c8408ff8d140d94811a1d5293fd0 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Sun, 21 Jan 2024 14:03:21 +0100
Subject: [PATCH 14/14] yarn.lock: update

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 yarn.lock | 1 -
 1 file changed, 1 deletion(-)

diff --git a/yarn.lock b/yarn.lock
index 3ba535682c..6182ed543f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -39723,7 +39723,6 @@ __metadata:
     fs-extra: 10.1.0
     husky: ^8.0.0
     lint-staged: ^15.0.0
-    lodash: ^4.17.21
     minimist: ^1.2.5
     node-gyp: ^10.0.0
     prettier: ^2.2.1