What is the Microsoft login link?
You can link employees from an intranet portal or a bookmark directly to the Microsoft sign-in:
- https://app.timebutler.com/login?sso=microsoft
-
https://app.timebutler.com/login?sso=microsoft&login=name@example.com
- Direct access: The link skips the standard Timebutler login form.
- Account pre-selection (optional): If you append the parameter
login=name@example.com, Microsoft will pre-select that account automatically. - Seamless sign-in: If a user is already signed in to Microsoft in their browser, they will land directly in Timebutler with just one click. The portal does not need or store a Timebutler password.
Requirement:
The Microsoft email address must match the Timebutler login email address, or you can link the Microsoft account beforehand under Settings > Integration. For details, see Single Sign-On (SSO) with Microsoft, Google, Slack, OAuth and Azure.
Why does this feature exist? (CSRF protection)
Timebutler includes extra security measures to protect data against cross-site request forgery (CSRF). In a CSRF attack, an external website tries to send requests to Timebutler in the name of a logged-in user. Timebutler rejects POST requests that originate from another website (HTTP 403, checked via the Origin / Referer header). The session cookie is also set to SameSite=Lax.
Previously, some intranet portals logged users in using a form that posted the username and password to Timebutler. For the browser, this looks identical to a CSRF attack, so Timebutler now blocks it.
The new Microsoft login link replaces this legacy method:
- It is a plain link (GET request), so it won’t be blocked by the CSRF check.
- The portal cannot construct the OAuth link on its own: Timebutler binds the OAuth state value directly to the user’s browser session and only accepts Microsoft’s response when they match. The link safely starts the login process on Timebutler’s server inside the user’s browser before redirecting to Microsoft.
Security notes
- No stored credentials: The portal stores no passwords, and the link contains no secret keys or tokens.
- No open redirect: The link always redirects to Microsoft’s fixed sign-in address.