Merill Fernando 💚

@merill.net

6154 Followers 4418 Following

Product Manager @microsoft | Creator of bluesky.ms • cmd.ms • idPowerToys.merill.net • Graph X-Ray • 🇦🇺 • 🇱🇰 • Posts my own http://youtube.com/@merillx Sign up to my newsletter https://entra.news

wouldn't this be the way to do it withtout certs? https://devblogs.microsoft.com/identity/access-cloud-resources-across-tenants-without-secrets/ 13:23 Worked for 1m 2s Yes. You found the missing piece, and my earlier conclusion was too restrictive. The app registration and managed identity stay together in the Azure workforce tenant. The app is made multitenant, then its service principal is provisioned into each External ID tenant and attached to the user flow.
Yes, we're asking for write permission — and it's broader than you'd hope This is the part you'll want to know precisely. AT-Proto OAuth in 2025-2026 has two scope realities: What works in production today (transition:generic) scope: "atproto transition:generic" transition:generic = full generic write access to the user's entire AT-Proto repository. Not scoped to ms.zap.*. Not scoped to types we care about. Full write. That means with this token, zap.ms could: - Write app.bsky.feed.like records (likes on Bluesky posts) on the user's behalf - Write app.bsky.feed.post records (Bluesky posts) on their behalf - Write app.bsky.graph.follow records (follows) on their behalf - Delete any existing record in their repo We won't, and we'd never ship code that does. But the protocol-level enforcement is "zap.ms is trusted to write whatever it wants in the user's repo." Frontpage uses this exact scope; so does basically every atproto app in production today. What the spec says we should be able to do (repo:<collection>) The Permissions spec at <https://atproto.com/specs/permission> defines granular scopes: scope: "atproto repo:ms.zap.story?action=create repo:ms.zap.comment?action=create repo:ms.zap.vote?action=create repo:ms.zap.favorite?action=create repo:ms.zap.vote?action=delete" // for unvote This would limit zap.ms to literally only the four collections it uses. However: deployment of granular scopes across PDSes (especially bsky.social, where most users will be) is uncertain in 2025-2026 per the research I did. The safe bet is they're not consistently honored yet. What the user actually sees When they click "Sign in with Bluesky," they get bounced to their PDS's consent page (most users: bsky.social). It says roughly: zap.ms is requesting access to your account: - Identify you (atproto) - Generic read/write access to your repository (transition:generic) Cancel Authorize The phrase "generic write access" makes some users pause
Pic of laptop with msft badge