From 3cab3dcd36d74339eaaf7230fd4d874573ebfed5 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Wed, 21 Oct 2026 21:54:27 -0500
Subject: [PATCH 01/12] Replace Windows Live authentication with Microsoft

---
 .../appsettings.Production.yml                |   2 +-
 src/Exceptionless.Job/appsettings.Staging.yml |   2 +-
 .../Api/Endpoints/AuthEndpoints.cs            |   6 +-
 .../Api/Handlers/AuthHandler.cs               |  47 +++-
 .../Api/Handlers/UserHandler.cs               |   5 +-
 .../Api/Messages/AuthMessages.cs              |   2 +-
 .../src/lib/features/auth/index.svelte.ts     |  46 +++-
 .../src/lib/features/auth/microsoft.test.ts   | 137 ++++++++++
 .../account/external-logins/+page.svelte      |   6 +-
 .../src/routes/(auth)/login/+page.svelte      |   6 +-
 .../src/routes/(auth)/signup/+page.svelte     |  13 +-
 .../Security/OAuthProviderClient.cs           |   4 +-
 .../appsettings.Production.yml                |   2 +-
 src/Exceptionless.Web/appsettings.Staging.yml |   2 +-
 .../Api/Data/endpoint-manifest.json           |  20 +-
 .../Exceptionless.Tests/Api/Data/openapi.json |   4 +-
 .../Api/Endpoints/AuthEndpointTests.cs        |  16 +-
 .../Endpoints/MicrosoftAuthEndpointTests.cs   | 258 ++++++++++++++++++
 .../Api/Endpoints/UserEndpointTests.cs        |  26 ++
 .../Api/Handlers/AuthHandlerTests.cs          |  79 +++++-
 .../Mail/CountingMailer.cs                    |   4 +
 .../Utility/TestOAuthProviderClient.cs        |   2 +-
 22 files changed, 619 insertions(+), 70 deletions(-)
 create mode 100644 src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
 create mode 100644 tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs

diff --git a/src/Exceptionless.Job/appsettings.Production.yml b/src/Exceptionless.Job/appsettings.Production.yml
index b01a5221e1..54a50b1916 100644
--- a/src/Exceptionless.Job/appsettings.Production.yml
+++ b/src/Exceptionless.Job/appsettings.Production.yml
@@ -7,7 +7,7 @@ ConnectionStrings:
 #  Storage: ''
 #  Email: 'smtps://user:password@domain.com:587'
 #  LDAP: ''
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=000000004C137E8B;SlackId=34500115540.177239122322;
+  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://be.exceptionless.io
diff --git a/src/Exceptionless.Job/appsettings.Staging.yml b/src/Exceptionless.Job/appsettings.Staging.yml
index 608f6972a1..c3b0be8d15 100644
--- a/src/Exceptionless.Job/appsettings.Staging.yml
+++ b/src/Exceptionless.Job/appsettings.Staging.yml
@@ -6,7 +6,7 @@ ConnectionStrings:
 #  MessageBus: provider=redis;
 #  Queue: provider=redis;
 # Storage: provider=folder;path=.\storage=
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=000000004C137E8B;SlackId=34500115540.177239122322;
+  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://dev-app.exceptionless.io
diff --git a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
index 7b1fc2b41a..afd5f85c18 100644
--- a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
+++ b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
@@ -151,9 +151,9 @@ headers api_key input box.
             }
         });
 
-        group.MapPost("live", async (IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext, [FromBody] ExternalAuthInfo value) =>
+        group.MapPost("microsoft", async (IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext, [FromBody] ExternalAuthInfo value) =>
         {
-            return (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.LiveLogin(value, httpContext))).ToHttpResult(resultMapper);
+            return (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.MicrosoftLogin(value, httpContext))).ToHttpResult(resultMapper);
         })
         .AllowAnonymous()
         .Accepts<ExternalAuthInfo>("application/json", "application/*+json")
@@ -164,7 +164,7 @@ headers api_key input box.
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
-                ["403"] = "Account Creation is currently disabled",
+                ["403"] = "Account creation is disabled or the existing account must be signed into before linking Microsoft",
                 ["422"] = "Validation error",
             }
         });
diff --git a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
index fc37943515..4bc0146072 100644
--- a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
@@ -37,6 +37,8 @@ public class AuthHandler(
     TimeProvider timeProvider,
     ILogger<AuthHandler> logger)
 {
+    private const string LegacyMicrosoftOAuthProvider = "WindowsLive";
+    private const string MicrosoftOAuthProvider = "Microsoft";
     private readonly ScopedCacheClient _cache = new(cacheClient, "Auth");
     private static bool _isFirstUserChecked;
     private static readonly TimeSpan IntercomJwtLifetime = TimeSpan.FromMinutes(60);
@@ -281,7 +283,7 @@ public Task<Result<TokenResult>> Handle(FacebookLogin message)
         );
     }
 
-    public Task<Result<TokenResult>> Handle(LiveLogin message)
+    public Task<Result<TokenResult>> Handle(MicrosoftLogin message)
     {
         return ExternalLoginAsync(message.AuthInfo, message.Context,
             authOptions.MicrosoftId,
@@ -522,7 +524,11 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         User? user;
         try
         {
-            user = await FromExternalLoginAsync(userInfo, authInfo.InviteToken, httpContext);
+            var result = await FromExternalLoginAsync(userInfo, authInfo.InviteToken, httpContext);
+            if (!result.IsSuccess)
+                return Result<TokenResult>.FromResult(result);
+
+            user = result.Value;
         }
         catch (ApplicationException ex)
         {
@@ -542,18 +548,22 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         return new TokenResult { Token = await GetOrCreateAuthenticationTokenAsync(user) };
     }
 
-    private async Task<User> FromExternalLoginAsync(UserInfo userInfo, string? inviteToken, HttpContext httpContext)
+    private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, string? inviteToken, HttpContext httpContext)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Id);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.ProviderName);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Email);
 
+        bool isMicrosoft = String.Equals(userInfo.ProviderName, MicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase);
         var existingUser = await userRepository.GetUserByOAuthProviderAsync(userInfo.ProviderName, userInfo.Id);
         using var _ = logger.BeginScope(new ExceptionlessState().Tag("External Login").Tag(userInfo.ProviderName).Identity(userInfo.Email).SetHttpContext(httpContext));
 
         if (String.IsNullOrWhiteSpace(inviteToken) && httpContext.User.IsUserAuthType())
         {
             var currentUser = httpContext.Request.GetUser();
+            if (isMicrosoft && !currentUser.IsEmailAddressVerified)
+                return Result.Forbidden("Verify your account email address before linking Microsoft from your account settings.");
+
             if (existingUser is not null)
             {
                 if (!String.Equals(existingUser.Id, currentUser.Id, StringComparison.Ordinal))
@@ -567,26 +577,39 @@ private async Task<User> FromExternalLoginAsync(UserInfo userInfo, string? invit
                 }
                 else
                 {
+                    if (RemoveLegacyMicrosoftOAuthAccounts(currentUser, userInfo.ProviderName))
+                        return await userRepository.SaveAsync(currentUser, o => o.Cache());
+
                     return currentUser;
                 }
             }
 
             currentUser.AddOAuthAccount(userInfo.ProviderName, userInfo.Id, userInfo.Email);
+            RemoveLegacyMicrosoftOAuthAccounts(currentUser, userInfo.ProviderName);
             return await userRepository.SaveAsync(currentUser, o => o.Cache());
         }
 
         if (existingUser is not null)
         {
-            if (!existingUser.IsEmailAddressVerified)
+            bool hasChanges = RemoveLegacyMicrosoftOAuthAccounts(existingUser, userInfo.ProviderName);
+            if (!isMicrosoft && !existingUser.IsEmailAddressVerified)
             {
                 existingUser.MarkEmailAddressVerified();
-                await userRepository.SaveAsync(existingUser, o => o.Cache());
+                hasChanges = true;
             }
 
+            if (hasChanges)
+                await userRepository.SaveAsync(existingUser, o => o.Cache());
+
             return existingUser;
         }
 
+        // Microsoft Graph mail is editable. Never create or match an account using it.
+        if (isMicrosoft)
+            return Result.Forbidden("Create and verify an account, or sign in to your existing account, then link Microsoft from your account settings.");
+
         var user = !String.IsNullOrEmpty(userInfo.Email) ? await userRepository.GetByEmailAddressAsync(userInfo.Email) : null;
+
         if (user is null)
         {
             if (!await IsAccountCreationEnabledAsync(inviteToken))
@@ -609,6 +632,20 @@ private async Task<User> FromExternalLoginAsync(UserInfo userInfo, string? invit
         return user;
     }
 
+    private static bool RemoveLegacyMicrosoftOAuthAccounts(User user, string providerName)
+    {
+        if (!String.Equals(providerName, MicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase))
+            return false;
+
+        var legacyAccounts = user.OAuthAccounts
+            .Where(account => String.Equals(account.Provider, LegacyMicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase))
+            .ToArray();
+        foreach (var account in legacyAccounts)
+            user.OAuthAccounts.Remove(account);
+
+        return legacyAccounts.Length > 0;
+    }
+
     private async Task<bool> IsAccountCreationEnabledAsync(string? token)
     {
         if (authOptions.EnableAccountCreation)
diff --git a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
index 9a8a6e9787..65c293bb7b 100644
--- a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
@@ -284,7 +284,10 @@ public async Task<Result<UpdateEmailAddressResult>> Handle(UpdateEmailAddress me
 
         user.ResetPasswordResetToken();
         user.EmailAddress = email;
-        user.IsEmailAddressVerified = user.OAuthAccounts.Any(oa => String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
+        // Microsoft Graph mail is editable and does not establish email ownership.
+        user.IsEmailAddressVerified = user.OAuthAccounts.Any(oa =>
+            !String.Equals(oa.Provider, "Microsoft", StringComparison.OrdinalIgnoreCase)
+            && String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
         if (user.IsEmailAddressVerified)
             user.MarkEmailAddressVerified();
         else
diff --git a/src/Exceptionless.Web/Api/Messages/AuthMessages.cs b/src/Exceptionless.Web/Api/Messages/AuthMessages.cs
index 068710fd2d..cd43fd7a93 100644
--- a/src/Exceptionless.Web/Api/Messages/AuthMessages.cs
+++ b/src/Exceptionless.Web/Api/Messages/AuthMessages.cs
@@ -9,7 +9,7 @@ public record SignupMessage(Signup Model, HttpContext Context);
 public record GitHubLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record GoogleLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record FacebookLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
-public record LiveLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
+public record MicrosoftLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record RemoveExternalLogin(string ProviderName, ValueFromBody<string> ProviderUserId, HttpContext Context);
 public record ChangePassword(ChangePasswordModel Model, HttpContext Context);
 public record CheckEmailAddress(string Email, HttpContext Context);
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts
index 2d7aff7947..6bbf006859 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts
@@ -9,9 +9,11 @@ import {
 import { goto } from '$app/navigation';
 import { resolve } from '$app/paths';
 import { useFetchClient } from '@foundatiofx/fetchclient';
+import { toast } from 'svelte-sonner';
 
 import { gotoRedirect } from '#features/navigation/redirect.ts';
 import { getVisibleUrl } from '#features/navigation/visible-url.ts';
+import { getProblemMessage } from '#shared/validation.ts';
 
 import type { TokenResult } from './models';
 
@@ -54,7 +56,7 @@ export interface OAuthResponseData {
     state: string;
 }
 
-export type SupportedOAuthProviders = 'facebook' | 'github' | 'google' | 'live' | 'slack';
+export type SupportedOAuthProviders = 'facebook' | 'github' | 'google' | 'microsoft' | 'slack';
 
 export const enableAccountCreation = PUBLIC_ENABLE_ACCOUNT_CREATION === 'true';
 export const facebookClientId = PUBLIC_FACEBOOK_APPID;
@@ -133,21 +135,21 @@ export async function gotoLogin() {
     });
 }
 
-export async function liveLogin(redirectUrl?: string, inviteToken?: null | string) {
+export async function microsoftLogin(redirectUrl?: string, inviteToken?: null | string) {
     if (!microsoftClientId) {
-        throw new Error('Live client id not set');
+        throw new Error('Microsoft client id not set');
     }
 
     await oauthLogin({
-        authUrl: 'https://login.live.com/oauth20_authorize.srf',
+        authUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
         clientId: microsoftClientId,
         extraParams: {
-            display: 'popup'
+            state: createOAuthState()
         },
         inviteToken,
-        provider: 'live',
+        provider: 'microsoft',
         redirectUrl,
-        scope: 'wl.emails'
+        scope: 'User.Read'
     });
 }
 
@@ -175,21 +177,37 @@ export async function slackOAuthLogin(): Promise<string> {
 
 // OAuth helpers
 
+function createOAuthState() {
+    if (typeof crypto.randomUUID === 'function') {
+        return crypto.randomUUID();
+    }
+
+    return Array.from(crypto.getRandomValues(new Uint8Array(16)), (value) => value.toString(16).padStart(2, '0')).join('');
+}
+
 async function oauthLogin(options: OAuthLoginOptions) {
     const data = await openOAuthPopup(options);
 
     const client = useFetchClient();
-    const response = await client.postJSON<TokenResult>(`auth/${options.provider}`, {
-        clientId: options.clientId,
-        code: data.code,
-        inviteToken: options.inviteToken,
-        redirectUri: window.location.origin,
-        state: data.state
-    });
+    const response = await client.postJSON<TokenResult>(
+        `auth/${options.provider}`,
+        {
+            clientId: options.clientId,
+            code: data.code,
+            inviteToken: options.inviteToken,
+            redirectUri: window.location.origin,
+            state: data.state
+        },
+        {
+            expectedStatusCodes: [401, 403, 422]
+        }
+    );
 
     if (response.ok && response.data?.token) {
         accessToken.current = response.data.token;
         await gotoRedirect(options.redirectUrl || resolve('/(app)'));
+    } else {
+        toast.error(getProblemMessage(response.problem, 'Unable to sign in. Please try again.'));
     }
 }
 
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
new file mode 100644
index 0000000000..715f2fa732
--- /dev/null
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
@@ -0,0 +1,137 @@
+import { FetchClient } from '@foundatiofx/fetchclient';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { accessToken, goto, postJSON, toastError } = vi.hoisted(() => ({
+    accessToken: { current: null as null | string },
+    goto: vi.fn(),
+    postJSON: vi.fn(),
+    toastError: vi.fn()
+}));
+
+vi.mock('$app/navigation', () => ({ goto }));
+vi.mock('$app/paths', () => ({ resolve: (path: string) => path }));
+vi.mock('$app/state', () => ({ page: {} }));
+vi.mock('$env/dynamic/public', () => ({ env: { PUBLIC_MICROSOFT_APPID: 'microsoft-client-id' } }));
+vi.mock('@foundatiofx/fetchclient', async (importOriginal) => ({ ...(await importOriginal<object>()), useFetchClient: () => ({ postJSON }) }));
+vi.mock('svelte-sonner', () => ({ toast: { error: toastError } }));
+vi.mock('./api.svelte', () => ({}));
+vi.mock('./state.svelte', () => ({ accessToken }));
+vi.mock('./validators', () => ({ validateEmailAvailability: vi.fn() }));
+
+import { microsoftLogin } from './index.svelte';
+
+describe('microsoftLogin', () => {
+    const popup = { close: vi.fn(), closed: false, focus: vi.fn(), location: new URL('https://login.microsoftonline.com/') };
+    const open = vi.fn<(url: string) => typeof popup>().mockReturnValue(popup);
+
+    beforeEach(() => {
+        vi.useFakeTimers();
+        vi.clearAllMocks();
+        accessToken.current = null;
+        popup.location = new URL('https://login.microsoftonline.com/');
+        postJSON.mockResolvedValue({ data: { token: 'session-token' }, ok: true });
+        vi.stubGlobal('window', { location: new URL('http://localhost:7131/login'), open, outerHeight: 900, outerWidth: 1200, screenX: 0, screenY: 0 });
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+        vi.unstubAllGlobals();
+    });
+
+    it.each([true, false])('validates state and preserves invitation and redirect with randomUUID available: %s', async (hasRandomUUID) => {
+        const getRandomValues = vi.fn((bytes: Uint8Array) => bytes.fill(10));
+        vi.stubGlobal('crypto', { getRandomValues, randomUUID: hasRandomUUID ? () => 'oauth-state' : undefined });
+
+        const login = microsoftLogin('/organization/invited', 'invitation-token');
+        const authorizationUrl = new URL(open.mock.calls[0]![0]);
+        expect(authorizationUrl.origin + authorizationUrl.pathname).toBe('https://login.microsoftonline.com/common/oauth2/v2.0/authorize');
+        expect(authorizationUrl.searchParams.get('client_id')).toBe('microsoft-client-id');
+        expect(authorizationUrl.searchParams.get('scope')).toBe('User.Read');
+        expect(authorizationUrl.searchParams.get('response_type')).toBe('code');
+        expect(authorizationUrl.searchParams.get('redirect_uri')).toBe('http://localhost:7131');
+        const state = authorizationUrl.searchParams.get('state');
+        expect(state).toBe(hasRandomUUID ? 'oauth-state' : '0a'.repeat(16));
+
+        popup.location = new URL(`http://localhost:7131/?code=authorization-code&state=${state}`);
+        await vi.advanceTimersByTimeAsync(500);
+        await login;
+
+        expect(postJSON).toHaveBeenCalledExactlyOnceWith(
+            'auth/microsoft',
+            {
+                clientId: 'microsoft-client-id',
+                code: 'authorization-code',
+                inviteToken: 'invitation-token',
+                redirectUri: 'http://localhost:7131',
+                state
+            },
+            { expectedStatusCodes: [401, 403, 422] }
+        );
+        expect(accessToken.current).toBe('session-token');
+        expect(goto).toHaveBeenCalledExactlyOnceWith('/organization/invited');
+        expect(popup.close).toHaveBeenCalledOnce();
+    });
+
+    it.each([
+        [
+            { status: 403, title: 'Sign in to your existing account first, then link Microsoft from your account settings.' },
+            'Sign in to your existing account first, then link Microsoft from your account settings.'
+        ],
+        [undefined, 'Unable to sign in. Please try again.']
+    ])('displays an unsuccessful exchange without changing the session', async (problem, message) => {
+        vi.stubGlobal('crypto', { randomUUID: () => 'expected-state' });
+        accessToken.current = 'existing-session';
+        postJSON.mockResolvedValue({ ok: false, problem });
+        const login = microsoftLogin();
+        popup.location = new URL('http://localhost:7131/?code=authorization-code&state=expected-state');
+        await vi.advanceTimersByTimeAsync(500);
+        await login;
+
+        expect(toastError).toHaveBeenCalledExactlyOnceWith(message);
+        expect(accessToken.current).toBe('existing-session');
+        expect(goto).not.toHaveBeenCalled();
+        expect(popup.close).toHaveBeenCalledOnce();
+    });
+
+    it('displays the 403 with the application error callback enabled', async () => {
+        const message = 'Sign in to your existing account first, then link Microsoft from your account settings.';
+        const client = new FetchClient({
+            baseUrl: 'http://localhost/api/v2',
+            defaultRequestOptions: {
+                errorCallback: (response) => {
+                    throw response.problem ?? response;
+                }
+            },
+            fetch: async () =>
+                new Response(JSON.stringify({ status: 403, title: message }), {
+                    headers: { 'Content-Type': 'application/problem+json' },
+                    status: 403
+                })
+        });
+        postJSON.mockImplementation(client.postJSON.bind(client));
+        vi.stubGlobal('crypto', { randomUUID: () => 'expected-state' });
+        const login = microsoftLogin();
+        const completed = expect(login).resolves.toBeUndefined();
+        popup.location = new URL('http://localhost:7131/?code=authorization-code&state=expected-state');
+        await vi.advanceTimersByTimeAsync(500);
+        await completed;
+        expect(toastError).toHaveBeenCalledExactlyOnceWith(message);
+        expect(accessToken.current).toBeNull();
+        expect(goto).not.toHaveBeenCalled();
+    });
+
+    it.each(['state=wrong-state', '', 'error=access_denied'])('does not exchange the code when the callback contains %s', async (query) => {
+        vi.stubGlobal('crypto', { randomUUID: () => 'expected-state' });
+        const login = microsoftLogin();
+        const rejected = expect(login).rejects.toThrow(query.includes('error=') ? 'access_denied' : 'Invalid state');
+
+        popup.location = new URL(`http://localhost:7131/?code=authorization-code&${query}`);
+        await vi.advanceTimersByTimeAsync(500);
+        await rejected;
+
+        expect(postJSON).not.toHaveBeenCalled();
+        expect(accessToken.current).toBeNull();
+        expect(goto).not.toHaveBeenCalled();
+        expect(popup.close).toHaveBeenCalledOnce();
+    });
+});
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
index 399d725359..fda0466923 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
@@ -19,8 +19,8 @@
         githubLogin,
         googleClientId,
         googleLogin,
-        liveLogin,
-        microsoftClientId
+        microsoftClientId,
+        microsoftLogin
     } from '#features/auth/index.svelte.ts';
     import { getMeQuery } from '#features/users/api.svelte.ts';
 
@@ -58,7 +58,7 @@
             <H4>Add an external login</H4>
             <div class="mt-2 flex flex-wrap gap-2">
                 {#if microsoftClientId}
-                    <Button aria-label="Link Microsoft account" onclick={() => liveLogin()} variant="outline">
+                    <Button aria-label="Link Microsoft account" onclick={() => microsoftLogin()} variant="outline">
                         <MicrosoftIcon class="size-4" /> Microsoft
                     </Button>
                 {/if}
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
index 31c36255e4..2cf27e7924 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
@@ -28,9 +28,9 @@
         githubLogin,
         googleClientId,
         googleLogin,
-        liveLogin,
         logout,
-        microsoftClientId
+        microsoftClientId,
+        microsoftLogin
     } from '#features/auth/index.svelte.ts';
     import { type LoginFormData, LoginSchema } from '#features/auth/schemas.ts';
     import { gotoRedirect } from '#features/navigation/redirect.ts';
@@ -178,7 +178,7 @@
                 </div>
                 <div class="grid grid-flow-col grid-cols-2 grid-rows-2 gap-4">
                     {#if microsoftClientId}
-                        <Button aria-label="Login with Microsoft" tabindex={4} onclick={() => liveLogin(redirectUrl, inviteToken)}>
+                        <Button aria-label="Login with Microsoft" tabindex={4} onclick={() => microsoftLogin(redirectUrl, inviteToken)}>
                             <MicrosoftIcon class="size-4" /> Microsoft
                         </Button>
                     {/if}
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
index 22400385b2..da5c6fd263 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
@@ -8,7 +8,6 @@
     import FacebookIcon from '#comp/icons/FacebookIcon.svelte';
     import GitHubIcon from '#comp/icons/GitHubIcon.svelte';
     import GoogleIcon from '#comp/icons/GoogleIcon.svelte';
-    import MicrosoftIcon from '#comp/icons/MicrosoftIcon.svelte';
     import Logo from '#comp/logo.svelte';
     import { A, P } from '#comp/typography/index.ts';
     import { Button } from '#comp/ui/button/index.ts';
@@ -20,16 +19,13 @@
     import { signup } from '#features/auth/api.svelte.ts';
     import {
         accessToken,
-        enableOAuthLogin,
         facebookClientId,
         facebookLogin,
         gitHubClientId,
         githubLogin,
         googleClientId,
         googleLogin,
-        liveLogin,
-        logout,
-        microsoftClientId
+        logout
     } from '#features/auth/index.svelte.ts';
     import { type SignupFormData, SignupSchema } from '#features/auth/schemas.ts';
     import { validateEmailAvailability } from '#features/auth/validators.ts';
@@ -78,14 +74,9 @@
     </Card.Header>
     <Card.Content>
         <div>
-            {#if enableOAuthLogin}
+            {#if googleClientId || facebookClientId || gitHubClientId}
                 <P class="text-center">Sign up with</P>
                 <div class="grid grid-flow-col grid-cols-2 grid-rows-2 gap-4">
-                    {#if microsoftClientId}
-                        <Button aria-label="Sign up with Microsoft" onclick={() => liveLogin(redirectUrl, inviteToken)}>
-                            <MicrosoftIcon class="size-4" /> Microsoft
-                        </Button>
-                    {/if}
                     {#if googleClientId}
                         <Button aria-label="Sign up with Google" onclick={() => googleLogin(redirectUrl, inviteToken)}>
                             <GoogleIcon class="size-4" /> Google
diff --git a/src/Exceptionless.Web/Security/OAuthProviderClient.cs b/src/Exceptionless.Web/Security/OAuthProviderClient.cs
index c7427390a2..7a8a0b637d 100644
--- a/src/Exceptionless.Web/Security/OAuthProviderClient.cs
+++ b/src/Exceptionless.Web/Security/OAuthProviderClient.cs
@@ -52,8 +52,8 @@ public Task<UserInfo> GetMicrosoftUserInfoAsync(ExternalAuthInfo authInfo, strin
     {
         return GetUserInfoAsync(authInfo, appId, appSecret, (factory, configuration) =>
         {
-            configuration.Scope = "wl.emails";
-            return new WindowsLiveClient(factory, configuration);
+            configuration.Scope = "User.Read";
+            return new MicrosoftClient(factory, configuration);
         });
     }
 
diff --git a/src/Exceptionless.Web/appsettings.Production.yml b/src/Exceptionless.Web/appsettings.Production.yml
index a6bbd82962..2e8f317ee7 100644
--- a/src/Exceptionless.Web/appsettings.Production.yml
+++ b/src/Exceptionless.Web/appsettings.Production.yml
@@ -7,7 +7,7 @@ ConnectionStrings:
 #  Storage: ''
 #  Email: 'smtps://user:password@domain.com:587'
 #  LDAP: ''
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=000000004C137E8B;SlackId=34500115540.177239122322;
+  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://be.exceptionless.io
diff --git a/src/Exceptionless.Web/appsettings.Staging.yml b/src/Exceptionless.Web/appsettings.Staging.yml
index 7a367fafd1..8cebd7f9b4 100644
--- a/src/Exceptionless.Web/appsettings.Staging.yml
+++ b/src/Exceptionless.Web/appsettings.Staging.yml
@@ -6,7 +6,7 @@ ConnectionStrings:
 #  MessageBus: provider=redis;
 #  Queue: provider=redis;
 # Storage: provider=folder;path=.\storage=
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=000000004C137E8B;SlackId=34500115540.177239122322;
+  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://dev-app.exceptionless.io
diff --git a/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json b/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json
index c1c7ce67c1..40a39f0ef9 100644
--- a/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json
+++ b/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json
@@ -777,8 +777,8 @@
   },
   {
     "method": "POST",
-    "route": "/api/v2/auth/live",
-    "displayName": "HTTP: POST api/v2/auth/live",
+    "route": "/api/v2/auth/login",
+    "displayName": "HTTP: POST api/v2/auth/login",
     "tags": [
       "Auth"
     ],
@@ -790,13 +790,13 @@
     "authenticationSchemes": []
   },
   {
-    "method": "POST",
-    "route": "/api/v2/auth/login",
-    "displayName": "HTTP: POST api/v2/auth/login",
+    "method": "GET",
+    "route": "/api/v2/auth/logout",
+    "displayName": "HTTP: GET api/v2/auth/logout",
     "tags": [
       "Auth"
     ],
-    "allowAnonymous": true,
+    "allowAnonymous": false,
     "authorizationPolicies": [
       "UserPolicy"
     ],
@@ -804,13 +804,13 @@
     "authenticationSchemes": []
   },
   {
-    "method": "GET",
-    "route": "/api/v2/auth/logout",
-    "displayName": "HTTP: GET api/v2/auth/logout",
+    "method": "POST",
+    "route": "/api/v2/auth/microsoft",
+    "displayName": "HTTP: POST api/v2/auth/microsoft",
     "tags": [
       "Auth"
     ],
-    "allowAnonymous": false,
+    "allowAnonymous": true,
     "authorizationPolicies": [
       "UserPolicy"
     ],
diff --git a/tests/Exceptionless.Tests/Api/Data/openapi.json b/tests/Exceptionless.Tests/Api/Data/openapi.json
index dd4e606f62..e8a0429094 100644
--- a/tests/Exceptionless.Tests/Api/Data/openapi.json
+++ b/tests/Exceptionless.Tests/Api/Data/openapi.json
@@ -1896,7 +1896,7 @@
         }
       }
     },
-    "/api/v2/auth/live": {
+    "/api/v2/auth/microsoft": {
       "post": {
         "tags": [
           "Auth"
@@ -1929,7 +1929,7 @@
             }
           },
           "403": {
-            "description": "Account Creation is currently disabled",
+            "description": "Account creation is disabled or the existing account must be signed into before linking Microsoft",
             "content": {
               "application/problem\u002Bjson": {
                 "schema": {
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs
index 9e834ef68c..0f12ad7264 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs
@@ -556,16 +556,20 @@ public async Task GoogleAsync_WithConfiguredProvider_ReturnsToken()
     }
 
     [Fact]
-    public async Task LiveAsync_WithConfiguredProvider_ReturnsToken()
+    public async Task MicrosoftAsync_WithLinkedIdentity_ReturnsToken()
     {
         // Arrange
-        const string code = "live-user";
+        const string code = "microsoft-user";
+        var user = new User { EmailAddress = TestOAuthProviderClient.GetEmailAddress(code), FullName = "Microsoft User" };
+        user.MarkEmailAddressVerified();
+        user.AddOAuthAccount("Microsoft", code, user.EmailAddress);
+        await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
 
         // Act
-        var result = await SendExternalLoginAsync("live", code);
+        var result = await SendExternalLoginAsync("microsoft", code);
 
         // Assert
-        await AssertExternalLoginAsync(result, "windowslive", code);
+        await AssertExternalLoginAsync(result, "microsoft", code);
     }
 
     [Fact]
@@ -1995,14 +1999,14 @@ await SendRequestAsync(r => r
         Assert.False(token.IsSuspended);
     }
 
-    private async Task AssertExternalLoginAsync(TokenResult? result, string providerName, string providerUserId)
+    private async Task AssertExternalLoginAsync(TokenResult? result, string providerName, string providerUserId, bool isEmailVerified = true)
     {
         Assert.NotNull(result);
         Assert.False(String.IsNullOrEmpty(result.Token));
 
         var user = await _userRepository.GetByEmailAddressAsync(TestOAuthProviderClient.GetEmailAddress(providerUserId));
         Assert.NotNull(user);
-        Assert.True(user.IsEmailAddressVerified);
+        Assert.Equal(isEmailVerified, user.IsEmailAddressVerified);
         var account = Assert.Single(user.OAuthAccounts);
         Assert.Equal(providerName, account.Provider);
         Assert.Equal(providerUserId, account.ProviderUserId);
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
new file mode 100644
index 0000000000..3671628dca
--- /dev/null
+++ b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
@@ -0,0 +1,258 @@
+using Exceptionless.Core.Authorization;
+using Exceptionless.Core.Configuration;
+using Exceptionless.Core.Extensions;
+using Exceptionless.Core.Mail;
+using Exceptionless.Core.Models;
+using Exceptionless.Core.Repositories;
+using Exceptionless.Core.Utility;
+using Exceptionless.Tests.Extensions;
+using Exceptionless.Tests.Mail;
+using Exceptionless.Tests.Utility;
+using Exceptionless.Web.Models;
+using FluentRest;
+using Foundatio.Repositories;
+using Microsoft.Extensions.DependencyInjection;
+using Xunit;
+using ProblemDetails = Microsoft.AspNetCore.Mvc.ProblemDetails;
+
+namespace Exceptionless.Tests.Api.Endpoints;
+
+public sealed class MicrosoftAuthEndpointTests : IntegrationTestsBase
+{
+    private readonly AuthOptions _authOptions;
+    private readonly bool _originalEnableAccountCreation;
+    private readonly string? _originalMicrosoftId;
+    private readonly string? _originalMicrosoftSecret;
+    private readonly IUserRepository _userRepository;
+    private readonly IOrganizationRepository _organizationRepository;
+    private readonly CountingMailer _mailer;
+
+    public MicrosoftAuthEndpointTests(ITestOutputHelper output, AppWebHostFactory factory) : base(output, factory)
+    {
+        _authOptions = GetService<AuthOptions>();
+        _originalEnableAccountCreation = _authOptions.EnableAccountCreation;
+        _originalMicrosoftId = _authOptions.MicrosoftId;
+        _originalMicrosoftSecret = _authOptions.MicrosoftSecret;
+        _userRepository = GetService<IUserRepository>();
+        _organizationRepository = GetService<IOrganizationRepository>();
+        _mailer = GetService<CountingMailer>();
+    }
+
+    protected override void RegisterServices(IServiceCollection services)
+    {
+        base.RegisterServices(services);
+        services.AddSingleton<CountingMailer>();
+        services.ReplaceSingleton<IMailer>(provider => provider.GetRequiredService<CountingMailer>());
+    }
+
+    protected override async Task ResetDataAsync()
+    {
+        await base.ResetDataAsync();
+        _authOptions.EnableAccountCreation = true;
+        _authOptions.MicrosoftId = "microsoft-client-id";
+        _authOptions.MicrosoftSecret = "microsoft-client-secret";
+        await GetService<SampleDataService>().CreateDataAsync();
+        _mailer.Reset();
+    }
+
+    public override ValueTask DisposeAsync()
+    {
+        _authOptions.EnableAccountCreation = _originalEnableAccountCreation;
+        _authOptions.MicrosoftId = _originalMicrosoftId;
+        _authOptions.MicrosoftSecret = _originalMicrosoftSecret;
+        return base.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task MicrosoftAsync_AuthenticatedLinkWithDifferentEmail_ReplacesLegacyIdentity()
+    {
+        // Arrange
+        const string code = "authenticated-microsoft-user";
+        var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
+        Assert.NotNull(user);
+        user.MarkEmailAddressVerified();
+        user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
+        await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
+
+        // Act
+        await SendMicrosoftLoginAsync(code, isAuthenticated: true);
+
+        // Assert
+        var updatedUser = await _userRepository.GetByIdAsync(user.Id);
+        Assert.NotNull(updatedUser);
+        Assert.Equal(SampleDataService.TEST_ORG_USER_EMAIL, updatedUser.EmailAddress);
+        var account = Assert.Single(updatedUser.OAuthAccounts);
+        Assert.Equal("microsoft", account.Provider);
+        Assert.Equal(code, account.ProviderUserId);
+        Assert.Equal(TestOAuthProviderClient.GetEmailAddress(code), account.Username);
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task MicrosoftAsync_ExistingModernIdentity_PreservesEmailVerification(bool isEmailVerified)
+    {
+        // Arrange
+        const string code = "existing-microsoft-user";
+        var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
+        if (!isEmailVerified)
+            user.ResetVerifyEmailAddressTokenAndExpiration(TimeProvider);
+        string? verificationToken = user.VerifyEmailAddressToken;
+        user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
+        user.AddOAuthAccount("Microsoft", code, user.EmailAddress);
+        await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
+
+        // Act
+        await SendMicrosoftLoginAsync(code);
+
+        // Assert
+        var updatedUser = await _userRepository.GetByIdAsync(user.Id);
+        Assert.NotNull(updatedUser);
+        var account = Assert.Single(updatedUser.OAuthAccounts);
+        Assert.Equal("microsoft", account.Provider);
+        Assert.Equal(code, account.ProviderUserId);
+        Assert.Equal(isEmailVerified, updatedUser.IsEmailAddressVerified);
+        Assert.Equal(verificationToken, updatedUser.VerifyEmailAddressToken);
+    }
+
+    [Fact]
+    public async Task MicrosoftAsync_ExactEmailMatch_RequiresAuthenticatedLinkWithoutChangingUser()
+    {
+        // Arrange
+        const string code = "matching-email-user";
+        var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
+        user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
+        await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
+
+        // Act
+        var problem = await SendRequestAsAsync<ProblemDetails>(request => request
+            .Post()
+            .AppendPaths("auth", "microsoft")
+            .Content(new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = code, RedirectUri = "http://localhost" })
+            .StatusCodeShouldBeForbidden());
+
+        // Assert
+        var updatedUser = await _userRepository.GetByEmailAddressAsync(user.EmailAddress);
+        Assert.NotNull(updatedUser);
+        Assert.Equal(user.Id, updatedUser.Id);
+        var account = Assert.Single(updatedUser.OAuthAccounts);
+        Assert.Equal("windowslive", account.Provider);
+        Assert.Equal("legacy-user", account.ProviderUserId);
+        Assert.NotNull(problem);
+        Assert.Contains("link Microsoft", problem.Title);
+    }
+
+    [Fact]
+    public async Task MicrosoftAsync_UnmatchedEmail_DoesNotCreateUserOrChangeLegacyUser()
+    {
+        // Arrange
+        const string code = "different-email-user";
+        var legacyUser = CreateUser("legacy-user@exceptionless.test");
+        legacyUser.AddOAuthAccount("WindowsLive", "legacy-user", legacyUser.EmailAddress);
+        await _userRepository.AddAsync(legacyUser, o => o.ImmediateConsistency());
+
+        // Act
+        await AssertMicrosoftLoginForbiddenAsync(code);
+
+        // Assert
+        var unchangedLegacyUser = await _userRepository.GetByIdAsync(legacyUser.Id);
+        Assert.NotNull(unchangedLegacyUser);
+        var legacyAccount = Assert.Single(unchangedLegacyUser.OAuthAccounts);
+        Assert.Equal("windowslive", legacyAccount.Provider);
+
+        var microsoftUser = await _userRepository.GetByEmailAddressAsync(TestOAuthProviderClient.GetEmailAddress(code));
+        Assert.Null(microsoftUser);
+        Assert.Equal(0, _mailer.UserEmailVerificationCount);
+    }
+
+    [Fact]
+    public async Task MicrosoftAsync_MatchingInvitation_DoesNotBypassVerifiedAccountRequirement()
+    {
+        // Arrange
+        const string code = "invited-microsoft-user";
+        string emailAddress = TestOAuthProviderClient.GetEmailAddress(code);
+        var organization = (await _organizationRepository.GetAllAsync()).Documents.First();
+        var invite = new Invite {
+            Token = StringExtensions.GetNewToken(),
+            EmailAddress = emailAddress,
+            DateAdded = TimeProvider.GetUtcNow().UtcDateTime
+        };
+        organization.Invites.Add(invite);
+        await _organizationRepository.SaveAsync(organization, options => options.ImmediateConsistency());
+
+        // Act
+        await AssertMicrosoftLoginForbiddenAsync(code, inviteToken: invite.Token);
+
+        // Assert
+        var user = await _userRepository.GetByEmailAddressAsync(emailAddress);
+        Assert.Null(user);
+        var unchangedOrganization = await _organizationRepository.GetByIdAsync(organization.Id);
+        Assert.NotNull(unchangedOrganization);
+        Assert.Contains(unchangedOrganization.Invites, existing => existing.Token == invite.Token);
+        Assert.Equal(0, _mailer.UserEmailVerificationCount);
+    }
+
+    [Fact]
+    public async Task MicrosoftAsync_UnverifiedAuthenticatedUser_CannotLinkIdentity()
+    {
+        var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
+        Assert.NotNull(user);
+        user.ResetVerifyEmailAddressTokenAndExpiration(TimeProvider);
+        user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
+        await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
+
+        await AssertMicrosoftLoginForbiddenAsync("unverified-link", isAuthenticated: true);
+
+        var unchangedUser = await _userRepository.GetByIdAsync(user.Id);
+        Assert.NotNull(unchangedUser);
+        Assert.False(unchangedUser.IsEmailAddressVerified);
+        Assert.Equal("windowslive", Assert.Single(unchangedUser.OAuthAccounts).Provider);
+    }
+
+    private async Task AssertMicrosoftLoginForbiddenAsync(string code, bool isAuthenticated = false, string? inviteToken = null)
+    {
+        var problem = await SendRequestAsAsync<ProblemDetails>(request =>
+        {
+            request.Post().AppendPaths("auth", "microsoft")
+                .Content(new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = code, RedirectUri = "http://localhost", InviteToken = inviteToken })
+                .StatusCodeShouldBeForbidden();
+            if (isAuthenticated)
+                request.AsTestOrganizationUser();
+        });
+        Assert.NotNull(problem);
+        Assert.Contains("Microsoft", problem.Title);
+    }
+
+    private static User CreateUser(string emailAddress)
+    {
+        var user = new User
+        {
+            EmailAddress = emailAddress,
+            FullName = "Microsoft User",
+            Roles = new HashSet<string> { AuthorizationRoles.Client, AuthorizationRoles.User }
+        };
+        user.MarkEmailAddressVerified();
+        return user;
+    }
+
+    private Task<TokenResult?> SendMicrosoftLoginAsync(string code, bool isAuthenticated = false, string? inviteToken = null)
+    {
+        return SendRequestAsAsync<TokenResult>(request =>
+        {
+            request
+                .Post()
+                .AppendPaths("auth", "microsoft")
+                .Content(new ExternalAuthInfo
+                {
+                    ClientId = "microsoft-client-id",
+                    Code = code,
+                    InviteToken = inviteToken,
+                    RedirectUri = "http://localhost/callback"
+                })
+                .StatusCodeShouldBeOk();
+
+            if (isAuthenticated)
+                request.AsTestOrganizationUser();
+        });
+    }
+}
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
index 8493e66ab5..8f91dd37ed 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
@@ -1056,6 +1056,32 @@ public async Task UpdateEmailAddressAsync_ValidEmail_ReturnsResult()
         Assert.NotNull(result);
     }
 
+    [Theory]
+    [InlineData("Microsoft", false)]
+    [InlineData("Google", true)]
+    public async Task UpdateEmailAddressAsync_LinkedProviderEmail_PreservesProviderTrust(string provider, bool isVerified)
+    {
+        const string email = "linked-provider@exceptionless.test";
+        var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
+        Assert.NotNull(user);
+        user.AddOAuthAccount(provider, "provider-user", email);
+        await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
+
+        var result = await SendRequestAsAsync<UpdateEmailAddressResult>(r => r
+            .Post()
+            .AsTestOrganizationUser()
+            .AppendPaths("users", user.Id, "email-address", email)
+            .StatusCodeShouldBeOk());
+
+        Assert.NotNull(result);
+        Assert.Equal(isVerified, result.IsVerified);
+        var updatedUser = await _userRepository.GetByIdAsync(user.Id);
+        Assert.NotNull(updatedUser);
+        Assert.Equal(email, updatedUser.EmailAddress);
+        Assert.Equal(isVerified, updatedUser.IsEmailAddressVerified);
+        Assert.Equal(!isVerified, !String.IsNullOrEmpty(updatedUser.VerifyEmailAddressToken));
+    }
+
     [Fact]
     public async Task VerifyAsync_ExpiredToken_ReturnsValidationProblem()
     {
diff --git a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
index 14f653cb09..08a449196c 100644
--- a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
+++ b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
@@ -128,18 +128,89 @@ public async Task Handle_LoginRepositoryException_ReturnsUnauthorizedResult(Exce
         new OperationCanceledException("Repository operation was canceled.")
     };
 
-    private AuthHandler CreateHandler(IUserRepository userRepository, ITokenRepository tokenRepository, IOAuthTokenRepository oauthTokenRepository, IOAuthProviderClient providerClient)
+    [Theory]
+    [InlineData(null)]
+    [InlineData("invitation-token")]
+    public async Task Handle_UnlinkedMicrosoftIdentity_DoesNotLookUpEmailOrModifyAccounts(string? inviteToken)
+    {
+        // Arrange
+        var userRepository = new Mock<IUserRepository>(MockBehavior.Strict);
+        userRepository.Setup(repository => repository.GetUserByOAuthProviderAsync("Microsoft", "matching-user"))
+            .ReturnsAsync((User?)null);
+        var handler = CreateHandler(userRepository.Object);
+
+        // Act
+        var result = await handler.Handle(new MicrosoftLogin(
+            new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = "matching-user", RedirectUri = "http://localhost", InviteToken = inviteToken },
+            new DefaultHttpContext()));
+
+        // Assert
+        Assert.Equal(ResultStatus.Forbidden, result.Status);
+        Assert.Contains("link", result.Message, StringComparison.OrdinalIgnoreCase);
+        userRepository.VerifyAll();
+        userRepository.VerifyNoOtherCalls();
+    }
+
+    [Fact]
+    public async Task Handle_UnverifiedAuthenticatedUser_DoesNotLinkMicrosoft()
+    {
+        // Arrange
+        var userRepository = new Mock<IUserRepository>(MockBehavior.Strict);
+        userRepository.Setup(repository => repository.GetUserByOAuthProviderAsync("Microsoft", "unverified-user"))
+            .ReturnsAsync((User?)null);
+        var user = new User { Id = "unverified", EmailAddress = "unverified@exceptionless.test" };
+        var context = new DefaultHttpContext { User = new ClaimsPrincipal(new ClaimsIdentity(IdentityUtils.UserAuthenticationType)) };
+        context.Request.SetUser(user);
+
+        // Act
+        var result = await CreateHandler(userRepository.Object).Handle(new MicrosoftLogin(
+            new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = "unverified-user", RedirectUri = "http://localhost" }, context));
+
+        // Assert
+        Assert.Equal(ResultStatus.Forbidden, result.Status);
+        Assert.Contains("Verify", result.Message);
+        Assert.Empty(user.OAuthAccounts);
+        userRepository.VerifyAll();
+        userRepository.VerifyNoOtherCalls();
+    }
+
+    [Fact]
+    public async Task Handle_MicrosoftProviderFails_DoesNotAccessUserRepository()
+    {
+        // Arrange
+        var userRepository = new Mock<IUserRepository>(MockBehavior.Strict);
+        var oauthProvider = new Mock<IOAuthProviderClient>(MockBehavior.Strict);
+        oauthProvider.Setup(provider => provider.GetMicrosoftUserInfoAsync(It.IsAny<ExternalAuthInfo>(), "microsoft-client-id", "microsoft-client-secret"))
+            .ThrowsAsync(new InvalidOperationException("Microsoft provider failed."));
+        var handler = CreateHandler(userRepository.Object, oauthProvider: oauthProvider.Object);
+
+        // Act
+        var exception = await Record.ExceptionAsync(async () =>
+        {
+            _ = await handler.Handle(new MicrosoftLogin(
+                new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = "provider-failure", RedirectUri = "http://localhost" },
+                new DefaultHttpContext()));
+        });
+
+        // Assert
+        Assert.IsType<InvalidOperationException>(exception);
+        userRepository.VerifyNoOtherCalls();
+    }
+
+    private AuthHandler CreateHandler(IUserRepository userRepository, ITokenRepository? tokenRepository = null, IOAuthTokenRepository? oauthTokenRepository = null, IOAuthProviderClient? oauthProvider = null)
     {
         var appOptions = GetService<AppOptions>();
+        appOptions.AuthOptions.MicrosoftId = "microsoft-client-id";
+        appOptions.AuthOptions.MicrosoftSecret = "microsoft-client-secret";
 
         return new AuthHandler(
             appOptions.AuthOptions,
             appOptions.IntercomOptions,
             GetService<IOrganizationRepository>(),
             userRepository,
-            tokenRepository,
-            oauthTokenRepository,
-            providerClient,
+            tokenRepository ?? GetService<ITokenRepository>(),
+            oauthTokenRepository ?? GetService<IOAuthTokenRepository>(),
+            oauthProvider ?? GetService<IOAuthProviderClient>(),
             GetService<ICacheClient>(),
             GetService<AuthService>(),
             GetService<IMailer>(),
diff --git a/tests/Exceptionless.Tests/Mail/CountingMailer.cs b/tests/Exceptionless.Tests/Mail/CountingMailer.cs
index 2967a84886..9e2862ad1e 100644
--- a/tests/Exceptionless.Tests/Mail/CountingMailer.cs
+++ b/tests/Exceptionless.Tests/Mail/CountingMailer.cs
@@ -6,8 +6,10 @@ namespace Exceptionless.Tests.Mail;
 public class CountingMailer : IMailer
 {
     private int _organizationNoticeCount;
+    private int _userEmailVerificationCount;
 
     public int OrganizationNoticeCount => _organizationNoticeCount;
+    public int UserEmailVerificationCount => _userEmailVerificationCount;
 
     public List<OrganizationNoticeCall> OrganizationNoticeCalls { get; } = [];
 
@@ -62,6 +64,7 @@ public Task SendProjectDailySummaryAsync(User user, Project project, IEnumerable
 
     public Task SendUserEmailVerifyAsync(User user)
     {
+        Interlocked.Increment(ref _userEmailVerificationCount);
         return Task.CompletedTask;
     }
 
@@ -73,6 +76,7 @@ public Task SendUserPasswordResetAsync(User user)
     public void Reset()
     {
         Interlocked.Exchange(ref _organizationNoticeCount, 0);
+        Interlocked.Exchange(ref _userEmailVerificationCount, 0);
         lock (OrganizationNoticeCalls)
         {
             OrganizationNoticeCalls.Clear();
diff --git a/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs b/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs
index 969236d4a0..41cee96fe6 100644
--- a/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs
+++ b/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs
@@ -24,7 +24,7 @@ public Task<UserInfo> GetGoogleUserInfoAsync(ExternalAuthInfo authInfo, string a
 
     public Task<UserInfo> GetMicrosoftUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret)
     {
-        return GetUserInfoAsync("WindowsLive", authInfo);
+        return GetUserInfoAsync("Microsoft", authInfo);
     }
 
     public Task<SlackToken?> GetSlackAccessTokenAsync(string code)

From 99fcf393d003b99e356954a18c1abc869437bce5 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Wed, 21 Oct 2026 22:03:56 -0500
Subject: [PATCH 02/12] Remove Facebook login and preserve legacy account
 management

---
 build/update-config.sh                        |  3 +-
 src/Exceptionless.Core/Bootstrapper.cs        |  2 -
 .../Configuration/AuthOptions.cs              |  6 --
 .../Security/SensitiveDataLogging.cs          |  1 -
 .../appsettings.Production.yml                |  2 +-
 src/Exceptionless.Job/appsettings.Staging.yml |  2 +-
 .../Api/Endpoints/AuthEndpoints.cs            | 18 -----
 .../Api/Handlers/AuthHandler.cs               |  9 ---
 .../Api/Messages/AuthMessages.cs              |  1 -
 src/Exceptionless.Web/ClientApp/.env          |  1 -
 src/Exceptionless.Web/ClientApp/src/env.ts    |  1 -
 .../src/lib/features/auth/index.svelte.ts     | 29 +------
 .../src/lib/features/auth/microsoft.test.ts   |  9 ++-
 .../components/icons/FacebookIcon.svelte      | 16 ----
 .../account/external-logins/+page.svelte      | 78 +++++++++----------
 .../external-logins.svelte.test.ts            | 34 ++++++++
 .../src/routes/(auth)/login/+page.svelte      | 10 +--
 .../src/routes/(auth)/signup/+page.svelte     | 21 +----
 src/Exceptionless.Web/Program.cs              |  1 -
 .../Security/OAuthProviderClient.cs           | 10 ---
 .../appsettings.Production.yml                |  2 +-
 src/Exceptionless.Web/appsettings.Staging.yml |  2 +-
 .../Api/Data/endpoint-manifest.json           | 16 +---
 .../Exceptionless.Tests/Api/Data/openapi.json | 57 +-------------
 .../Api/Endpoints/AuthEndpointTests.cs        | 21 ++---
 .../Endpoints/MicrosoftAuthEndpointTests.cs   |  3 +
 .../Utility/TestOAuthProviderClient.cs        |  5 --
 27 files changed, 102 insertions(+), 258 deletions(-)
 delete mode 100644 src/Exceptionless.Web/ClientApp/src/lib/features/shared/components/icons/FacebookIcon.svelte
 create mode 100644 src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts

diff --git a/build/update-config.sh b/build/update-config.sh
index 1bc23e722a..32fd68d1f9 100644
--- a/build/update-config.sh
+++ b/build/update-config.sh
@@ -11,7 +11,7 @@ for part in "${oauth_parts[@]}"; do
     value="${value#"${value%%[![:space:]]*}"}"
     value="${value%"${value##*[![:space:]]}"}"
     case "$key" in
-        FacebookId|GitHubId|GoogleId|IntercomId|MicrosoftId|SlackId)
+        GitHubId|GoogleId|IntercomId|MicrosoftId|SlackId)
             oauth_ids[$key]="$value" ;;
     esac
 done
@@ -43,7 +43,6 @@ mkdir -p _app
     write_setting PUBLIC_EXCEPTIONLESS_CLIENT_SETUP_SHOW_SERVER_URL "${EX_ClientSetupShowServerUrl:-true}"
     write_setting PUBLIC_EXCEPTIONLESS_SERVER_URL "${EX_ExceptionlessServerUrl:-}"
     write_setting PUBLIC_STRIPE_PUBLISHABLE_KEY "${EX_StripePublishableApiKey:-}"
-    write_setting PUBLIC_FACEBOOK_APPID "${oauth_ids[FacebookId]:-}"
     write_setting PUBLIC_GITHUB_APPID "${oauth_ids[GitHubId]:-}"
     write_setting PUBLIC_GOOGLE_APPID "${oauth_ids[GoogleId]:-}"
     write_setting PUBLIC_MICROSOFT_APPID "${oauth_ids[MicrosoftId]:-}"
diff --git a/src/Exceptionless.Core/Bootstrapper.cs b/src/Exceptionless.Core/Bootstrapper.cs
index 92c2ad4c43..0d45dc5823 100644
--- a/src/Exceptionless.Core/Bootstrapper.cs
+++ b/src/Exceptionless.Core/Bootstrapper.cs
@@ -374,8 +374,6 @@ private static string GetEnabledIntegrations(AppOptions options)
             integrations.Add("Google OAuth");
         if (!String.IsNullOrWhiteSpace(options.AuthOptions.MicrosoftId))
             integrations.Add("Microsoft OAuth");
-        if (!String.IsNullOrWhiteSpace(options.AuthOptions.FacebookId))
-            integrations.Add("Facebook OAuth");
         if (!String.IsNullOrWhiteSpace(options.AuthOptions.GitHubId))
             integrations.Add("GitHub OAuth");
         if (options.AuthOptions.EnableActiveDirectoryAuth)
diff --git a/src/Exceptionless.Core/Configuration/AuthOptions.cs b/src/Exceptionless.Core/Configuration/AuthOptions.cs
index f394c32f99..b7bb6ce807 100644
--- a/src/Exceptionless.Core/Configuration/AuthOptions.cs
+++ b/src/Exceptionless.Core/Configuration/AuthOptions.cs
@@ -13,10 +13,6 @@ public class AuthOptions
 
     public string? MicrosoftSecret { get; internal set; }
 
-    public string? FacebookId { get; internal set; }
-
-    public string? FacebookSecret { get; internal set; }
-
     public string? GitHubId { get; internal set; }
 
     public string? GitHubSecret { get; internal set; }
@@ -41,8 +37,6 @@ public static AuthOptions ReadFromConfiguration(IConfiguration config)
         options.GoogleSecret = oAuth.GetString(nameof(options.GoogleSecret));
         options.MicrosoftId = oAuth.GetString(nameof(options.MicrosoftId));
         options.MicrosoftSecret = oAuth.GetString(nameof(options.MicrosoftSecret));
-        options.FacebookId = oAuth.GetString(nameof(options.FacebookId));
-        options.FacebookSecret = oAuth.GetString(nameof(options.FacebookSecret));
         options.GitHubId = oAuth.GetString(nameof(options.GitHubId));
         options.GitHubSecret = oAuth.GetString(nameof(options.GitHubSecret));
 
diff --git a/src/Exceptionless.Insulation/Security/SensitiveDataLogging.cs b/src/Exceptionless.Insulation/Security/SensitiveDataLogging.cs
index aeb7bf6860..aa7f3df888 100644
--- a/src/Exceptionless.Insulation/Security/SensitiveDataLogging.cs
+++ b/src/Exceptionless.Insulation/Security/SensitiveDataLogging.cs
@@ -58,7 +58,6 @@ private sealed record SensitivePropertyRule(
             Redact<AppOptions>(nameof(AppOptions.GoogleGeocodingApiKey)),
             Redact<AppOptions>(nameof(AppOptions.MaxMindGeoIpKey)),
             Redact<AuthOptions>(nameof(AuthOptions.MicrosoftSecret)),
-            Redact<AuthOptions>(nameof(AuthOptions.FacebookSecret)),
             Redact<AuthOptions>(nameof(AuthOptions.GitHubSecret)),
             Redact<AuthOptions>(nameof(AuthOptions.GoogleSecret)),
             Sanitize<AuthOptions>(
diff --git a/src/Exceptionless.Job/appsettings.Production.yml b/src/Exceptionless.Job/appsettings.Production.yml
index 54a50b1916..c7cc61b1d8 100644
--- a/src/Exceptionless.Job/appsettings.Production.yml
+++ b/src/Exceptionless.Job/appsettings.Production.yml
@@ -7,7 +7,7 @@ ConnectionStrings:
 #  Storage: ''
 #  Email: 'smtps://user:password@domain.com:587'
 #  LDAP: ''
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
+  OAuth: GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://be.exceptionless.io
diff --git a/src/Exceptionless.Job/appsettings.Staging.yml b/src/Exceptionless.Job/appsettings.Staging.yml
index c3b0be8d15..fc1af1fa7a 100644
--- a/src/Exceptionless.Job/appsettings.Staging.yml
+++ b/src/Exceptionless.Job/appsettings.Staging.yml
@@ -6,7 +6,7 @@ ConnectionStrings:
 #  MessageBus: provider=redis;
 #  Queue: provider=redis;
 # Storage: provider=folder;path=.\storage=
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
+  OAuth: GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://dev-app.exceptionless.io
diff --git a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
index afd5f85c18..69895d520b 100644
--- a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
+++ b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
@@ -133,24 +133,6 @@ headers api_key input box.
             }
         });
 
-        group.MapPost("facebook", async (IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext, [FromBody] ExternalAuthInfo value) =>
-        {
-            return (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.FacebookLogin(value, httpContext))).ToHttpResult(resultMapper);
-        })
-        .AllowAnonymous()
-        .Accepts<ExternalAuthInfo>("application/json", "application/*+json")
-        .Produces<TokenResult>()
-        .ProducesProblem(StatusCodes.Status403Forbidden)
-        .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
-        .WithSummary("Sign in with Facebook")
-        .WithMetadata(new EndpointDocumentation {
-            ResponseDescriptions = new() {
-                ["200"] = "User Authentication Token",
-                ["403"] = "Account Creation is currently disabled",
-                ["422"] = "Validation error",
-            }
-        });
-
         group.MapPost("microsoft", async (IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext, [FromBody] ExternalAuthInfo value) =>
         {
             return (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.MicrosoftLogin(value, httpContext))).ToHttpResult(resultMapper);
diff --git a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
index 4bc0146072..63f0accd24 100644
--- a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
@@ -274,15 +274,6 @@ public Task<Result<TokenResult>> Handle(GoogleLogin message)
         );
     }
 
-    public Task<Result<TokenResult>> Handle(FacebookLogin message)
-    {
-        return ExternalLoginAsync(message.AuthInfo, message.Context,
-            authOptions.FacebookId,
-            authOptions.FacebookSecret,
-            oauthProviderClient.GetFacebookUserInfoAsync
-        );
-    }
-
     public Task<Result<TokenResult>> Handle(MicrosoftLogin message)
     {
         return ExternalLoginAsync(message.AuthInfo, message.Context,
diff --git a/src/Exceptionless.Web/Api/Messages/AuthMessages.cs b/src/Exceptionless.Web/Api/Messages/AuthMessages.cs
index cd43fd7a93..134ee74ca7 100644
--- a/src/Exceptionless.Web/Api/Messages/AuthMessages.cs
+++ b/src/Exceptionless.Web/Api/Messages/AuthMessages.cs
@@ -8,7 +8,6 @@ public record LogoutMessage(HttpContext Context);
 public record SignupMessage(Signup Model, HttpContext Context);
 public record GitHubLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record GoogleLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
-public record FacebookLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record MicrosoftLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record RemoveExternalLogin(string ProviderName, ValueFromBody<string> ProviderUserId, HttpContext Context);
 public record ChangePassword(ChangePasswordModel Model, HttpContext Context);
diff --git a/src/Exceptionless.Web/ClientApp/.env b/src/Exceptionless.Web/ClientApp/.env
index c7364a03d3..90c666eb7a 100644
--- a/src/Exceptionless.Web/ClientApp/.env
+++ b/src/Exceptionless.Web/ClientApp/.env
@@ -3,7 +3,6 @@ PUBLIC_ENABLE_ACCOUNT_CREATION=true
 PUBLIC_EXCEPTIONLESS_API_KEY=
 PUBLIC_EXCEPTIONLESS_CLIENT_SETUP_SHOW_SERVER_URL=true
 PUBLIC_EXCEPTIONLESS_SERVER_URL=
-PUBLIC_FACEBOOK_APPID=
 PUBLIC_GITHUB_APPID=
 PUBLIC_GOOGLE_APPID=
 PUBLIC_INTERCOM_APPID=
diff --git a/src/Exceptionless.Web/ClientApp/src/env.ts b/src/Exceptionless.Web/ClientApp/src/env.ts
index d6f55588bd..2904e08cc0 100644
--- a/src/Exceptionless.Web/ClientApp/src/env.ts
+++ b/src/Exceptionless.Web/ClientApp/src/env.ts
@@ -14,7 +14,6 @@ export const variables = defineEnvVars({
     PUBLIC_EXCEPTIONLESS_CLIENT_SETUP_SHOW_SERVER_URL: { public: true },
     PUBLIC_EXCEPTIONLESS_SERVER_URL: { description: 'Server URL shown in client setup instructions and used for UI telemetry.', public: true },
     PUBLIC_EXCEPTIONLESS_TELEMETRY_SERVER_URL: { public: true, schema: optional },
-    PUBLIC_FACEBOOK_APPID: { public: true },
     PUBLIC_GITHUB_APPID: { public: true },
     PUBLIC_GOOGLE_APPID: { public: true },
     PUBLIC_INTERCOM_APPID: { public: true },
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts
index 6bbf006859..a98bce3c7a 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/index.svelte.ts
@@ -1,11 +1,4 @@
-import {
-    PUBLIC_ENABLE_ACCOUNT_CREATION,
-    PUBLIC_FACEBOOK_APPID,
-    PUBLIC_GITHUB_APPID,
-    PUBLIC_GOOGLE_APPID,
-    PUBLIC_MICROSOFT_APPID,
-    PUBLIC_SLACK_APPID
-} from '$app/env/public';
+import { PUBLIC_ENABLE_ACCOUNT_CREATION, PUBLIC_GITHUB_APPID, PUBLIC_GOOGLE_APPID, PUBLIC_MICROSOFT_APPID, PUBLIC_SLACK_APPID } from '$app/env/public';
 import { goto } from '$app/navigation';
 import { resolve } from '$app/paths';
 import { useFetchClient } from '@foundatiofx/fetchclient';
@@ -56,33 +49,17 @@ export interface OAuthResponseData {
     state: string;
 }
 
-export type SupportedOAuthProviders = 'facebook' | 'github' | 'google' | 'microsoft' | 'slack';
+export type SupportedOAuthProviders = 'github' | 'google' | 'microsoft' | 'slack';
 
 export const enableAccountCreation = PUBLIC_ENABLE_ACCOUNT_CREATION === 'true';
-export const facebookClientId = PUBLIC_FACEBOOK_APPID;
 export const gitHubClientId = PUBLIC_GITHUB_APPID;
 export const googleClientId = PUBLIC_GOOGLE_APPID;
 export const microsoftClientId = PUBLIC_MICROSOFT_APPID;
 export const slackClientId = PUBLIC_SLACK_APPID;
-export const enableOAuthLogin = facebookClientId || gitHubClientId || googleClientId || microsoftClientId;
+export const enableOAuthLogin = gitHubClientId || googleClientId || microsoftClientId;
 
 // OAuth login functions (interactive popup-based, not pure API calls)
 
-export async function facebookLogin(redirectUrl?: string, inviteToken?: null | string) {
-    if (!facebookClientId) {
-        throw new Error('Facebook client id not set');
-    }
-
-    await oauthLogin({
-        authUrl: 'https://www.facebook.com/v2.5/dialog/oauth',
-        clientId: facebookClientId,
-        inviteToken,
-        provider: 'facebook',
-        redirectUrl,
-        scope: 'email'
-    });
-}
-
 export async function githubLogin(redirectUrl?: string, inviteToken?: null | string) {
     if (!gitHubClientId) {
         throw new Error('GitHub client id not set');
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
index 715f2fa732..a3c4fcba29 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
@@ -11,7 +11,14 @@ const { accessToken, goto, postJSON, toastError } = vi.hoisted(() => ({
 vi.mock('$app/navigation', () => ({ goto }));
 vi.mock('$app/paths', () => ({ resolve: (path: string) => path }));
 vi.mock('$app/state', () => ({ page: {} }));
-vi.mock('$env/dynamic/public', () => ({ env: { PUBLIC_MICROSOFT_APPID: 'microsoft-client-id' } }));
+vi.mock('$app/env/public', () => ({
+    PUBLIC_ENABLE_ACCOUNT_CREATION: 'true',
+    PUBLIC_GITHUB_APPID: '',
+    PUBLIC_GOOGLE_APPID: '',
+    PUBLIC_MICROSOFT_APPID: 'microsoft-client-id',
+    PUBLIC_SLACK_APPID: ''
+}));
+vi.mock('#features/navigation/redirect.ts', () => ({ gotoRedirect: goto }));
 vi.mock('@foundatiofx/fetchclient', async (importOriginal) => ({ ...(await importOriginal<object>()), useFetchClient: () => ({ postJSON }) }));
 vi.mock('svelte-sonner', () => ({ toast: { error: toastError } }));
 vi.mock('./api.svelte', () => ({}));
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/components/icons/FacebookIcon.svelte b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/components/icons/FacebookIcon.svelte
deleted file mode 100644
index 2576b2804d..0000000000
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/components/icons/FacebookIcon.svelte
+++ /dev/null
@@ -1,16 +0,0 @@
-<script lang="ts">
-    import type { HTMLAttributes } from 'svelte/elements';
-
-    type FacebookIconProps = HTMLAttributes<SVGSVGElement> & {
-        class?: string;
-        height?: number;
-        width?: number;
-    };
-
-    const { class: className = '', height = 24, width = 24, ...rest }: FacebookIconProps = $props();
-</script>
-
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 36 36" {width} {height} class={className} aria-label="Facebook icon" {...rest}>
-    <path fill="#1877F2" d="M15 35.8C6.5 34.3 0 26.9 0 18 0 8.1 8.1 0 18 0s18 8.1 18 18c0 8.9-6.5 16.3-15 17.8l-1-.8h-4z" />
-    <path fill="#FFF" d="m25 23 .8-5H21v-3.5c0-1.4.5-2.5 2.7-2.5H26V7.4c-1.3-.2-2.7-.4-4-.4-4.1 0-7 2.5-7 7v4h-4.5v5H15v12.7q1.5.3 3 .3c1.5 0 2-.1 3-.3V23z" />
-</svg>
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
index fda0466923..5ea32e4a76 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
@@ -2,7 +2,6 @@
     import X from '@lucide/svelte/icons/x';
     import { toast } from 'svelte-sonner';
 
-    import FacebookIcon from '#comp/icons/FacebookIcon.svelte';
     import GitHubIcon from '#comp/icons/GitHubIcon.svelte';
     import GoogleIcon from '#comp/icons/GoogleIcon.svelte';
     import MicrosoftIcon from '#comp/icons/MicrosoftIcon.svelte';
@@ -13,8 +12,6 @@
     import { unlinkOAuthAccount } from '#features/auth/api.svelte.ts';
     import {
         enableOAuthLogin,
-        facebookClientId,
-        facebookLogin,
         gitHubClientId,
         githubLogin,
         googleClientId,
@@ -67,11 +64,6 @@
                         <GoogleIcon class="size-4" /> Google
                     </Button>
                 {/if}
-                {#if facebookClientId}
-                    <Button aria-label="Link Facebook account" onclick={() => facebookLogin()} variant="outline">
-                        <FacebookIcon class="size-4" /> Facebook
-                    </Button>
-                {/if}
                 {#if gitHubClientId}
                     <Button aria-label="Link GitHub account" onclick={() => githubLogin()} variant="outline">
                         <GitHubIcon class="size-4" /> GitHub
@@ -79,42 +71,42 @@
                 {/if}
             </div>
         </div>
-
-        <div class="mt-6">
-            <H4>Existing external logins</H4>
-            {#if oauthAccounts.length > 0}
-                <Table.Root class="mt-2">
-                    <Table.Header>
-                        <Table.Row>
-                            <Table.Head>Provider</Table.Head>
-                            <Table.Head class="w-24 text-right">Actions</Table.Head>
-                        </Table.Row>
-                    </Table.Header>
-                    <Table.Body>
-                        {#each oauthAccounts as account (account.provider_user_id)}
-                            <Table.Row>
-                                <Table.Cell class="capitalize">{account.provider} ({account.username || account.provider_user_id})</Table.Cell>
-                                <Table.Cell class="text-right">
-                                    <Button
-                                        aria-label="Remove {account.provider} account"
-                                        disabled={!canUnlinkAccount}
-                                        onclick={() => handleUnlinkAccount(account.provider, account.provider_user_id)}
-                                        size="icon"
-                                        title={canUnlinkAccount ? 'Remove' : 'Cannot remove the only login method'}
-                                        variant="ghost"
-                                    >
-                                        <X class="size-4" />
-                                    </Button>
-                                </Table.Cell>
-                            </Table.Row>
-                        {/each}
-                    </Table.Body>
-                </Table.Root>
-            {:else}
-                <P class="text-muted-foreground mt-2">No external logins were found.</P>
-            {/if}
-        </div>
     {:else}
         <P class="text-muted-foreground">External login providers are not configured.</P>
     {/if}
+
+    <div class="mt-6">
+        <H4>Existing external logins</H4>
+        {#if oauthAccounts.length > 0}
+            <Table.Root class="mt-2">
+                <Table.Header>
+                    <Table.Row>
+                        <Table.Head>Provider</Table.Head>
+                        <Table.Head class="w-24 text-right">Actions</Table.Head>
+                    </Table.Row>
+                </Table.Header>
+                <Table.Body>
+                    {#each oauthAccounts as account (account.provider_user_id)}
+                        <Table.Row>
+                            <Table.Cell class="capitalize">{account.provider} ({account.username || account.provider_user_id})</Table.Cell>
+                            <Table.Cell class="text-right">
+                                <Button
+                                    aria-label="Remove {account.provider} account"
+                                    disabled={!canUnlinkAccount}
+                                    onclick={() => handleUnlinkAccount(account.provider, account.provider_user_id)}
+                                    size="icon"
+                                    title={canUnlinkAccount ? 'Remove' : 'Cannot remove the only login method'}
+                                    variant="ghost"
+                                >
+                                    <X class="size-4" />
+                                </Button>
+                            </Table.Cell>
+                        </Table.Row>
+                    {/each}
+                </Table.Body>
+            </Table.Root>
+        {:else}
+            <P class="text-muted-foreground mt-2">No external logins were found.</P>
+        {/if}
+    </div>
 </div>
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
new file mode 100644
index 0000000000..4633a463d7
--- /dev/null
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
@@ -0,0 +1,34 @@
+import { render, screen } from '@testing-library/svelte';
+import { describe, expect, it, vi } from 'vitest';
+
+import ExternalLogins from './+page.svelte';
+
+vi.mock('#features/auth/index.svelte.ts', () => ({
+    enableOAuthLogin: false,
+    gitHubClientId: '',
+    githubLogin: vi.fn(),
+    googleClientId: '',
+    googleLogin: vi.fn(),
+    microsoftClientId: '',
+    microsoftLogin: vi.fn()
+}));
+vi.mock('#features/auth/api.svelte.ts', () => ({ unlinkOAuthAccount: vi.fn() }));
+vi.mock('#features/users/api.svelte.ts', () => ({
+    getMeQuery: () => ({
+        data: {
+            has_local_account: true,
+            o_auth_accounts: [{ provider: 'facebook', provider_user_id: 'legacy-facebook-id', username: 'legacy-user' }]
+        }
+    })
+}));
+
+describe('external logins', () => {
+    it('keeps legacy accounts available to unlink when no providers are configured', () => {
+        render(ExternalLogins);
+
+        expect(screen.getByText('External login providers are not configured.')).toBeVisible();
+        expect(screen.queryByRole('button', { name: /Link .* account/ })).not.toBeInTheDocument();
+        expect(screen.getByText('facebook (legacy-user)')).toBeVisible();
+        expect(screen.getByRole('button', { name: 'Remove facebook account' })).toBeEnabled();
+    });
+});
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
index 2cf27e7924..8234b5abfb 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
@@ -6,7 +6,6 @@
     import { onMount } from 'svelte';
 
     import ErrorMessage from '#comp/error-message.svelte';
-    import FacebookIcon from '#comp/icons/FacebookIcon.svelte';
     import GitHubIcon from '#comp/icons/GitHubIcon.svelte';
     import GoogleIcon from '#comp/icons/GoogleIcon.svelte';
     import MicrosoftIcon from '#comp/icons/MicrosoftIcon.svelte';
@@ -22,8 +21,6 @@
         accessToken,
         enableAccountCreation,
         enableOAuthLogin,
-        facebookClientId,
-        facebookLogin,
         gitHubClientId,
         githubLogin,
         googleClientId,
@@ -176,7 +173,7 @@
                     <P class="mt-0! px-3">OR</P>
                     <hr class="w-full" />
                 </div>
-                <div class="grid grid-flow-col grid-cols-2 grid-rows-2 gap-4">
+                <div class="grid grid-cols-2 gap-4">
                     {#if microsoftClientId}
                         <Button aria-label="Login with Microsoft" tabindex={4} onclick={() => microsoftLogin(redirectUrl, inviteToken)}>
                             <MicrosoftIcon class="size-4" /> Microsoft
@@ -187,11 +184,6 @@
                             <GoogleIcon class="size-4" /> Google
                         </Button>
                     {/if}
-                    {#if facebookClientId}
-                        <Button aria-label="Login with Facebook" tabindex={4} onclick={() => facebookLogin(redirectUrl, inviteToken)}>
-                            <FacebookIcon class="size-4" /> Facebook
-                        </Button>
-                    {/if}
                     {#if gitHubClientId}
                         <Button aria-label="Login with GitHub" tabindex={4} onclick={() => githubLogin(redirectUrl, inviteToken)}>
                             <GitHubIcon class="size-4" /> GitHub
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
index da5c6fd263..5f58453663 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
@@ -5,7 +5,6 @@
     import { onMount } from 'svelte';
 
     import ErrorMessage from '#comp/error-message.svelte';
-    import FacebookIcon from '#comp/icons/FacebookIcon.svelte';
     import GitHubIcon from '#comp/icons/GitHubIcon.svelte';
     import GoogleIcon from '#comp/icons/GoogleIcon.svelte';
     import Logo from '#comp/logo.svelte';
@@ -17,16 +16,7 @@
     import { Input } from '#comp/ui/input/index.ts';
     import { Spinner } from '#comp/ui/spinner/index.ts';
     import { signup } from '#features/auth/api.svelte.ts';
-    import {
-        accessToken,
-        facebookClientId,
-        facebookLogin,
-        gitHubClientId,
-        githubLogin,
-        googleClientId,
-        googleLogin,
-        logout
-    } from '#features/auth/index.svelte.ts';
+    import { accessToken, gitHubClientId, githubLogin, googleClientId, googleLogin, logout } from '#features/auth/index.svelte.ts';
     import { type SignupFormData, SignupSchema } from '#features/auth/schemas.ts';
     import { validateEmailAvailability } from '#features/auth/validators.ts';
     import { gotoRedirect } from '#features/navigation/redirect.ts';
@@ -74,19 +64,14 @@
     </Card.Header>
     <Card.Content>
         <div>
-            {#if googleClientId || facebookClientId || gitHubClientId}
+            {#if googleClientId || gitHubClientId}
                 <P class="text-center">Sign up with</P>
-                <div class="grid grid-flow-col grid-cols-2 grid-rows-2 gap-4">
+                <div class="grid grid-cols-2 gap-4">
                     {#if googleClientId}
                         <Button aria-label="Sign up with Google" onclick={() => googleLogin(redirectUrl, inviteToken)}>
                             <GoogleIcon class="size-4" /> Google
                         </Button>
                     {/if}
-                    {#if facebookClientId}
-                        <Button aria-label="Sign up with Facebook" onclick={() => facebookLogin(redirectUrl, inviteToken)}>
-                            <FacebookIcon class="size-4" /> Facebook
-                        </Button>
-                    {/if}
                     {#if gitHubClientId}
                         <Button aria-label="Sign up with GitHub" onclick={() => githubLogin(redirectUrl, inviteToken)}>
                             <GitHubIcon class="size-4" /> GitHub
diff --git a/src/Exceptionless.Web/Program.cs b/src/Exceptionless.Web/Program.cs
index 42c70fe801..f0de9e65ae 100644
--- a/src/Exceptionless.Web/Program.cs
+++ b/src/Exceptionless.Web/Program.cs
@@ -442,7 +442,6 @@ private static void SetClientEnvironmentVariablesInDevelopmentMode(AppOptions op
             Environment.SetEnvironmentVariable("PUBLIC_EXCEPTIONLESS_SERVER_URL", options.ExceptionlessServerUrl);
             Environment.SetEnvironmentVariable("PUBLIC_STRIPE_PUBLISHABLE_KEY",
                 options.StripeOptions.StripePublishableApiKey);
-            Environment.SetEnvironmentVariable("PUBLIC_FACEBOOK_APPID", options.AuthOptions.FacebookId);
             Environment.SetEnvironmentVariable("PUBLIC_GITHUB_APPID", options.AuthOptions.GitHubId);
             Environment.SetEnvironmentVariable("PUBLIC_GOOGLE_APPID", options.AuthOptions.GoogleId);
             Environment.SetEnvironmentVariable("PUBLIC_MICROSOFT_APPID", options.AuthOptions.MicrosoftId);
diff --git a/src/Exceptionless.Web/Security/OAuthProviderClient.cs b/src/Exceptionless.Web/Security/OAuthProviderClient.cs
index 7a8a0b637d..a9a1d71cc5 100644
--- a/src/Exceptionless.Web/Security/OAuthProviderClient.cs
+++ b/src/Exceptionless.Web/Security/OAuthProviderClient.cs
@@ -12,7 +12,6 @@ namespace Exceptionless.Web.Security;
 
 public interface IOAuthProviderClient
 {
-    Task<UserInfo> GetFacebookUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret);
     Task<UserInfo> GetGitHubUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret);
     Task<UserInfo> GetGoogleUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret);
     Task<UserInfo> GetMicrosoftUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret);
@@ -21,15 +20,6 @@ public interface IOAuthProviderClient
 
 public sealed class OAuthProviderClient(SlackService slackService) : IOAuthProviderClient
 {
-    public Task<UserInfo> GetFacebookUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret)
-    {
-        return GetUserInfoAsync(authInfo, appId, appSecret, (factory, configuration) =>
-        {
-            configuration.Scope = "email";
-            return new FacebookClient(factory, configuration);
-        });
-    }
-
     public Task<UserInfo> GetGitHubUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret)
     {
         return GetUserInfoAsync(authInfo, appId, appSecret, (factory, configuration) =>
diff --git a/src/Exceptionless.Web/appsettings.Production.yml b/src/Exceptionless.Web/appsettings.Production.yml
index 2e8f317ee7..d0967e1d52 100644
--- a/src/Exceptionless.Web/appsettings.Production.yml
+++ b/src/Exceptionless.Web/appsettings.Production.yml
@@ -7,7 +7,7 @@ ConnectionStrings:
 #  Storage: ''
 #  Email: 'smtps://user:password@domain.com:587'
 #  LDAP: ''
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
+  OAuth: GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://be.exceptionless.io
diff --git a/src/Exceptionless.Web/appsettings.Staging.yml b/src/Exceptionless.Web/appsettings.Staging.yml
index 8cebd7f9b4..cc4bf2e259 100644
--- a/src/Exceptionless.Web/appsettings.Staging.yml
+++ b/src/Exceptionless.Web/appsettings.Staging.yml
@@ -6,7 +6,7 @@ ConnectionStrings:
 #  MessageBus: provider=redis;
 #  Queue: provider=redis;
 # Storage: provider=folder;path=.\storage=
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
+  OAuth: GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://dev-app.exceptionless.io
diff --git a/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json b/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json
index 40a39f0ef9..c0474d670b 100644
--- a/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json
+++ b/tests/Exceptionless.Tests/Api/Data/endpoint-manifest.json
@@ -705,20 +705,6 @@
     "authorizationRoles": [],
     "authenticationSchemes": []
   },
-  {
-    "method": "POST",
-    "route": "/api/v2/auth/facebook",
-    "displayName": "HTTP: POST api/v2/auth/facebook",
-    "tags": [
-      "Auth"
-    ],
-    "allowAnonymous": true,
-    "authorizationPolicies": [
-      "UserPolicy"
-    ],
-    "authorizationRoles": [],
-    "authenticationSchemes": []
-  },
   {
     "method": "GET",
     "route": "/api/v2/auth/forgot-password/{email:minlength(1)}",
@@ -3143,4 +3129,4 @@
     "authorizationRoles": [],
     "authenticationSchemes": []
   }
-]
+]
\ No newline at end of file
diff --git a/tests/Exceptionless.Tests/Api/Data/openapi.json b/tests/Exceptionless.Tests/Api/Data/openapi.json
index e8a0429094..2095e2dbc0 100644
--- a/tests/Exceptionless.Tests/Api/Data/openapi.json
+++ b/tests/Exceptionless.Tests/Api/Data/openapi.json
@@ -1841,61 +1841,6 @@
         }
       }
     },
-    "/api/v2/auth/facebook": {
-      "post": {
-        "tags": [
-          "Auth"
-        ],
-        "summary": "Sign in with Facebook",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ExternalAuthInfo"
-              }
-            },
-            "application/*\u002Bjson": {
-              "schema": {
-                "$ref": "#/components/schemas/ExternalAuthInfo"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "User Authentication Token",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/TokenResult"
-                }
-              }
-            }
-          },
-          "403": {
-            "description": "Account Creation is currently disabled",
-            "content": {
-              "application/problem\u002Bjson": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            }
-          },
-          "422": {
-            "description": "Validation error",
-            "content": {
-              "application/problem\u002Bjson": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
     "/api/v2/auth/microsoft": {
       "post": {
         "tags": [
@@ -15279,4 +15224,4 @@
       "name": "Source Map"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs
index 0f12ad7264..e2a822b0cc 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/AuthEndpointTests.cs
@@ -71,8 +71,6 @@ private void ConfigureAuthOptions()
     {
         _authOptions.EnableAccountCreation = true;
         _authOptions.EnableActiveDirectoryAuth = false;
-        _authOptions.FacebookId = "facebook-client-id";
-        _authOptions.FacebookSecret = "facebook-client-secret";
         _authOptions.GitHubId = "github-client-id";
         _authOptions.GitHubSecret = "github-client-secret";
         _authOptions.GoogleId = "google-client-id";
@@ -517,16 +515,19 @@ await SendRequestAsync(r => r
     }
 
     [Fact]
-    public async Task FacebookAsync_WithConfiguredProvider_ReturnsToken()
+    public async Task FacebookAsync_RemovedProvider_ReturnsNotFound()
     {
-        // Arrange
-        const string code = "facebook-user";
+        // Arrange is handled by the configured authentication fixture.
 
         // Act
-        var result = await SendExternalLoginAsync("facebook", code);
+        var response = await SendRequestAsync(request => request
+            .Post()
+            .AppendPaths("auth", "facebook")
+            .Content(new ExternalAuthInfo { ClientId = "facebook-client-id", Code = "facebook-user", RedirectUri = "http://localhost" })
+            .StatusCodeShouldBeNotFound());
 
         // Assert
-        await AssertExternalLoginAsync(result, "facebook", code);
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
     }
 
     [Fact]
@@ -2032,8 +2033,6 @@ private async Task AssertExternalLoginAsync(TokenResult? result, string provider
     private sealed record AuthOptionsState(
         bool EnableAccountCreation,
         bool EnableActiveDirectoryAuth,
-        string? FacebookId,
-        string? FacebookSecret,
         string? GitHubId,
         string? GitHubSecret,
         string? GoogleId,
@@ -2047,8 +2046,6 @@ public static AuthOptionsState Capture(AuthOptions options)
             return new AuthOptionsState(
                 options.EnableAccountCreation,
                 options.EnableActiveDirectoryAuth,
-                options.FacebookId,
-                options.FacebookSecret,
                 options.GitHubId,
                 options.GitHubSecret,
                 options.GoogleId,
@@ -2061,8 +2058,6 @@ public void Apply(AuthOptions options)
         {
             options.EnableAccountCreation = EnableAccountCreation;
             options.EnableActiveDirectoryAuth = EnableActiveDirectoryAuth;
-            options.FacebookId = FacebookId;
-            options.FacebookSecret = FacebookSecret;
             options.GitHubId = GitHubId;
             options.GitHubSecret = GitHubSecret;
             options.GoogleId = GoogleId;
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
index 3671628dca..fcf7af2ead 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
@@ -195,14 +195,17 @@ public async Task MicrosoftAsync_MatchingInvitation_DoesNotBypassVerifiedAccount
     [Fact]
     public async Task MicrosoftAsync_UnverifiedAuthenticatedUser_CannotLinkIdentity()
     {
+        // Arrange
         var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
         Assert.NotNull(user);
         user.ResetVerifyEmailAddressTokenAndExpiration(TimeProvider);
         user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
         await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
 
+        // Act
         await AssertMicrosoftLoginForbiddenAsync("unverified-link", isAuthenticated: true);
 
+        // Assert
         var unchangedUser = await _userRepository.GetByIdAsync(user.Id);
         Assert.NotNull(unchangedUser);
         Assert.False(unchangedUser.IsEmailAddressVerified);
diff --git a/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs b/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs
index 41cee96fe6..235953a8bb 100644
--- a/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs
+++ b/tests/Exceptionless.Tests/Utility/TestOAuthProviderClient.cs
@@ -7,11 +7,6 @@ namespace Exceptionless.Tests.Utility;
 
 public sealed class TestOAuthProviderClient : IOAuthProviderClient
 {
-    public Task<UserInfo> GetFacebookUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret)
-    {
-        return GetUserInfoAsync("Facebook", authInfo);
-    }
-
     public Task<UserInfo> GetGitHubUserInfoAsync(ExternalAuthInfo authInfo, string appId, string appSecret)
     {
         return GetUserInfoAsync("GitHub", authInfo);

From 497973d2d258f6c074003765c525058956daab9f Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Wed, 21 Oct 2026 22:17:49 -0500
Subject: [PATCH 03/12] Isolate telemetry sampling tests and reuse CI frontend
 dependencies

---
 src/Exceptionless.AppHost/Program.cs               | 1 +
 tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/src/Exceptionless.AppHost/Program.cs b/src/Exceptionless.AppHost/Program.cs
index a7b0bcc998..4472dfc1a6 100644
--- a/src/Exceptionless.AppHost/Program.cs
+++ b/src/Exceptionless.AppHost/Program.cs
@@ -188,6 +188,7 @@
 
 #pragma warning disable ASPIREBROWSERLOGS001
     var app = builder.AddViteApp("App", "../Exceptionless.Web/ClientApp")
+        .WithNpm(install: !ciE2E, installCommand: "ci")
         .WithBrowserLogs()
         .WithReference(api)
         .WithEnvironment("PUBLIC_EXCEPTIONLESS_API_KEY", builder.Configuration["PUBLIC_EXCEPTIONLESS_API_KEY"])
diff --git a/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs b/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs
index 85b1f67dba..dd5a3852c7 100644
--- a/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs
+++ b/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs
@@ -25,6 +25,10 @@
 
 namespace Exceptionless.Tests.Jobs;
 
+[CollectionDefinition(nameof(WebHookTelemetryCollection), DisableParallelization = true)]
+public sealed class WebHookTelemetryCollection;
+
+[Collection(nameof(WebHookTelemetryCollection))]
 public sealed class WebHooksJobTests : TestWithServices
 {
     private const string DestinationUrl = "https://example.com/webhook";

From 162a560b2f51227665016c7be2ebaeaae1c7cf9c Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 06:48:18 -0500
Subject: [PATCH 04/12] Refine CI npm install handling and Microsoft docs

---
 .github/workflows/build.yaml                         | 2 +-
 src/Exceptionless.AppHost/Program.cs                 | 3 ++-
 src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs | 2 +-
 tests/Exceptionless.Tests/Api/Data/openapi.json      | 4 ++--
 tests/ci/README.md                                   | 1 +
 5 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 64c0941bc9..0933687634 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -367,7 +367,7 @@ jobs:
           mkdir -p "$HOME/.aspnet/https"
           # Aspire builds the AppHost and its referenced projects in Debug. Do not build
           # the entire solution in Release first (including an unused test assembly).
-          aspire run --apphost src/Exceptionless.AppHost --non-interactive --nologo -- --ci-e2e > aspire-run.log 2>&1 &
+          aspire run --apphost src/Exceptionless.AppHost --non-interactive --nologo -- --ci-e2e --skip-client-dependency-install > aspire-run.log 2>&1 &
           echo "$!" > aspire-run.pid
           sleep 5
           if ! kill -0 "$(cat aspire-run.pid)" 2>/dev/null; then
diff --git a/src/Exceptionless.AppHost/Program.cs b/src/Exceptionless.AppHost/Program.cs
index 4472dfc1a6..146c4dba62 100644
--- a/src/Exceptionless.AppHost/Program.cs
+++ b/src/Exceptionless.AppHost/Program.cs
@@ -12,6 +12,7 @@
     : null;
 bool servicesOnly = HasArgument("--services-only");
 bool ciE2E = HasArgument("--ci-e2e");
+bool skipClientDependencyInstall = HasArgument("--skip-client-dependency-install");
 bool includeDevTools = !ciE2E;
 int appPort = worktreePorts?.AppHttps ?? 7131;
 string appOrigin = worktreePorts?.AppHttpsUrl ?? $"https://web-ex.dev.localhost:{appPort}";
@@ -188,7 +189,7 @@
 
 #pragma warning disable ASPIREBROWSERLOGS001
     var app = builder.AddViteApp("App", "../Exceptionless.Web/ClientApp")
-        .WithNpm(install: !ciE2E, installCommand: "ci")
+        .WithNpm(install: !skipClientDependencyInstall)
         .WithBrowserLogs()
         .WithReference(api)
         .WithEnvironment("PUBLIC_EXCEPTIONLESS_API_KEY", builder.Configuration["PUBLIC_EXCEPTIONLESS_API_KEY"])
diff --git a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
index 69895d520b..a9db9da0cc 100644
--- a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
+++ b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
@@ -146,7 +146,7 @@ headers api_key input box.
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
-                ["403"] = "Account creation is disabled or the existing account must be signed into before linking Microsoft",
+                ["403"] = "Account Creation is currently disabled",
                 ["422"] = "Validation error",
             }
         });
diff --git a/tests/Exceptionless.Tests/Api/Data/openapi.json b/tests/Exceptionless.Tests/Api/Data/openapi.json
index 2095e2dbc0..88be9cf072 100644
--- a/tests/Exceptionless.Tests/Api/Data/openapi.json
+++ b/tests/Exceptionless.Tests/Api/Data/openapi.json
@@ -1874,7 +1874,7 @@
             }
           },
           "403": {
-            "description": "Account creation is disabled or the existing account must be signed into before linking Microsoft",
+            "description": "Account Creation is currently disabled",
             "content": {
               "application/problem\u002Bjson": {
                 "schema": {
@@ -15224,4 +15224,4 @@
       "name": "Source Map"
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/tests/ci/README.md b/tests/ci/README.md
index d880955b9b..68be3f9cf8 100644
--- a/tests/ci/README.md
+++ b/tests/ci/README.md
@@ -15,6 +15,7 @@ The normal build targets a roughly **10-minute critical path**. Track elapsed wo
 - .NET coverage is merged as a union with ReportGenerator before publishing the existing coverage summary. Browser blob reports are merged into one HTML/JSON/JUnit report. Per-shard TRX, CTRF JSON, JUnit, failure traces/screenshots, and Aspire logs remain downloadable for 14 days.
 - E2E startup lets Aspire build its referenced applications once. The former Release solution build was unused by Aspire's Debug startup and also built the unused .NET test assembly.
 - Browser shards use GitHub's Ubuntu 24.04 image (with its installed browser libraries) and install only Playwright's headless Chromium shell. This avoids unrelated apt upgrades and font downloads that added several minutes to individual runners. Browser versions still come from the locked Playwright package; all layout/locale tests remain enabled.
+- Browser shards install ClientApp dependencies with `npm ci` before AppHost startup, then pass `--skip-client-dependency-install` to avoid running a second install. Local `--ci-e2e` runs omit that flag, so Aspire still installs dependencies when needed.
 - Backend fixtures request `--test-services`, starting only Elasticsearch. Their queues/cache are in memory and storage is scoped to local files. The general `--services-only` mode still starts all development services. This also prevents backend tests from replacing a live preview's shared Azurite container with different dynamic ports.
 - `--ci-e2e` uses temporary Redis and storage containers with allocated ports. This prevents concurrent local AppHosts from replacing shared containers or changing credentials/TLS configuration during a test run. Normal development retains its persistent containers and volumes.
 - Superseded PR runs are cancelled; push/tag runs are not interrupted by newer runs.

From cc941dfa57721910de1a63b0aca2c0fbfe074461 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 06:49:17 -0500
Subject: [PATCH 05/12] Keep CI npm install skip scoped to preinstalled runs

---
 src/Exceptionless.AppHost/Program.cs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/Exceptionless.AppHost/Program.cs b/src/Exceptionless.AppHost/Program.cs
index 146c4dba62..a872746e95 100644
--- a/src/Exceptionless.AppHost/Program.cs
+++ b/src/Exceptionless.AppHost/Program.cs
@@ -189,7 +189,6 @@
 
 #pragma warning disable ASPIREBROWSERLOGS001
     var app = builder.AddViteApp("App", "../Exceptionless.Web/ClientApp")
-        .WithNpm(install: !skipClientDependencyInstall)
         .WithBrowserLogs()
         .WithReference(api)
         .WithEnvironment("PUBLIC_EXCEPTIONLESS_API_KEY", builder.Configuration["PUBLIC_EXCEPTIONLESS_API_KEY"])
@@ -218,8 +217,8 @@
             .WithEnvironment("API_HTTPS", worktreePorts.ApiHttpsUrl);
     }
 
-    // The e2e workflow runs npm ci before starting the AppHost, so a second install would only delay the app.
-    if (ciE2E)
+    // The e2e workflow runs npm ci before starting the AppHost, so it skips Aspire's second install.
+    if (skipClientDependencyInstall)
         app.WithNpm(install: false);
 
     if (includeDevTools)

From 2d3375cfb6dc53391f2226657fdb941067d0138b Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 07:13:42 -0500
Subject: [PATCH 06/12] Restore external login UI guards and layout

---
 .../account/external-logins/+page.svelte      | 70 +++++++++----------
 .../external-logins.svelte.test.ts            |  7 +-
 .../src/routes/(auth)/login/+page.svelte      |  2 +-
 .../src/routes/(auth)/signup/+page.svelte     |  2 +-
 4 files changed, 41 insertions(+), 40 deletions(-)

diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
index 5ea32e4a76..8deb5630eb 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
@@ -71,42 +71,42 @@
                 {/if}
             </div>
         </div>
-    {:else}
-        <P class="text-muted-foreground">External login providers are not configured.</P>
-    {/if}
 
-    <div class="mt-6">
-        <H4>Existing external logins</H4>
-        {#if oauthAccounts.length > 0}
-            <Table.Root class="mt-2">
-                <Table.Header>
-                    <Table.Row>
-                        <Table.Head>Provider</Table.Head>
-                        <Table.Head class="w-24 text-right">Actions</Table.Head>
-                    </Table.Row>
-                </Table.Header>
-                <Table.Body>
-                    {#each oauthAccounts as account (account.provider_user_id)}
+        <div class="mt-6">
+            <H4>Existing external logins</H4>
+            {#if oauthAccounts.length > 0}
+                <Table.Root class="mt-2">
+                    <Table.Header>
                         <Table.Row>
-                            <Table.Cell class="capitalize">{account.provider} ({account.username || account.provider_user_id})</Table.Cell>
-                            <Table.Cell class="text-right">
-                                <Button
-                                    aria-label="Remove {account.provider} account"
-                                    disabled={!canUnlinkAccount}
-                                    onclick={() => handleUnlinkAccount(account.provider, account.provider_user_id)}
-                                    size="icon"
-                                    title={canUnlinkAccount ? 'Remove' : 'Cannot remove the only login method'}
-                                    variant="ghost"
-                                >
-                                    <X class="size-4" />
-                                </Button>
-                            </Table.Cell>
+                            <Table.Head>Provider</Table.Head>
+                            <Table.Head class="w-24 text-right">Actions</Table.Head>
                         </Table.Row>
-                    {/each}
-                </Table.Body>
-            </Table.Root>
-        {:else}
-            <P class="text-muted-foreground mt-2">No external logins were found.</P>
-        {/if}
-    </div>
+                    </Table.Header>
+                    <Table.Body>
+                        {#each oauthAccounts as account (account.provider_user_id)}
+                            <Table.Row>
+                                <Table.Cell class="capitalize">{account.provider} ({account.username || account.provider_user_id})</Table.Cell>
+                                <Table.Cell class="text-right">
+                                    <Button
+                                        aria-label="Remove {account.provider} account"
+                                        disabled={!canUnlinkAccount}
+                                        onclick={() => handleUnlinkAccount(account.provider, account.provider_user_id)}
+                                        size="icon"
+                                        title={canUnlinkAccount ? 'Remove' : 'Cannot remove the only login method'}
+                                        variant="ghost"
+                                    >
+                                        <X class="size-4" />
+                                    </Button>
+                                </Table.Cell>
+                            </Table.Row>
+                        {/each}
+                    </Table.Body>
+                </Table.Root>
+            {:else}
+                <P class="text-muted-foreground mt-2">No external logins were found.</P>
+            {/if}
+        </div>
+    {:else}
+        <P class="text-muted-foreground">External login providers are not configured.</P>
+    {/if}
 </div>
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
index 4633a463d7..69d246877a 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
@@ -23,12 +23,13 @@ vi.mock('#features/users/api.svelte.ts', () => ({
 }));
 
 describe('external logins', () => {
-    it('keeps legacy accounts available to unlink when no providers are configured', () => {
+    it('hides external logins when no providers are configured', () => {
         render(ExternalLogins);
 
         expect(screen.getByText('External login providers are not configured.')).toBeVisible();
         expect(screen.queryByRole('button', { name: /Link .* account/ })).not.toBeInTheDocument();
-        expect(screen.getByText('facebook (legacy-user)')).toBeVisible();
-        expect(screen.getByRole('button', { name: 'Remove facebook account' })).toBeEnabled();
+        expect(screen.queryByText('Existing external logins')).not.toBeInTheDocument();
+        expect(screen.queryByText('facebook (legacy-user)')).not.toBeInTheDocument();
+        expect(screen.queryByRole('button', { name: 'Remove facebook account' })).not.toBeInTheDocument();
     });
 });
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
index 8234b5abfb..b09b3e9775 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/login/+page.svelte
@@ -173,7 +173,7 @@
                     <P class="mt-0! px-3">OR</P>
                     <hr class="w-full" />
                 </div>
-                <div class="grid grid-cols-2 gap-4">
+                <div class="grid grid-flow-col grid-cols-2 grid-rows-2 gap-4">
                     {#if microsoftClientId}
                         <Button aria-label="Login with Microsoft" tabindex={4} onclick={() => microsoftLogin(redirectUrl, inviteToken)}>
                             <MicrosoftIcon class="size-4" /> Microsoft
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
index 5f58453663..a189d5625b 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
@@ -66,7 +66,7 @@
         <div>
             {#if googleClientId || gitHubClientId}
                 <P class="text-center">Sign up with</P>
-                <div class="grid grid-cols-2 gap-4">
+                <div class="grid grid-flow-col grid-cols-2 grid-rows-2 gap-4">
                     {#if googleClientId}
                         <Button aria-label="Sign up with Google" onclick={() => googleLogin(redirectUrl, inviteToken)}>
                             <GoogleIcon class="size-4" /> Google

From 1503f7e6288cb6ff8663a52f6117b9789a5bf61d Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 07:44:53 -0500
Subject: [PATCH 07/12] Reuse ciE2E to skip the duplicate npm install

---
 .github/workflows/build.yaml         | 2 +-
 src/Exceptionless.AppHost/Program.cs | 3 +--
 tests/ci/README.md                   | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 0933687634..64c0941bc9 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -367,7 +367,7 @@ jobs:
           mkdir -p "$HOME/.aspnet/https"
           # Aspire builds the AppHost and its referenced projects in Debug. Do not build
           # the entire solution in Release first (including an unused test assembly).
-          aspire run --apphost src/Exceptionless.AppHost --non-interactive --nologo -- --ci-e2e --skip-client-dependency-install > aspire-run.log 2>&1 &
+          aspire run --apphost src/Exceptionless.AppHost --non-interactive --nologo -- --ci-e2e > aspire-run.log 2>&1 &
           echo "$!" > aspire-run.pid
           sleep 5
           if ! kill -0 "$(cat aspire-run.pid)" 2>/dev/null; then
diff --git a/src/Exceptionless.AppHost/Program.cs b/src/Exceptionless.AppHost/Program.cs
index a872746e95..983e877ca9 100644
--- a/src/Exceptionless.AppHost/Program.cs
+++ b/src/Exceptionless.AppHost/Program.cs
@@ -12,7 +12,6 @@
     : null;
 bool servicesOnly = HasArgument("--services-only");
 bool ciE2E = HasArgument("--ci-e2e");
-bool skipClientDependencyInstall = HasArgument("--skip-client-dependency-install");
 bool includeDevTools = !ciE2E;
 int appPort = worktreePorts?.AppHttps ?? 7131;
 string appOrigin = worktreePorts?.AppHttpsUrl ?? $"https://web-ex.dev.localhost:{appPort}";
@@ -218,7 +217,7 @@
     }
 
     // The e2e workflow runs npm ci before starting the AppHost, so it skips Aspire's second install.
-    if (skipClientDependencyInstall)
+    if (ciE2E)
         app.WithNpm(install: false);
 
     if (includeDevTools)
diff --git a/tests/ci/README.md b/tests/ci/README.md
index 68be3f9cf8..96f77dc2df 100644
--- a/tests/ci/README.md
+++ b/tests/ci/README.md
@@ -15,7 +15,7 @@ The normal build targets a roughly **10-minute critical path**. Track elapsed wo
 - .NET coverage is merged as a union with ReportGenerator before publishing the existing coverage summary. Browser blob reports are merged into one HTML/JSON/JUnit report. Per-shard TRX, CTRF JSON, JUnit, failure traces/screenshots, and Aspire logs remain downloadable for 14 days.
 - E2E startup lets Aspire build its referenced applications once. The former Release solution build was unused by Aspire's Debug startup and also built the unused .NET test assembly.
 - Browser shards use GitHub's Ubuntu 24.04 image (with its installed browser libraries) and install only Playwright's headless Chromium shell. This avoids unrelated apt upgrades and font downloads that added several minutes to individual runners. Browser versions still come from the locked Playwright package; all layout/locale tests remain enabled.
-- Browser shards install ClientApp dependencies with `npm ci` before AppHost startup, then pass `--skip-client-dependency-install` to avoid running a second install. Local `--ci-e2e` runs omit that flag, so Aspire still installs dependencies when needed.
+- Browser shards install ClientApp dependencies with `npm ci` before AppHost startup; `--ci-e2e` disables Aspire's second install. Local `--ci-e2e` runs need ClientApp dependencies installed first.
 - Backend fixtures request `--test-services`, starting only Elasticsearch. Their queues/cache are in memory and storage is scoped to local files. The general `--services-only` mode still starts all development services. This also prevents backend tests from replacing a live preview's shared Azurite container with different dynamic ports.
 - `--ci-e2e` uses temporary Redis and storage containers with allocated ports. This prevents concurrent local AppHosts from replacing shared containers or changing credentials/TLS configuration during a test run. Normal development retains its persistent containers and volumes.
 - Superseded PR runs are cancelled; push/tag runs are not interrupted by newer runs.

From f8142c3beaeb9d9befc98ae0b8040d7f066b0fda Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 08:05:31 -0500
Subject: [PATCH 08/12] Allow Microsoft signup and account matching

---
 .../Api/Handlers/AuthHandler.cs               |  10 +-
 .../Api/Handlers/UserHandler.cs               |   4 +-
 .../src/routes/(auth)/signup/+page.svelte     |  20 +++-
 .../Endpoints/MicrosoftAuthEndpointTests.cs   | 102 ++++++------------
 .../Api/Endpoints/UserEndpointTests.cs        |  12 +--
 .../Api/Handlers/AuthHandlerTests.cs          |  46 --------
 6 files changed, 56 insertions(+), 138 deletions(-)

diff --git a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
index 63f0accd24..936eedc05d 100644
--- a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
@@ -545,16 +545,12 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.ProviderName);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Email);
 
-        bool isMicrosoft = String.Equals(userInfo.ProviderName, MicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase);
         var existingUser = await userRepository.GetUserByOAuthProviderAsync(userInfo.ProviderName, userInfo.Id);
         using var _ = logger.BeginScope(new ExceptionlessState().Tag("External Login").Tag(userInfo.ProviderName).Identity(userInfo.Email).SetHttpContext(httpContext));
 
         if (String.IsNullOrWhiteSpace(inviteToken) && httpContext.User.IsUserAuthType())
         {
             var currentUser = httpContext.Request.GetUser();
-            if (isMicrosoft && !currentUser.IsEmailAddressVerified)
-                return Result.Forbidden("Verify your account email address before linking Microsoft from your account settings.");
-
             if (existingUser is not null)
             {
                 if (!String.Equals(existingUser.Id, currentUser.Id, StringComparison.Ordinal))
@@ -583,7 +579,7 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
         if (existingUser is not null)
         {
             bool hasChanges = RemoveLegacyMicrosoftOAuthAccounts(existingUser, userInfo.ProviderName);
-            if (!isMicrosoft && !existingUser.IsEmailAddressVerified)
+            if (!existingUser.IsEmailAddressVerified)
             {
                 existingUser.MarkEmailAddressVerified();
                 hasChanges = true;
@@ -595,10 +591,6 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
             return existingUser;
         }
 
-        // Microsoft Graph mail is editable. Never create or match an account using it.
-        if (isMicrosoft)
-            return Result.Forbidden("Create and verify an account, or sign in to your existing account, then link Microsoft from your account settings.");
-
         var user = !String.IsNullOrEmpty(userInfo.Email) ? await userRepository.GetByEmailAddressAsync(userInfo.Email) : null;
 
         if (user is null)
diff --git a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
index 65c293bb7b..1e4c70db63 100644
--- a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
@@ -284,10 +284,8 @@ public async Task<Result<UpdateEmailAddressResult>> Handle(UpdateEmailAddress me
 
         user.ResetPasswordResetToken();
         user.EmailAddress = email;
-        // Microsoft Graph mail is editable and does not establish email ownership.
         user.IsEmailAddressVerified = user.OAuthAccounts.Any(oa =>
-            !String.Equals(oa.Provider, "Microsoft", StringComparison.OrdinalIgnoreCase)
-            && String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
+            String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
         if (user.IsEmailAddressVerified)
             user.MarkEmailAddressVerified();
         else
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
index a189d5625b..ec29db7fdb 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/signup/+page.svelte
@@ -7,6 +7,7 @@
     import ErrorMessage from '#comp/error-message.svelte';
     import GitHubIcon from '#comp/icons/GitHubIcon.svelte';
     import GoogleIcon from '#comp/icons/GoogleIcon.svelte';
+    import MicrosoftIcon from '#comp/icons/MicrosoftIcon.svelte';
     import Logo from '#comp/logo.svelte';
     import { A, P } from '#comp/typography/index.ts';
     import { Button } from '#comp/ui/button/index.ts';
@@ -16,7 +17,17 @@
     import { Input } from '#comp/ui/input/index.ts';
     import { Spinner } from '#comp/ui/spinner/index.ts';
     import { signup } from '#features/auth/api.svelte.ts';
-    import { accessToken, gitHubClientId, githubLogin, googleClientId, googleLogin, logout } from '#features/auth/index.svelte.ts';
+    import {
+        accessToken,
+        enableOAuthLogin,
+        gitHubClientId,
+        githubLogin,
+        googleClientId,
+        googleLogin,
+        logout,
+        microsoftClientId,
+        microsoftLogin
+    } from '#features/auth/index.svelte.ts';
     import { type SignupFormData, SignupSchema } from '#features/auth/schemas.ts';
     import { validateEmailAvailability } from '#features/auth/validators.ts';
     import { gotoRedirect } from '#features/navigation/redirect.ts';
@@ -64,9 +75,14 @@
     </Card.Header>
     <Card.Content>
         <div>
-            {#if googleClientId || gitHubClientId}
+            {#if enableOAuthLogin}
                 <P class="text-center">Sign up with</P>
                 <div class="grid grid-flow-col grid-cols-2 grid-rows-2 gap-4">
+                    {#if microsoftClientId}
+                        <Button aria-label="Sign up with Microsoft" onclick={() => microsoftLogin(redirectUrl, inviteToken)}>
+                            <MicrosoftIcon class="size-4" /> Microsoft
+                        </Button>
+                    {/if}
                     {#if googleClientId}
                         <Button aria-label="Sign up with Google" onclick={() => googleLogin(redirectUrl, inviteToken)}>
                             <GoogleIcon class="size-4" /> Google
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
index fcf7af2ead..9d4d7c036f 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
@@ -1,19 +1,15 @@
 using Exceptionless.Core.Authorization;
 using Exceptionless.Core.Configuration;
 using Exceptionless.Core.Extensions;
-using Exceptionless.Core.Mail;
 using Exceptionless.Core.Models;
 using Exceptionless.Core.Repositories;
 using Exceptionless.Core.Utility;
 using Exceptionless.Tests.Extensions;
-using Exceptionless.Tests.Mail;
 using Exceptionless.Tests.Utility;
 using Exceptionless.Web.Models;
 using FluentRest;
 using Foundatio.Repositories;
-using Microsoft.Extensions.DependencyInjection;
 using Xunit;
-using ProblemDetails = Microsoft.AspNetCore.Mvc.ProblemDetails;
 
 namespace Exceptionless.Tests.Api.Endpoints;
 
@@ -25,7 +21,6 @@ public sealed class MicrosoftAuthEndpointTests : IntegrationTestsBase
     private readonly string? _originalMicrosoftSecret;
     private readonly IUserRepository _userRepository;
     private readonly IOrganizationRepository _organizationRepository;
-    private readonly CountingMailer _mailer;
 
     public MicrosoftAuthEndpointTests(ITestOutputHelper output, AppWebHostFactory factory) : base(output, factory)
     {
@@ -35,14 +30,6 @@ public MicrosoftAuthEndpointTests(ITestOutputHelper output, AppWebHostFactory fa
         _originalMicrosoftSecret = _authOptions.MicrosoftSecret;
         _userRepository = GetService<IUserRepository>();
         _organizationRepository = GetService<IOrganizationRepository>();
-        _mailer = GetService<CountingMailer>();
-    }
-
-    protected override void RegisterServices(IServiceCollection services)
-    {
-        base.RegisterServices(services);
-        services.AddSingleton<CountingMailer>();
-        services.ReplaceSingleton<IMailer>(provider => provider.GetRequiredService<CountingMailer>());
     }
 
     protected override async Task ResetDataAsync()
@@ -52,7 +39,6 @@ protected override async Task ResetDataAsync()
         _authOptions.MicrosoftId = "microsoft-client-id";
         _authOptions.MicrosoftSecret = "microsoft-client-secret";
         await GetService<SampleDataService>().CreateDataAsync();
-        _mailer.Reset();
     }
 
     public override ValueTask DisposeAsync()
@@ -87,17 +73,13 @@ public async Task MicrosoftAsync_AuthenticatedLinkWithDifferentEmail_ReplacesLeg
         Assert.Equal(TestOAuthProviderClient.GetEmailAddress(code), account.Username);
     }
 
-    [Theory]
-    [InlineData(true)]
-    [InlineData(false)]
-    public async Task MicrosoftAsync_ExistingModernIdentity_PreservesEmailVerification(bool isEmailVerified)
+    [Fact]
+    public async Task MicrosoftAsync_ExistingModernIdentity_MarksEmailVerified()
     {
         // Arrange
         const string code = "existing-microsoft-user";
         var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
-        if (!isEmailVerified)
-            user.ResetVerifyEmailAddressTokenAndExpiration(TimeProvider);
-        string? verificationToken = user.VerifyEmailAddressToken;
+        user.ResetVerifyEmailAddressTokenAndExpiration(TimeProvider);
         user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
         user.AddOAuthAccount("Microsoft", code, user.EmailAddress);
         await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
@@ -111,62 +93,51 @@ public async Task MicrosoftAsync_ExistingModernIdentity_PreservesEmailVerificati
         var account = Assert.Single(updatedUser.OAuthAccounts);
         Assert.Equal("microsoft", account.Provider);
         Assert.Equal(code, account.ProviderUserId);
-        Assert.Equal(isEmailVerified, updatedUser.IsEmailAddressVerified);
-        Assert.Equal(verificationToken, updatedUser.VerifyEmailAddressToken);
+        Assert.True(updatedUser.IsEmailAddressVerified);
+        Assert.Null(updatedUser.VerifyEmailAddressToken);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_ExactEmailMatch_RequiresAuthenticatedLinkWithoutChangingUser()
+    public async Task MicrosoftAsync_ExactEmailMatch_SignsIntoExistingUser()
     {
         // Arrange
         const string code = "matching-email-user";
         var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
-        user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
         await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
 
         // Act
-        var problem = await SendRequestAsAsync<ProblemDetails>(request => request
-            .Post()
-            .AppendPaths("auth", "microsoft")
-            .Content(new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = code, RedirectUri = "http://localhost" })
-            .StatusCodeShouldBeForbidden());
+        await SendMicrosoftLoginAsync(code);
 
         // Assert
         var updatedUser = await _userRepository.GetByEmailAddressAsync(user.EmailAddress);
         Assert.NotNull(updatedUser);
         Assert.Equal(user.Id, updatedUser.Id);
         var account = Assert.Single(updatedUser.OAuthAccounts);
-        Assert.Equal("windowslive", account.Provider);
-        Assert.Equal("legacy-user", account.ProviderUserId);
-        Assert.NotNull(problem);
-        Assert.Contains("link Microsoft", problem.Title);
+        Assert.Equal("microsoft", account.Provider);
+        Assert.Equal(code, account.ProviderUserId);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_UnmatchedEmail_DoesNotCreateUserOrChangeLegacyUser()
+    public async Task MicrosoftAsync_UnmatchedEmail_CreatesUser()
     {
         // Arrange
-        const string code = "different-email-user";
-        var legacyUser = CreateUser("legacy-user@exceptionless.test");
-        legacyUser.AddOAuthAccount("WindowsLive", "legacy-user", legacyUser.EmailAddress);
-        await _userRepository.AddAsync(legacyUser, o => o.ImmediateConsistency());
+        const string code = "new-microsoft-user";
+        string emailAddress = TestOAuthProviderClient.GetEmailAddress(code);
 
         // Act
-        await AssertMicrosoftLoginForbiddenAsync(code);
+        await SendMicrosoftLoginAsync(code);
 
         // Assert
-        var unchangedLegacyUser = await _userRepository.GetByIdAsync(legacyUser.Id);
-        Assert.NotNull(unchangedLegacyUser);
-        var legacyAccount = Assert.Single(unchangedLegacyUser.OAuthAccounts);
-        Assert.Equal("windowslive", legacyAccount.Provider);
-
-        var microsoftUser = await _userRepository.GetByEmailAddressAsync(TestOAuthProviderClient.GetEmailAddress(code));
-        Assert.Null(microsoftUser);
-        Assert.Equal(0, _mailer.UserEmailVerificationCount);
+        var microsoftUser = await _userRepository.GetByEmailAddressAsync(emailAddress);
+        Assert.NotNull(microsoftUser);
+        Assert.True(microsoftUser.IsEmailAddressVerified);
+        var account = Assert.Single(microsoftUser.OAuthAccounts);
+        Assert.Equal("microsoft", account.Provider);
+        Assert.Equal(code, account.ProviderUserId);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_MatchingInvitation_DoesNotBypassVerifiedAccountRequirement()
+    public async Task MicrosoftAsync_MatchingInvitation_CreatesUserAndJoinsOrganization()
     {
         // Arrange
         const string code = "invited-microsoft-user";
@@ -181,19 +152,20 @@ public async Task MicrosoftAsync_MatchingInvitation_DoesNotBypassVerifiedAccount
         await _organizationRepository.SaveAsync(organization, options => options.ImmediateConsistency());
 
         // Act
-        await AssertMicrosoftLoginForbiddenAsync(code, inviteToken: invite.Token);
+        await SendMicrosoftLoginAsync(code, inviteToken: invite.Token);
 
         // Assert
         var user = await _userRepository.GetByEmailAddressAsync(emailAddress);
-        Assert.Null(user);
-        var unchangedOrganization = await _organizationRepository.GetByIdAsync(organization.Id);
-        Assert.NotNull(unchangedOrganization);
-        Assert.Contains(unchangedOrganization.Invites, existing => existing.Token == invite.Token);
-        Assert.Equal(0, _mailer.UserEmailVerificationCount);
+        Assert.NotNull(user);
+        Assert.True(user.IsEmailAddressVerified);
+        Assert.Contains(organization.Id, user.OrganizationIds);
+        var updatedOrganization = await _organizationRepository.GetByIdAsync(organization.Id);
+        Assert.NotNull(updatedOrganization);
+        Assert.DoesNotContain(updatedOrganization.Invites, existing => existing.Token == invite.Token);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_UnverifiedAuthenticatedUser_CannotLinkIdentity()
+    public async Task MicrosoftAsync_UnverifiedAuthenticatedUser_CanLinkIdentity()
     {
         // Arrange
         var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
@@ -203,27 +175,13 @@ public async Task MicrosoftAsync_UnverifiedAuthenticatedUser_CannotLinkIdentity(
         await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
 
         // Act
-        await AssertMicrosoftLoginForbiddenAsync("unverified-link", isAuthenticated: true);
+        await SendMicrosoftLoginAsync("unverified-link", isAuthenticated: true);
 
         // Assert
         var unchangedUser = await _userRepository.GetByIdAsync(user.Id);
         Assert.NotNull(unchangedUser);
         Assert.False(unchangedUser.IsEmailAddressVerified);
-        Assert.Equal("windowslive", Assert.Single(unchangedUser.OAuthAccounts).Provider);
-    }
-
-    private async Task AssertMicrosoftLoginForbiddenAsync(string code, bool isAuthenticated = false, string? inviteToken = null)
-    {
-        var problem = await SendRequestAsAsync<ProblemDetails>(request =>
-        {
-            request.Post().AppendPaths("auth", "microsoft")
-                .Content(new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = code, RedirectUri = "http://localhost", InviteToken = inviteToken })
-                .StatusCodeShouldBeForbidden();
-            if (isAuthenticated)
-                request.AsTestOrganizationUser();
-        });
-        Assert.NotNull(problem);
-        Assert.Contains("Microsoft", problem.Title);
+        Assert.Contains(unchangedUser.OAuthAccounts, account => account.Provider == "microsoft" && account.ProviderUserId == "unverified-link");
     }
 
     private static User CreateUser(string emailAddress)
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
index 8f91dd37ed..652a31d69c 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
@@ -1057,9 +1057,9 @@ public async Task UpdateEmailAddressAsync_ValidEmail_ReturnsResult()
     }
 
     [Theory]
-    [InlineData("Microsoft", false)]
-    [InlineData("Google", true)]
-    public async Task UpdateEmailAddressAsync_LinkedProviderEmail_PreservesProviderTrust(string provider, bool isVerified)
+    [InlineData("Microsoft")]
+    [InlineData("Google")]
+    public async Task UpdateEmailAddressAsync_LinkedProviderEmail_MarksAddressVerified(string provider)
     {
         const string email = "linked-provider@exceptionless.test";
         var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
@@ -1074,12 +1074,12 @@ public async Task UpdateEmailAddressAsync_LinkedProviderEmail_PreservesProviderT
             .StatusCodeShouldBeOk());
 
         Assert.NotNull(result);
-        Assert.Equal(isVerified, result.IsVerified);
+        Assert.True(result.IsVerified);
         var updatedUser = await _userRepository.GetByIdAsync(user.Id);
         Assert.NotNull(updatedUser);
         Assert.Equal(email, updatedUser.EmailAddress);
-        Assert.Equal(isVerified, updatedUser.IsEmailAddressVerified);
-        Assert.Equal(!isVerified, !String.IsNullOrEmpty(updatedUser.VerifyEmailAddressToken));
+        Assert.True(updatedUser.IsEmailAddressVerified);
+        Assert.Null(updatedUser.VerifyEmailAddressToken);
     }
 
     [Fact]
diff --git a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
index 08a449196c..9e930452fa 100644
--- a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
+++ b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
@@ -128,52 +128,6 @@ public async Task Handle_LoginRepositoryException_ReturnsUnauthorizedResult(Exce
         new OperationCanceledException("Repository operation was canceled.")
     };
 
-    [Theory]
-    [InlineData(null)]
-    [InlineData("invitation-token")]
-    public async Task Handle_UnlinkedMicrosoftIdentity_DoesNotLookUpEmailOrModifyAccounts(string? inviteToken)
-    {
-        // Arrange
-        var userRepository = new Mock<IUserRepository>(MockBehavior.Strict);
-        userRepository.Setup(repository => repository.GetUserByOAuthProviderAsync("Microsoft", "matching-user"))
-            .ReturnsAsync((User?)null);
-        var handler = CreateHandler(userRepository.Object);
-
-        // Act
-        var result = await handler.Handle(new MicrosoftLogin(
-            new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = "matching-user", RedirectUri = "http://localhost", InviteToken = inviteToken },
-            new DefaultHttpContext()));
-
-        // Assert
-        Assert.Equal(ResultStatus.Forbidden, result.Status);
-        Assert.Contains("link", result.Message, StringComparison.OrdinalIgnoreCase);
-        userRepository.VerifyAll();
-        userRepository.VerifyNoOtherCalls();
-    }
-
-    [Fact]
-    public async Task Handle_UnverifiedAuthenticatedUser_DoesNotLinkMicrosoft()
-    {
-        // Arrange
-        var userRepository = new Mock<IUserRepository>(MockBehavior.Strict);
-        userRepository.Setup(repository => repository.GetUserByOAuthProviderAsync("Microsoft", "unverified-user"))
-            .ReturnsAsync((User?)null);
-        var user = new User { Id = "unverified", EmailAddress = "unverified@exceptionless.test" };
-        var context = new DefaultHttpContext { User = new ClaimsPrincipal(new ClaimsIdentity(IdentityUtils.UserAuthenticationType)) };
-        context.Request.SetUser(user);
-
-        // Act
-        var result = await CreateHandler(userRepository.Object).Handle(new MicrosoftLogin(
-            new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = "unverified-user", RedirectUri = "http://localhost" }, context));
-
-        // Assert
-        Assert.Equal(ResultStatus.Forbidden, result.Status);
-        Assert.Contains("Verify", result.Message);
-        Assert.Empty(user.OAuthAccounts);
-        userRepository.VerifyAll();
-        userRepository.VerifyNoOtherCalls();
-    }
-
     [Fact]
     public async Task Handle_MicrosoftProviderFails_DoesNotAccessUserRepository()
     {

From 5494e91f2b51aa1e79081b5d9f701f89e02ed1e9 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 08:21:23 -0500
Subject: [PATCH 09/12] Keep PR test changes focused

---
 .../Api/Endpoints/MicrosoftAuthEndpointTests.cs  | 16 ++++++++--------
 .../Api/Handlers/AuthHandlerTests.cs             | 14 +++++++++-----
 .../Exceptionless.Tests/Jobs/WebHooksJobTests.cs |  4 ----
 3 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
index 9d4d7c036f..2e5a025912 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
@@ -41,14 +41,6 @@ protected override async Task ResetDataAsync()
         await GetService<SampleDataService>().CreateDataAsync();
     }
 
-    public override ValueTask DisposeAsync()
-    {
-        _authOptions.EnableAccountCreation = _originalEnableAccountCreation;
-        _authOptions.MicrosoftId = _originalMicrosoftId;
-        _authOptions.MicrosoftSecret = _originalMicrosoftSecret;
-        return base.DisposeAsync();
-    }
-
     [Fact]
     public async Task MicrosoftAsync_AuthenticatedLinkWithDifferentEmail_ReplacesLegacyIdentity()
     {
@@ -216,4 +208,12 @@ private static User CreateUser(string emailAddress)
                 request.AsTestOrganizationUser();
         });
     }
+
+    public override ValueTask DisposeAsync()
+    {
+        _authOptions.EnableAccountCreation = _originalEnableAccountCreation;
+        _authOptions.MicrosoftId = _originalMicrosoftId;
+        _authOptions.MicrosoftSecret = _originalMicrosoftSecret;
+        return base.DisposeAsync();
+    }
 }
diff --git a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
index 9e930452fa..4fddb34fb1 100644
--- a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
+++ b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
@@ -136,7 +136,11 @@ public async Task Handle_MicrosoftProviderFails_DoesNotAccessUserRepository()
         var oauthProvider = new Mock<IOAuthProviderClient>(MockBehavior.Strict);
         oauthProvider.Setup(provider => provider.GetMicrosoftUserInfoAsync(It.IsAny<ExternalAuthInfo>(), "microsoft-client-id", "microsoft-client-secret"))
             .ThrowsAsync(new InvalidOperationException("Microsoft provider failed."));
-        var handler = CreateHandler(userRepository.Object, oauthProvider: oauthProvider.Object);
+        var handler = CreateHandler(
+            userRepository.Object,
+            GetService<ITokenRepository>(),
+            GetService<IOAuthTokenRepository>(),
+            oauthProvider.Object);
 
         // Act
         var exception = await Record.ExceptionAsync(async () =>
@@ -151,7 +155,7 @@ public async Task Handle_MicrosoftProviderFails_DoesNotAccessUserRepository()
         userRepository.VerifyNoOtherCalls();
     }
 
-    private AuthHandler CreateHandler(IUserRepository userRepository, ITokenRepository? tokenRepository = null, IOAuthTokenRepository? oauthTokenRepository = null, IOAuthProviderClient? oauthProvider = null)
+    private AuthHandler CreateHandler(IUserRepository userRepository, ITokenRepository tokenRepository, IOAuthTokenRepository oauthTokenRepository, IOAuthProviderClient oauthProvider)
     {
         var appOptions = GetService<AppOptions>();
         appOptions.AuthOptions.MicrosoftId = "microsoft-client-id";
@@ -162,9 +166,9 @@ private AuthHandler CreateHandler(IUserRepository userRepository, ITokenReposito
             appOptions.IntercomOptions,
             GetService<IOrganizationRepository>(),
             userRepository,
-            tokenRepository ?? GetService<ITokenRepository>(),
-            oauthTokenRepository ?? GetService<IOAuthTokenRepository>(),
-            oauthProvider ?? GetService<IOAuthProviderClient>(),
+            tokenRepository,
+            oauthTokenRepository,
+            oauthProvider,
             GetService<ICacheClient>(),
             GetService<AuthService>(),
             GetService<IMailer>(),
diff --git a/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs b/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs
index dd5a3852c7..85b1f67dba 100644
--- a/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs
+++ b/tests/Exceptionless.Tests/Jobs/WebHooksJobTests.cs
@@ -25,10 +25,6 @@
 
 namespace Exceptionless.Tests.Jobs;
 
-[CollectionDefinition(nameof(WebHookTelemetryCollection), DisableParallelization = true)]
-public sealed class WebHookTelemetryCollection;
-
-[Collection(nameof(WebHookTelemetryCollection))]
 public sealed class WebHooksJobTests : TestWithServices
 {
     private const string DestinationUrl = "https://example.com/webhook";

From 9bbe3d3c64a541fad5194c80a56e5144d866f829 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 08:42:56 -0500
Subject: [PATCH 10/12] Protect Microsoft email ownership and the last usable
 login

---
 .../Extensions/UserExtensions.cs              | 14 ++-
 .../Api/Endpoints/AuthEndpoints.cs            |  2 +-
 .../Api/Handlers/AuthHandler.cs               | 38 +++++---
 .../Api/Handlers/UserHandler.cs               |  4 +-
 .../account/external-logins/+page.svelte      | 10 +-
 .../external-logins.svelte.test.ts            | 53 ++++++++++-
 .../Exceptionless.Tests/Api/Data/openapi.json |  2 +-
 .../Endpoints/MicrosoftAuthEndpointTests.cs   | 50 ++++++++--
 .../Api/Endpoints/UserEndpointTests.cs        | 16 ++--
 .../Api/Handlers/AuthHandlerTests.cs          | 61 ++++++++++++
 .../Extensions/UserExtensionsTests.cs         | 95 +++++++++++++++++++
 11 files changed, 300 insertions(+), 45 deletions(-)
 create mode 100644 tests/Exceptionless.Tests/Extensions/UserExtensionsTests.cs

diff --git a/src/Exceptionless.Core/Extensions/UserExtensions.cs b/src/Exceptionless.Core/Extensions/UserExtensions.cs
index a04982adbc..cf8b86c724 100644
--- a/src/Exceptionless.Core/Extensions/UserExtensions.cs
+++ b/src/Exceptionless.Core/Extensions/UserExtensions.cs
@@ -79,13 +79,19 @@ public static void AddOAuthAccount(this User user, string providerName, string p
 
     public static bool RemoveOAuthAccount(this User user, string providerName, string providerUserId)
     {
-        if (user.OAuthAccounts.Count <= 1 && String.IsNullOrEmpty(user.Password))
-            return false;
-
-        var account = user.OAuthAccounts.FirstOrDefault(o => o.Provider == providerName.ToLowerInvariant() && o.ProviderUserId == providerUserId);
+        var account = user.OAuthAccounts.FirstOrDefault(o => String.Equals(o.Provider, providerName, StringComparison.OrdinalIgnoreCase) && o.ProviderUserId == providerUserId);
         if (account is null)
             return true;
 
+        // Retired provider records cannot keep a passwordless account accessible.
+        if (String.IsNullOrEmpty(user.Password)
+            && !String.Equals(account.Provider, "facebook", StringComparison.OrdinalIgnoreCase)
+            && !String.Equals(account.Provider, "windowslive", StringComparison.OrdinalIgnoreCase)
+            && !user.OAuthAccounts.Any(other => other != account
+                && !String.Equals(other.Provider, "facebook", StringComparison.OrdinalIgnoreCase)
+                && !String.Equals(other.Provider, "windowslive", StringComparison.OrdinalIgnoreCase)))
+            return false;
+
         return user.OAuthAccounts.Remove(account);
     }
 }
diff --git a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
index a9db9da0cc..1de150d69f 100644
--- a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
+++ b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
@@ -146,7 +146,7 @@ headers api_key input box.
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
-                ["403"] = "Account Creation is currently disabled",
+                ["403"] = "Account creation is disabled or Microsoft must be linked from an existing account",
                 ["422"] = "Validation error",
             }
         });
diff --git a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
index 936eedc05d..02da9c74d3 100644
--- a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
@@ -295,19 +295,16 @@ public async Task<Result<TokenResult>> Handle(RemoveExternalLogin message)
             return Result.BadRequest("Invalid Provider Name or Provider User Id.");
         }
 
-        if (user.OAuthAccounts.Count <= 1 && String.IsNullOrEmpty(user.Password))
-        {
-            logger.LogError("Remove external login failed for {EmailAddress}: You must set a local password before removing your external login", user.EmailAddress);
-            return Result.BadRequest("You must set a local password before removing your external login.");
-        }
-
         try
         {
-            if (user.RemoveOAuthAccount(message.ProviderName, message.ProviderUserId.Value))
+            if (!user.RemoveOAuthAccount(message.ProviderName, message.ProviderUserId.Value))
             {
-                user.AuthenticationVersion = Core.Extensions.StringExtensions.GetNewToken();
-                await userRepository.SaveAsync(user, o => o.Cache());
+                logger.LogError("Remove external login failed for {EmailAddress}: You must set a local password before removing your external login", user.EmailAddress);
+                return Result.BadRequest("You must set a local password before removing your external login.");
             }
+
+            user.AuthenticationVersion = Core.Extensions.StringExtensions.GetNewToken();
+            await userRepository.SaveAsync(user, o => o.Cache());
         }
         catch (Exception ex)
         {
@@ -513,6 +510,7 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         }
 
         User? user;
+        bool isNewUser;
         try
         {
             var result = await FromExternalLoginAsync(userInfo, authInfo.InviteToken, httpContext);
@@ -520,6 +518,7 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
                 return Result<TokenResult>.FromResult(result);
 
             user = result.Value;
+            isNewUser = result.Status == ResultStatus.Created;
         }
         catch (ApplicationException ex)
         {
@@ -535,6 +534,9 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         if (!String.IsNullOrWhiteSpace(authInfo.InviteToken))
             await AddInvitedUserToOrganizationAsync(authInfo.InviteToken, user, httpContext);
 
+        if (isNewUser && !user.IsEmailAddressVerified)
+            await mailer.SendUserEmailVerifyAsync(user);
+
         logger.UserLoggedIn(user.EmailAddress);
         return new TokenResult { Token = await GetOrCreateAuthenticationTokenAsync(user) };
     }
@@ -545,6 +547,7 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.ProviderName);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Email);
 
+        bool isMicrosoft = String.Equals(userInfo.ProviderName, MicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase);
         var existingUser = await userRepository.GetUserByOAuthProviderAsync(userInfo.ProviderName, userInfo.Id);
         using var _ = logger.BeginScope(new ExceptionlessState().Tag("External Login").Tag(userInfo.ProviderName).Identity(userInfo.Email).SetHttpContext(httpContext));
 
@@ -579,7 +582,7 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
         if (existingUser is not null)
         {
             bool hasChanges = RemoveLegacyMicrosoftOAuthAccounts(existingUser, userInfo.ProviderName);
-            if (!existingUser.IsEmailAddressVerified)
+            if (!isMicrosoft && !existingUser.IsEmailAddressVerified)
             {
                 existingUser.MarkEmailAddressVerified();
                 hasChanges = true;
@@ -592,6 +595,9 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
         }
 
         var user = !String.IsNullOrEmpty(userInfo.Email) ? await userRepository.GetByEmailAddressAsync(userInfo.Email) : null;
+        // Microsoft Graph mail is editable and does not establish ownership of an existing account.
+        if (isMicrosoft && user is not null)
+            return Result.Forbidden("Sign in to your existing account first, then link Microsoft from your account settings.");
 
         if (user is null)
         {
@@ -604,15 +610,17 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
             await AddGlobalAdminRoleIfFirstUserAsync(user);
         }
 
-        user.MarkEmailAddressVerified();
+        if (isMicrosoft)
+            user.ResetVerifyEmailAddressTokenAndExpiration(timeProvider);
+        else
+            user.MarkEmailAddressVerified();
+
         user.AddOAuthAccount(userInfo.ProviderName, userInfo.Id, userInfo.Email);
 
         if (String.IsNullOrEmpty(user.Id))
-            await userRepository.AddAsync(user, o => o.Cache());
-        else
-            await userRepository.SaveAsync(user, o => o.Cache());
+            return Result.Created(await userRepository.AddAsync(user, o => o.Cache()));
 
-        return user;
+        return await userRepository.SaveAsync(user, o => o.Cache());
     }
 
     private static bool RemoveLegacyMicrosoftOAuthAccounts(User user, string providerName)
diff --git a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
index 1e4c70db63..329f96ecd5 100644
--- a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
@@ -284,8 +284,10 @@ public async Task<Result<UpdateEmailAddressResult>> Handle(UpdateEmailAddress me
 
         user.ResetPasswordResetToken();
         user.EmailAddress = email;
+        // Microsoft Graph profile email does not establish mailbox ownership.
         user.IsEmailAddressVerified = user.OAuthAccounts.Any(oa =>
-            String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
+            !String.Equals(oa.Provider, "Microsoft", StringComparison.OrdinalIgnoreCase)
+            && String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
         if (user.IsEmailAddressVerified)
             user.MarkEmailAddressVerified();
         else
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
index 8deb5630eb..cc0a08c115 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
@@ -41,7 +41,11 @@
 
     const oauthAccounts = $derived(meQuery.data?.o_auth_accounts ?? []);
     const hasLocalAccount = $derived(meQuery.data?.has_local_account ?? false);
-    const canUnlinkAccount = $derived(hasLocalAccount || oauthAccounts.length > 1);
+    const activeOAuthAccountCount = $derived(oauthAccounts.filter((account) => !['facebook', 'windowslive'].includes(account.provider.toLowerCase())).length);
+
+    function canUnlinkAccount(provider: string) {
+        return hasLocalAccount || ['facebook', 'windowslive'].includes(provider.toLowerCase()) || activeOAuthAccountCount > 1;
+    }
 </script>
 
 <div class="space-y-6">
@@ -89,10 +93,10 @@
                                 <Table.Cell class="text-right">
                                     <Button
                                         aria-label="Remove {account.provider} account"
-                                        disabled={!canUnlinkAccount}
+                                        disabled={!canUnlinkAccount(account.provider)}
                                         onclick={() => handleUnlinkAccount(account.provider, account.provider_user_id)}
                                         size="icon"
-                                        title={canUnlinkAccount ? 'Remove' : 'Cannot remove the only login method'}
+                                        title={canUnlinkAccount(account.provider) ? 'Remove' : 'Cannot remove the only login method'}
                                         variant="ghost"
                                     >
                                         <X class="size-4" />
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
index 69d246877a..91114407f3 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/external-logins.svelte.test.ts
@@ -1,13 +1,23 @@
 import { render, screen } from '@testing-library/svelte';
-import { describe, expect, it, vi } from 'vitest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const state = vi.hoisted(() => ({
+    enableOAuthLogin: false,
+    hasLocalAccount: true,
+    oauthAccounts: [{ provider: 'facebook', provider_user_id: 'legacy-facebook-id', username: 'legacy-user' }]
+}));
 
 import ExternalLogins from './+page.svelte';
 
 vi.mock('#features/auth/index.svelte.ts', () => ({
-    enableOAuthLogin: false,
+    get enableOAuthLogin() {
+        return state.enableOAuthLogin;
+    },
     gitHubClientId: '',
     githubLogin: vi.fn(),
-    googleClientId: '',
+    get googleClientId() {
+        return state.enableOAuthLogin ? 'google-client-id' : '';
+    },
     googleLogin: vi.fn(),
     microsoftClientId: '',
     microsoftLogin: vi.fn()
@@ -16,13 +26,19 @@ vi.mock('#features/auth/api.svelte.ts', () => ({ unlinkOAuthAccount: vi.fn() }))
 vi.mock('#features/users/api.svelte.ts', () => ({
     getMeQuery: () => ({
         data: {
-            has_local_account: true,
-            o_auth_accounts: [{ provider: 'facebook', provider_user_id: 'legacy-facebook-id', username: 'legacy-user' }]
+            has_local_account: state.hasLocalAccount,
+            o_auth_accounts: state.oauthAccounts
         }
     })
 }));
 
 describe('external logins', () => {
+    beforeEach(() => {
+        state.enableOAuthLogin = false;
+        state.hasLocalAccount = true;
+        state.oauthAccounts = [{ provider: 'facebook', provider_user_id: 'legacy-facebook-id', username: 'legacy-user' }];
+    });
+
     it('hides external logins when no providers are configured', () => {
         render(ExternalLogins);
 
@@ -32,4 +48,31 @@ describe('external logins', () => {
         expect(screen.queryByText('facebook (legacy-user)')).not.toBeInTheDocument();
         expect(screen.queryByRole('button', { name: 'Remove facebook account' })).not.toBeInTheDocument();
     });
+
+    it.each(['facebook', 'WindowsLive'])('protects the last active login when a retained %s account exists', (retiredProvider) => {
+        state.enableOAuthLogin = true;
+        state.hasLocalAccount = false;
+        state.oauthAccounts = [
+            { provider: 'google', provider_user_id: 'google-user', username: 'user@example.com' },
+            { provider: retiredProvider, provider_user_id: 'retired-user', username: 'user@example.com' }
+        ];
+
+        render(ExternalLogins);
+
+        expect(screen.getByRole('button', { name: 'Remove google account' })).toBeDisabled();
+        expect(screen.getByRole('button', { name: `Remove ${retiredProvider} account` })).toBeEnabled();
+    });
+
+    it.each([true, false])('allows unlinking when another login remains, with local account: %s', (hasLocalAccount) => {
+        state.enableOAuthLogin = true;
+        state.hasLocalAccount = hasLocalAccount;
+        state.oauthAccounts = [{ provider: 'google', provider_user_id: 'google-user', username: 'user@example.com' }];
+        if (!hasLocalAccount) {
+            state.oauthAccounts.push({ provider: 'microsoft', provider_user_id: 'microsoft-user', username: 'user@example.com' });
+        }
+
+        render(ExternalLogins);
+
+        expect(screen.getByRole('button', { name: 'Remove google account' })).toBeEnabled();
+    });
 });
diff --git a/tests/Exceptionless.Tests/Api/Data/openapi.json b/tests/Exceptionless.Tests/Api/Data/openapi.json
index 88be9cf072..3d8489b2bb 100644
--- a/tests/Exceptionless.Tests/Api/Data/openapi.json
+++ b/tests/Exceptionless.Tests/Api/Data/openapi.json
@@ -1874,7 +1874,7 @@
             }
           },
           "403": {
-            "description": "Account Creation is currently disabled",
+            "description": "Account creation is disabled or Microsoft must be linked from an existing account",
             "content": {
               "application/problem\u002Bjson": {
                 "schema": {
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
index 2e5a025912..5a5cdcced7 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
@@ -1,15 +1,19 @@
 using Exceptionless.Core.Authorization;
 using Exceptionless.Core.Configuration;
 using Exceptionless.Core.Extensions;
+using Exceptionless.Core.Mail;
 using Exceptionless.Core.Models;
 using Exceptionless.Core.Repositories;
 using Exceptionless.Core.Utility;
 using Exceptionless.Tests.Extensions;
+using Exceptionless.Tests.Mail;
 using Exceptionless.Tests.Utility;
 using Exceptionless.Web.Models;
 using FluentRest;
 using Foundatio.Repositories;
+using Microsoft.Extensions.DependencyInjection;
 using Xunit;
+using ProblemDetails = Microsoft.AspNetCore.Mvc.ProblemDetails;
 
 namespace Exceptionless.Tests.Api.Endpoints;
 
@@ -21,6 +25,7 @@ public sealed class MicrosoftAuthEndpointTests : IntegrationTestsBase
     private readonly string? _originalMicrosoftSecret;
     private readonly IUserRepository _userRepository;
     private readonly IOrganizationRepository _organizationRepository;
+    private readonly CountingMailer _mailer;
 
     public MicrosoftAuthEndpointTests(ITestOutputHelper output, AppWebHostFactory factory) : base(output, factory)
     {
@@ -30,6 +35,14 @@ public MicrosoftAuthEndpointTests(ITestOutputHelper output, AppWebHostFactory fa
         _originalMicrosoftSecret = _authOptions.MicrosoftSecret;
         _userRepository = GetService<IUserRepository>();
         _organizationRepository = GetService<IOrganizationRepository>();
+        _mailer = GetService<CountingMailer>();
+    }
+
+    protected override void RegisterServices(IServiceCollection services)
+    {
+        base.RegisterServices(services);
+        services.AddSingleton<CountingMailer>();
+        services.ReplaceSingleton<IMailer>(provider => provider.GetRequiredService<CountingMailer>());
     }
 
     protected override async Task ResetDataAsync()
@@ -39,6 +52,7 @@ protected override async Task ResetDataAsync()
         _authOptions.MicrosoftId = "microsoft-client-id";
         _authOptions.MicrosoftSecret = "microsoft-client-secret";
         await GetService<SampleDataService>().CreateDataAsync();
+        _mailer.Reset();
     }
 
     [Fact]
@@ -66,12 +80,13 @@ public async Task MicrosoftAsync_AuthenticatedLinkWithDifferentEmail_ReplacesLeg
     }
 
     [Fact]
-    public async Task MicrosoftAsync_ExistingModernIdentity_MarksEmailVerified()
+    public async Task MicrosoftAsync_ExistingModernIdentity_PreservesEmailVerification()
     {
         // Arrange
         const string code = "existing-microsoft-user";
         var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
         user.ResetVerifyEmailAddressTokenAndExpiration(TimeProvider);
+        string? verificationToken = user.VerifyEmailAddressToken;
         user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
         user.AddOAuthAccount("Microsoft", code, user.EmailAddress);
         await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
@@ -85,32 +100,41 @@ public async Task MicrosoftAsync_ExistingModernIdentity_MarksEmailVerified()
         var account = Assert.Single(updatedUser.OAuthAccounts);
         Assert.Equal("microsoft", account.Provider);
         Assert.Equal(code, account.ProviderUserId);
-        Assert.True(updatedUser.IsEmailAddressVerified);
-        Assert.Null(updatedUser.VerifyEmailAddressToken);
+        Assert.False(updatedUser.IsEmailAddressVerified);
+        Assert.Equal(verificationToken, updatedUser.VerifyEmailAddressToken);
+        Assert.Equal(0, _mailer.UserEmailVerificationCount);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_ExactEmailMatch_SignsIntoExistingUser()
+    public async Task MicrosoftAsync_ExactEmailMatch_RequiresAuthenticatedLink()
     {
         // Arrange
         const string code = "matching-email-user";
         var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
+        user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
         await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
 
         // Act
-        await SendMicrosoftLoginAsync(code);
+        var problem = await SendRequestAsAsync<ProblemDetails>(request => request
+            .Post()
+            .AppendPaths("auth", "microsoft")
+            .Content(new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = code, RedirectUri = "http://localhost" })
+            .StatusCodeShouldBeForbidden());
 
         // Assert
         var updatedUser = await _userRepository.GetByEmailAddressAsync(user.EmailAddress);
         Assert.NotNull(updatedUser);
         Assert.Equal(user.Id, updatedUser.Id);
         var account = Assert.Single(updatedUser.OAuthAccounts);
-        Assert.Equal("microsoft", account.Provider);
-        Assert.Equal(code, account.ProviderUserId);
+        Assert.Equal("windowslive", account.Provider);
+        Assert.Equal("legacy-user", account.ProviderUserId);
+        Assert.NotNull(problem);
+        Assert.Contains("link Microsoft", problem.Title);
+        Assert.Equal(0, _mailer.UserEmailVerificationCount);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_UnmatchedEmail_CreatesUser()
+    public async Task MicrosoftAsync_UnmatchedEmail_CreatesUnverifiedUserAndSendsOneVerification()
     {
         // Arrange
         const string code = "new-microsoft-user";
@@ -118,14 +142,19 @@ public async Task MicrosoftAsync_UnmatchedEmail_CreatesUser()
 
         // Act
         await SendMicrosoftLoginAsync(code);
+        await RefreshDataAsync();
+        await SendMicrosoftLoginAsync(code);
 
         // Assert
         var microsoftUser = await _userRepository.GetByEmailAddressAsync(emailAddress);
         Assert.NotNull(microsoftUser);
-        Assert.True(microsoftUser.IsEmailAddressVerified);
+        Assert.False(microsoftUser.IsEmailAddressVerified);
+        Assert.NotNull(microsoftUser.VerifyEmailAddressToken);
+        Assert.True(microsoftUser.HasValidVerifyEmailAddressTokenExpiration(TimeProvider));
         var account = Assert.Single(microsoftUser.OAuthAccounts);
         Assert.Equal("microsoft", account.Provider);
         Assert.Equal(code, account.ProviderUserId);
+        Assert.Equal(1, _mailer.UserEmailVerificationCount);
     }
 
     [Fact]
@@ -133,6 +162,7 @@ public async Task MicrosoftAsync_MatchingInvitation_CreatesUserAndJoinsOrganizat
     {
         // Arrange
         const string code = "invited-microsoft-user";
+        _authOptions.EnableAccountCreation = false;
         string emailAddress = TestOAuthProviderClient.GetEmailAddress(code);
         var organization = (await _organizationRepository.GetAllAsync()).Documents.First();
         var invite = new Invite {
@@ -154,6 +184,8 @@ public async Task MicrosoftAsync_MatchingInvitation_CreatesUserAndJoinsOrganizat
         var updatedOrganization = await _organizationRepository.GetByIdAsync(organization.Id);
         Assert.NotNull(updatedOrganization);
         Assert.DoesNotContain(updatedOrganization.Invites, existing => existing.Token == invite.Token);
+        Assert.Null(user.VerifyEmailAddressToken);
+        Assert.Equal(0, _mailer.UserEmailVerificationCount);
     }
 
     [Fact]
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
index 652a31d69c..ba096c03a1 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
@@ -1057,29 +1057,33 @@ public async Task UpdateEmailAddressAsync_ValidEmail_ReturnsResult()
     }
 
     [Theory]
-    [InlineData("Microsoft")]
-    [InlineData("Google")]
-    public async Task UpdateEmailAddressAsync_LinkedProviderEmail_MarksAddressVerified(string provider)
+    [InlineData("Microsoft", false)]
+    [InlineData("Google", true)]
+    public async Task UpdateEmailAddressAsync_LinkedProviderEmail_RequiresProofForMicrosoft(string provider, bool isVerified)
     {
+        // Arrange
         const string email = "linked-provider@exceptionless.test";
         var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
         Assert.NotNull(user);
         user.AddOAuthAccount(provider, "provider-user", email);
         await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
 
+        // Act
         var result = await SendRequestAsAsync<UpdateEmailAddressResult>(r => r
             .Post()
             .AsTestOrganizationUser()
             .AppendPaths("users", user.Id, "email-address", email)
             .StatusCodeShouldBeOk());
 
+        // Assert
         Assert.NotNull(result);
-        Assert.True(result.IsVerified);
+        Assert.Equal(isVerified, result.IsVerified);
         var updatedUser = await _userRepository.GetByIdAsync(user.Id);
         Assert.NotNull(updatedUser);
         Assert.Equal(email, updatedUser.EmailAddress);
-        Assert.True(updatedUser.IsEmailAddressVerified);
-        Assert.Null(updatedUser.VerifyEmailAddressToken);
+        Assert.Equal(isVerified, updatedUser.IsEmailAddressVerified);
+        Assert.Equal(isVerified, String.IsNullOrEmpty(updatedUser.VerifyEmailAddressToken));
+        Assert.Equal(!isVerified, updatedUser.HasValidVerifyEmailAddressTokenExpiration(TimeProvider));
     }
 
     [Fact]
diff --git a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
index 4fddb34fb1..6a4e530c3c 100644
--- a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
+++ b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
@@ -128,6 +128,67 @@ public async Task Handle_LoginRepositoryException_ReturnsUnauthorizedResult(Exce
         new OperationCanceledException("Repository operation was canceled.")
     };
 
+    [Fact]
+    public async Task Handle_MicrosoftEmailCollision_DoesNotAttachIdentityOrIssueToken()
+    {
+        // Arrange
+        const string providerUserId = "unlinked-microsoft-user";
+        var user = GetService<UserData>().GenerateUser(id: TestConstants.UserId, emailAddress: TestConstants.UserEmail);
+        user.MarkEmailAddressVerified();
+        var users = new Mock<IUserRepository>(MockBehavior.Strict);
+        users.Setup(repository => repository.GetUserByOAuthProviderAsync("Microsoft", providerUserId)).ReturnsAsync((User?)null);
+        users.Setup(repository => repository.GetByEmailAddressAsync(user.EmailAddress)).ReturnsAsync(user);
+        users.Setup(repository => repository.SaveAsync(user, It.IsAny<CommandOptionsDescriptor<User>>())).ReturnsAsync(user);
+        var tokens = new Mock<ITokenRepository>(MockBehavior.Strict);
+        tokens.Setup(repository => repository.GetByTypeAndUserIdAsync(TokenType.Authentication, user.Id, null)).ReturnsAsync(FindResults<Token>.Empty);
+        tokens.Setup(repository => repository.AddAsync(It.IsAny<Token>(), It.IsAny<CommandOptionsDescriptor<Token>>()))
+            .ReturnsAsync((Token token, CommandOptionsDescriptor<Token> _) => token);
+        var oauthTokens = new Mock<IOAuthTokenRepository>(MockBehavior.Strict);
+        var provider = new Mock<IOAuthProviderClient>(MockBehavior.Strict);
+        provider.Setup(client => client.GetMicrosoftUserInfoAsync(It.IsAny<ExternalAuthInfo>(), "microsoft-client-id", "microsoft-client-secret"))
+            .ReturnsAsync(new OAuth2.Models.UserInfo { ProviderName = "Microsoft", Id = providerUserId, Email = user.EmailAddress });
+        var handler = CreateHandler(users.Object, tokens.Object, oauthTokens.Object, provider.Object);
+
+        // Act
+        var result = await handler.Handle(new MicrosoftLogin(new ExternalAuthInfo(), new DefaultHttpContext()));
+
+        // Assert
+        Assert.Equal(ResultStatus.Forbidden, result.Status);
+        Assert.Contains("link Microsoft", result.Message);
+        Assert.Empty(user.OAuthAccounts);
+        users.Verify(repository => repository.SaveAsync(It.IsAny<User>(), It.IsAny<CommandOptionsDescriptor<User>>()), Times.Never);
+        tokens.VerifyNoOtherCalls();
+        oauthTokens.VerifyNoOtherCalls();
+    }
+
+    [Theory]
+    [InlineData("facebook")]
+    [InlineData("windowslive")]
+    public async Task Handle_RemoveLastUsableExternalLogin_ReturnsBadRequest(string retiredProvider)
+    {
+        // Arrange
+        var user = GetService<UserData>().GenerateUser(id: TestConstants.UserId, emailAddress: TestConstants.UserEmail);
+        user.Password = null;
+        user.AddOAuthAccount("google", "google-user", user.EmailAddress);
+        user.AddOAuthAccount(retiredProvider, "retired-user", user.EmailAddress);
+        var context = new DefaultHttpContext();
+        context.Request.SetUser(user);
+        var users = new Mock<IUserRepository>(MockBehavior.Strict);
+        var tokens = new Mock<ITokenRepository>(MockBehavior.Strict);
+        var oauthTokens = new Mock<IOAuthTokenRepository>(MockBehavior.Strict);
+        var handler = CreateHandler(users.Object, tokens.Object, oauthTokens.Object, GetService<IOAuthProviderClient>());
+
+        // Act
+        var result = await handler.Handle(new RemoveExternalLogin("google", new ValueFromBody<string>("google-user"), context));
+
+        // Assert
+        Assert.Equal(ResultStatus.BadRequest, result.Status);
+        Assert.Equal(2, user.OAuthAccounts.Count);
+        users.VerifyNoOtherCalls();
+        tokens.VerifyNoOtherCalls();
+        oauthTokens.VerifyNoOtherCalls();
+    }
+
     [Fact]
     public async Task Handle_MicrosoftProviderFails_DoesNotAccessUserRepository()
     {
diff --git a/tests/Exceptionless.Tests/Extensions/UserExtensionsTests.cs b/tests/Exceptionless.Tests/Extensions/UserExtensionsTests.cs
new file mode 100644
index 0000000000..9ab481f500
--- /dev/null
+++ b/tests/Exceptionless.Tests/Extensions/UserExtensionsTests.cs
@@ -0,0 +1,95 @@
+using Exceptionless.Core.Extensions;
+using Exceptionless.Core.Models;
+using Foundatio.Xunit;
+using Xunit;
+
+namespace Exceptionless.Tests.Extensions;
+
+public sealed class UserExtensionsTests(ITestOutputHelper output) : TestWithLoggingBase(output)
+{
+    [Theory]
+    [InlineData("facebook")]
+    [InlineData("Facebook")]
+    [InlineData("windowslive")]
+    [InlineData("WindowsLive")]
+    public void RemoveOAuthAccount_OnlyRetiredProviderWouldRemain_PreservesActiveLogin(string retiredProvider)
+    {
+        // Arrange
+        var user = new User();
+        user.AddOAuthAccount("google", "active-user", "user@example.com");
+        user.OAuthAccounts.Add(new OAuthAccount { Provider = retiredProvider, ProviderUserId = "retired-user", Username = "user@example.com" });
+
+        // Act
+        bool removed = user.RemoveOAuthAccount("google", "active-user");
+
+        // Assert
+        Assert.False(removed);
+        Assert.Equal(2, user.OAuthAccounts.Count);
+        Assert.Contains(user.OAuthAccounts, account => account.ProviderUserId == "active-user");
+    }
+
+    [Theory]
+    [InlineData("facebook")]
+    [InlineData("windowslive")]
+    public void RemoveOAuthAccount_OnlyRetiredLogin_RemovesAccount(string provider)
+    {
+        // Arrange
+        var user = new User();
+        user.AddOAuthAccount(provider, "retired-user", "user@example.com");
+
+        // Act
+        bool removed = user.RemoveOAuthAccount(provider, "retired-user");
+
+        // Assert
+        Assert.True(removed);
+        Assert.Empty(user.OAuthAccounts);
+    }
+
+    [Theory]
+    [InlineData(null, false, 1)]
+    [InlineData("password-hash", true, 0)]
+    public void RemoveOAuthAccount_LastActiveLogin_RequiresPassword(string? password, bool expectedRemoved, int expectedRemainingAccounts)
+    {
+        // Arrange
+        var user = new User { Password = password };
+        user.AddOAuthAccount("microsoft", "active-user", "user@example.com");
+
+        // Act
+        bool removed = user.RemoveOAuthAccount("microsoft", "active-user");
+
+        // Assert
+        Assert.Equal(expectedRemoved, removed);
+        Assert.Equal(expectedRemainingAccounts, user.OAuthAccounts.Count);
+    }
+
+    [Fact]
+    public void RemoveOAuthAccount_AnotherActiveLoginRemains_RemovesAccount()
+    {
+        // Arrange
+        var user = new User();
+        user.AddOAuthAccount("google", "google-user", "user@example.com");
+        user.AddOAuthAccount("microsoft", "microsoft-user", "user@example.com");
+
+        // Act
+        bool removed = user.RemoveOAuthAccount("google", "google-user");
+
+        // Assert
+        Assert.True(removed);
+        Assert.Equal("microsoft", Assert.Single(user.OAuthAccounts).Provider);
+    }
+
+    [Fact]
+    public void RemoveOAuthAccount_AccountDoesNotExist_PreservesLogin()
+    {
+        // Arrange
+        var user = new User();
+        user.AddOAuthAccount("google", "active-user", "user@example.com");
+
+        // Act
+        bool removed = user.RemoveOAuthAccount("google", "missing-user");
+
+        // Assert
+        Assert.True(removed);
+        Assert.Equal("active-user", Assert.Single(user.OAuthAccounts).ProviderUserId);
+    }
+}

From 2cb9d20f19cbb0d06d89a2cc18e8c17eb662be32 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 08:59:07 -0500
Subject: [PATCH 11/12] Keep Microsoft authentication changes focused and
 simplify unlinking

---
 .../Extensions/UserExtensions.cs              | 16 +++---
 .../Api/Endpoints/AuthEndpoints.cs            |  2 +-
 .../Api/Handlers/AuthHandler.cs               | 31 +++---------
 .../Api/Handlers/UserHandler.cs               |  5 +-
 .../src/lib/features/auth/microsoft.test.ts   |  7 +--
 .../account/external-logins/+page.svelte      | 11 ++--
 .../Exceptionless.Tests/Api/Data/openapi.json |  2 +-
 .../Endpoints/MicrosoftAuthEndpointTests.cs   | 50 ++++---------------
 .../Api/Endpoints/UserEndpointTests.cs        | 16 +++---
 .../Api/Handlers/AuthHandlerTests.cs          | 33 ------------
 .../Mail/CountingMailer.cs                    |  4 --
 11 files changed, 40 insertions(+), 137 deletions(-)

diff --git a/src/Exceptionless.Core/Extensions/UserExtensions.cs b/src/Exceptionless.Core/Extensions/UserExtensions.cs
index cf8b86c724..c811e3be5b 100644
--- a/src/Exceptionless.Core/Extensions/UserExtensions.cs
+++ b/src/Exceptionless.Core/Extensions/UserExtensions.cs
@@ -79,17 +79,17 @@ public static void AddOAuthAccount(this User user, string providerName, string p
 
     public static bool RemoveOAuthAccount(this User user, string providerName, string providerUserId)
     {
-        var account = user.OAuthAccounts.FirstOrDefault(o => String.Equals(o.Provider, providerName, StringComparison.OrdinalIgnoreCase) && o.ProviderUserId == providerUserId);
+        var account = user.OAuthAccounts.FirstOrDefault(o =>
+            String.Equals(o.Provider, providerName, StringComparison.OrdinalIgnoreCase)
+            && String.Equals(o.ProviderUserId, providerUserId, StringComparison.Ordinal));
         if (account is null)
             return true;
 
-        // Retired provider records cannot keep a passwordless account accessible.
-        if (String.IsNullOrEmpty(user.Password)
-            && !String.Equals(account.Provider, "facebook", StringComparison.OrdinalIgnoreCase)
-            && !String.Equals(account.Provider, "windowslive", StringComparison.OrdinalIgnoreCase)
-            && !user.OAuthAccounts.Any(other => other != account
-                && !String.Equals(other.Provider, "facebook", StringComparison.OrdinalIgnoreCase)
-                && !String.Equals(other.Provider, "windowslive", StringComparison.OrdinalIgnoreCase)))
+        var activeOAuthAccounts = user.OAuthAccounts
+            .Where(o => !String.Equals(o.Provider, "facebook", StringComparison.OrdinalIgnoreCase)
+                && !String.Equals(o.Provider, "windowslive", StringComparison.OrdinalIgnoreCase))
+            .ToArray();
+        if (String.IsNullOrEmpty(user.Password) && activeOAuthAccounts.Length <= 1 && activeOAuthAccounts.Contains(account))
             return false;
 
         return user.OAuthAccounts.Remove(account);
diff --git a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
index 1de150d69f..a9db9da0cc 100644
--- a/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
+++ b/src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs
@@ -146,7 +146,7 @@ headers api_key input box.
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
-                ["403"] = "Account creation is disabled or Microsoft must be linked from an existing account",
+                ["403"] = "Account Creation is currently disabled",
                 ["422"] = "Validation error",
             }
         });
diff --git a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
index 02da9c74d3..afbc11b311 100644
--- a/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/AuthHandler.cs
@@ -510,15 +510,9 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         }
 
         User? user;
-        bool isNewUser;
         try
         {
-            var result = await FromExternalLoginAsync(userInfo, authInfo.InviteToken, httpContext);
-            if (!result.IsSuccess)
-                return Result<TokenResult>.FromResult(result);
-
-            user = result.Value;
-            isNewUser = result.Status == ResultStatus.Created;
+            user = await FromExternalLoginAsync(userInfo, authInfo.InviteToken, httpContext);
         }
         catch (ApplicationException ex)
         {
@@ -534,20 +528,16 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         if (!String.IsNullOrWhiteSpace(authInfo.InviteToken))
             await AddInvitedUserToOrganizationAsync(authInfo.InviteToken, user, httpContext);
 
-        if (isNewUser && !user.IsEmailAddressVerified)
-            await mailer.SendUserEmailVerifyAsync(user);
-
         logger.UserLoggedIn(user.EmailAddress);
         return new TokenResult { Token = await GetOrCreateAuthenticationTokenAsync(user) };
     }
 
-    private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, string? inviteToken, HttpContext httpContext)
+    private async Task<User> FromExternalLoginAsync(UserInfo userInfo, string? inviteToken, HttpContext httpContext)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Id);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.ProviderName);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Email);
 
-        bool isMicrosoft = String.Equals(userInfo.ProviderName, MicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase);
         var existingUser = await userRepository.GetUserByOAuthProviderAsync(userInfo.ProviderName, userInfo.Id);
         using var _ = logger.BeginScope(new ExceptionlessState().Tag("External Login").Tag(userInfo.ProviderName).Identity(userInfo.Email).SetHttpContext(httpContext));
 
@@ -582,7 +572,7 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
         if (existingUser is not null)
         {
             bool hasChanges = RemoveLegacyMicrosoftOAuthAccounts(existingUser, userInfo.ProviderName);
-            if (!isMicrosoft && !existingUser.IsEmailAddressVerified)
+            if (!existingUser.IsEmailAddressVerified)
             {
                 existingUser.MarkEmailAddressVerified();
                 hasChanges = true;
@@ -595,9 +585,6 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
         }
 
         var user = !String.IsNullOrEmpty(userInfo.Email) ? await userRepository.GetByEmailAddressAsync(userInfo.Email) : null;
-        // Microsoft Graph mail is editable and does not establish ownership of an existing account.
-        if (isMicrosoft && user is not null)
-            return Result.Forbidden("Sign in to your existing account first, then link Microsoft from your account settings.");
 
         if (user is null)
         {
@@ -610,17 +597,15 @@ private async Task<Result<User>> FromExternalLoginAsync(UserInfo userInfo, strin
             await AddGlobalAdminRoleIfFirstUserAsync(user);
         }
 
-        if (isMicrosoft)
-            user.ResetVerifyEmailAddressTokenAndExpiration(timeProvider);
-        else
-            user.MarkEmailAddressVerified();
-
+        user.MarkEmailAddressVerified();
         user.AddOAuthAccount(userInfo.ProviderName, userInfo.Id, userInfo.Email);
 
         if (String.IsNullOrEmpty(user.Id))
-            return Result.Created(await userRepository.AddAsync(user, o => o.Cache()));
+            await userRepository.AddAsync(user, o => o.Cache());
+        else
+            await userRepository.SaveAsync(user, o => o.Cache());
 
-        return await userRepository.SaveAsync(user, o => o.Cache());
+        return user;
     }
 
     private static bool RemoveLegacyMicrosoftOAuthAccounts(User user, string providerName)
diff --git a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
index 329f96ecd5..9a8a6e9787 100644
--- a/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
+++ b/src/Exceptionless.Web/Api/Handlers/UserHandler.cs
@@ -284,10 +284,7 @@ public async Task<Result<UpdateEmailAddressResult>> Handle(UpdateEmailAddress me
 
         user.ResetPasswordResetToken();
         user.EmailAddress = email;
-        // Microsoft Graph profile email does not establish mailbox ownership.
-        user.IsEmailAddressVerified = user.OAuthAccounts.Any(oa =>
-            !String.Equals(oa.Provider, "Microsoft", StringComparison.OrdinalIgnoreCase)
-            && String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
+        user.IsEmailAddressVerified = user.OAuthAccounts.Any(oa => String.Equals(oa.EmailAddress(), email, StringComparison.InvariantCultureIgnoreCase));
         if (user.IsEmailAddressVerified)
             user.MarkEmailAddressVerified();
         else
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
index a3c4fcba29..59fd715c6d 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/auth/microsoft.test.ts
@@ -80,10 +80,7 @@ describe('microsoftLogin', () => {
     });
 
     it.each([
-        [
-            { status: 403, title: 'Sign in to your existing account first, then link Microsoft from your account settings.' },
-            'Sign in to your existing account first, then link Microsoft from your account settings.'
-        ],
+        [{ status: 403, title: 'Account Creation is currently disabled' }, 'Account Creation is currently disabled'],
         [undefined, 'Unable to sign in. Please try again.']
     ])('displays an unsuccessful exchange without changing the session', async (problem, message) => {
         vi.stubGlobal('crypto', { randomUUID: () => 'expected-state' });
@@ -101,7 +98,7 @@ describe('microsoftLogin', () => {
     });
 
     it('displays the 403 with the application error callback enabled', async () => {
-        const message = 'Sign in to your existing account first, then link Microsoft from your account settings.';
+        const message = 'Account Creation is currently disabled';
         const client = new FetchClient({
             baseUrl: 'http://localhost/api/v2',
             defaultRequestOptions: {
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
index cc0a08c115..8f0123fda4 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(app)/account/external-logins/+page.svelte
@@ -41,11 +41,7 @@
 
     const oauthAccounts = $derived(meQuery.data?.o_auth_accounts ?? []);
     const hasLocalAccount = $derived(meQuery.data?.has_local_account ?? false);
-    const activeOAuthAccountCount = $derived(oauthAccounts.filter((account) => !['facebook', 'windowslive'].includes(account.provider.toLowerCase())).length);
-
-    function canUnlinkAccount(provider: string) {
-        return hasLocalAccount || ['facebook', 'windowslive'].includes(provider.toLowerCase()) || activeOAuthAccountCount > 1;
-    }
+    const activeOAuthAccounts = $derived(oauthAccounts.filter((account) => !['facebook', 'windowslive'].includes(account.provider.toLowerCase())));
 </script>
 
 <div class="space-y-6">
@@ -88,15 +84,16 @@
                     </Table.Header>
                     <Table.Body>
                         {#each oauthAccounts as account (account.provider_user_id)}
+                            {@const canUnlinkAccount = hasLocalAccount || activeOAuthAccounts.length > 1 || !activeOAuthAccounts.includes(account)}
                             <Table.Row>
                                 <Table.Cell class="capitalize">{account.provider} ({account.username || account.provider_user_id})</Table.Cell>
                                 <Table.Cell class="text-right">
                                     <Button
                                         aria-label="Remove {account.provider} account"
-                                        disabled={!canUnlinkAccount(account.provider)}
+                                        disabled={!canUnlinkAccount}
                                         onclick={() => handleUnlinkAccount(account.provider, account.provider_user_id)}
                                         size="icon"
-                                        title={canUnlinkAccount(account.provider) ? 'Remove' : 'Cannot remove the only login method'}
+                                        title={canUnlinkAccount ? 'Remove' : 'Cannot remove the only login method'}
                                         variant="ghost"
                                     >
                                         <X class="size-4" />
diff --git a/tests/Exceptionless.Tests/Api/Data/openapi.json b/tests/Exceptionless.Tests/Api/Data/openapi.json
index 3d8489b2bb..88be9cf072 100644
--- a/tests/Exceptionless.Tests/Api/Data/openapi.json
+++ b/tests/Exceptionless.Tests/Api/Data/openapi.json
@@ -1874,7 +1874,7 @@
             }
           },
           "403": {
-            "description": "Account creation is disabled or Microsoft must be linked from an existing account",
+            "description": "Account Creation is currently disabled",
             "content": {
               "application/problem\u002Bjson": {
                 "schema": {
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
index 5a5cdcced7..2e5a025912 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/MicrosoftAuthEndpointTests.cs
@@ -1,19 +1,15 @@
 using Exceptionless.Core.Authorization;
 using Exceptionless.Core.Configuration;
 using Exceptionless.Core.Extensions;
-using Exceptionless.Core.Mail;
 using Exceptionless.Core.Models;
 using Exceptionless.Core.Repositories;
 using Exceptionless.Core.Utility;
 using Exceptionless.Tests.Extensions;
-using Exceptionless.Tests.Mail;
 using Exceptionless.Tests.Utility;
 using Exceptionless.Web.Models;
 using FluentRest;
 using Foundatio.Repositories;
-using Microsoft.Extensions.DependencyInjection;
 using Xunit;
-using ProblemDetails = Microsoft.AspNetCore.Mvc.ProblemDetails;
 
 namespace Exceptionless.Tests.Api.Endpoints;
 
@@ -25,7 +21,6 @@ public sealed class MicrosoftAuthEndpointTests : IntegrationTestsBase
     private readonly string? _originalMicrosoftSecret;
     private readonly IUserRepository _userRepository;
     private readonly IOrganizationRepository _organizationRepository;
-    private readonly CountingMailer _mailer;
 
     public MicrosoftAuthEndpointTests(ITestOutputHelper output, AppWebHostFactory factory) : base(output, factory)
     {
@@ -35,14 +30,6 @@ public MicrosoftAuthEndpointTests(ITestOutputHelper output, AppWebHostFactory fa
         _originalMicrosoftSecret = _authOptions.MicrosoftSecret;
         _userRepository = GetService<IUserRepository>();
         _organizationRepository = GetService<IOrganizationRepository>();
-        _mailer = GetService<CountingMailer>();
-    }
-
-    protected override void RegisterServices(IServiceCollection services)
-    {
-        base.RegisterServices(services);
-        services.AddSingleton<CountingMailer>();
-        services.ReplaceSingleton<IMailer>(provider => provider.GetRequiredService<CountingMailer>());
     }
 
     protected override async Task ResetDataAsync()
@@ -52,7 +39,6 @@ protected override async Task ResetDataAsync()
         _authOptions.MicrosoftId = "microsoft-client-id";
         _authOptions.MicrosoftSecret = "microsoft-client-secret";
         await GetService<SampleDataService>().CreateDataAsync();
-        _mailer.Reset();
     }
 
     [Fact]
@@ -80,13 +66,12 @@ public async Task MicrosoftAsync_AuthenticatedLinkWithDifferentEmail_ReplacesLeg
     }
 
     [Fact]
-    public async Task MicrosoftAsync_ExistingModernIdentity_PreservesEmailVerification()
+    public async Task MicrosoftAsync_ExistingModernIdentity_MarksEmailVerified()
     {
         // Arrange
         const string code = "existing-microsoft-user";
         var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
         user.ResetVerifyEmailAddressTokenAndExpiration(TimeProvider);
-        string? verificationToken = user.VerifyEmailAddressToken;
         user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
         user.AddOAuthAccount("Microsoft", code, user.EmailAddress);
         await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
@@ -100,41 +85,32 @@ public async Task MicrosoftAsync_ExistingModernIdentity_PreservesEmailVerificati
         var account = Assert.Single(updatedUser.OAuthAccounts);
         Assert.Equal("microsoft", account.Provider);
         Assert.Equal(code, account.ProviderUserId);
-        Assert.False(updatedUser.IsEmailAddressVerified);
-        Assert.Equal(verificationToken, updatedUser.VerifyEmailAddressToken);
-        Assert.Equal(0, _mailer.UserEmailVerificationCount);
+        Assert.True(updatedUser.IsEmailAddressVerified);
+        Assert.Null(updatedUser.VerifyEmailAddressToken);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_ExactEmailMatch_RequiresAuthenticatedLink()
+    public async Task MicrosoftAsync_ExactEmailMatch_SignsIntoExistingUser()
     {
         // Arrange
         const string code = "matching-email-user";
         var user = CreateUser(TestOAuthProviderClient.GetEmailAddress(code));
-        user.AddOAuthAccount("WindowsLive", "legacy-user", user.EmailAddress);
         await _userRepository.AddAsync(user, o => o.ImmediateConsistency());
 
         // Act
-        var problem = await SendRequestAsAsync<ProblemDetails>(request => request
-            .Post()
-            .AppendPaths("auth", "microsoft")
-            .Content(new ExternalAuthInfo { ClientId = "microsoft-client-id", Code = code, RedirectUri = "http://localhost" })
-            .StatusCodeShouldBeForbidden());
+        await SendMicrosoftLoginAsync(code);
 
         // Assert
         var updatedUser = await _userRepository.GetByEmailAddressAsync(user.EmailAddress);
         Assert.NotNull(updatedUser);
         Assert.Equal(user.Id, updatedUser.Id);
         var account = Assert.Single(updatedUser.OAuthAccounts);
-        Assert.Equal("windowslive", account.Provider);
-        Assert.Equal("legacy-user", account.ProviderUserId);
-        Assert.NotNull(problem);
-        Assert.Contains("link Microsoft", problem.Title);
-        Assert.Equal(0, _mailer.UserEmailVerificationCount);
+        Assert.Equal("microsoft", account.Provider);
+        Assert.Equal(code, account.ProviderUserId);
     }
 
     [Fact]
-    public async Task MicrosoftAsync_UnmatchedEmail_CreatesUnverifiedUserAndSendsOneVerification()
+    public async Task MicrosoftAsync_UnmatchedEmail_CreatesUser()
     {
         // Arrange
         const string code = "new-microsoft-user";
@@ -142,19 +118,14 @@ public async Task MicrosoftAsync_UnmatchedEmail_CreatesUnverifiedUserAndSendsOne
 
         // Act
         await SendMicrosoftLoginAsync(code);
-        await RefreshDataAsync();
-        await SendMicrosoftLoginAsync(code);
 
         // Assert
         var microsoftUser = await _userRepository.GetByEmailAddressAsync(emailAddress);
         Assert.NotNull(microsoftUser);
-        Assert.False(microsoftUser.IsEmailAddressVerified);
-        Assert.NotNull(microsoftUser.VerifyEmailAddressToken);
-        Assert.True(microsoftUser.HasValidVerifyEmailAddressTokenExpiration(TimeProvider));
+        Assert.True(microsoftUser.IsEmailAddressVerified);
         var account = Assert.Single(microsoftUser.OAuthAccounts);
         Assert.Equal("microsoft", account.Provider);
         Assert.Equal(code, account.ProviderUserId);
-        Assert.Equal(1, _mailer.UserEmailVerificationCount);
     }
 
     [Fact]
@@ -162,7 +133,6 @@ public async Task MicrosoftAsync_MatchingInvitation_CreatesUserAndJoinsOrganizat
     {
         // Arrange
         const string code = "invited-microsoft-user";
-        _authOptions.EnableAccountCreation = false;
         string emailAddress = TestOAuthProviderClient.GetEmailAddress(code);
         var organization = (await _organizationRepository.GetAllAsync()).Documents.First();
         var invite = new Invite {
@@ -184,8 +154,6 @@ public async Task MicrosoftAsync_MatchingInvitation_CreatesUserAndJoinsOrganizat
         var updatedOrganization = await _organizationRepository.GetByIdAsync(organization.Id);
         Assert.NotNull(updatedOrganization);
         Assert.DoesNotContain(updatedOrganization.Invites, existing => existing.Token == invite.Token);
-        Assert.Null(user.VerifyEmailAddressToken);
-        Assert.Equal(0, _mailer.UserEmailVerificationCount);
     }
 
     [Fact]
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
index ba096c03a1..652a31d69c 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
@@ -1057,33 +1057,29 @@ public async Task UpdateEmailAddressAsync_ValidEmail_ReturnsResult()
     }
 
     [Theory]
-    [InlineData("Microsoft", false)]
-    [InlineData("Google", true)]
-    public async Task UpdateEmailAddressAsync_LinkedProviderEmail_RequiresProofForMicrosoft(string provider, bool isVerified)
+    [InlineData("Microsoft")]
+    [InlineData("Google")]
+    public async Task UpdateEmailAddressAsync_LinkedProviderEmail_MarksAddressVerified(string provider)
     {
-        // Arrange
         const string email = "linked-provider@exceptionless.test";
         var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
         Assert.NotNull(user);
         user.AddOAuthAccount(provider, "provider-user", email);
         await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
 
-        // Act
         var result = await SendRequestAsAsync<UpdateEmailAddressResult>(r => r
             .Post()
             .AsTestOrganizationUser()
             .AppendPaths("users", user.Id, "email-address", email)
             .StatusCodeShouldBeOk());
 
-        // Assert
         Assert.NotNull(result);
-        Assert.Equal(isVerified, result.IsVerified);
+        Assert.True(result.IsVerified);
         var updatedUser = await _userRepository.GetByIdAsync(user.Id);
         Assert.NotNull(updatedUser);
         Assert.Equal(email, updatedUser.EmailAddress);
-        Assert.Equal(isVerified, updatedUser.IsEmailAddressVerified);
-        Assert.Equal(isVerified, String.IsNullOrEmpty(updatedUser.VerifyEmailAddressToken));
-        Assert.Equal(!isVerified, updatedUser.HasValidVerifyEmailAddressTokenExpiration(TimeProvider));
+        Assert.True(updatedUser.IsEmailAddressVerified);
+        Assert.Null(updatedUser.VerifyEmailAddressToken);
     }
 
     [Fact]
diff --git a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
index 6a4e530c3c..eac6a0f929 100644
--- a/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
+++ b/tests/Exceptionless.Tests/Api/Handlers/AuthHandlerTests.cs
@@ -128,39 +128,6 @@ public async Task Handle_LoginRepositoryException_ReturnsUnauthorizedResult(Exce
         new OperationCanceledException("Repository operation was canceled.")
     };
 
-    [Fact]
-    public async Task Handle_MicrosoftEmailCollision_DoesNotAttachIdentityOrIssueToken()
-    {
-        // Arrange
-        const string providerUserId = "unlinked-microsoft-user";
-        var user = GetService<UserData>().GenerateUser(id: TestConstants.UserId, emailAddress: TestConstants.UserEmail);
-        user.MarkEmailAddressVerified();
-        var users = new Mock<IUserRepository>(MockBehavior.Strict);
-        users.Setup(repository => repository.GetUserByOAuthProviderAsync("Microsoft", providerUserId)).ReturnsAsync((User?)null);
-        users.Setup(repository => repository.GetByEmailAddressAsync(user.EmailAddress)).ReturnsAsync(user);
-        users.Setup(repository => repository.SaveAsync(user, It.IsAny<CommandOptionsDescriptor<User>>())).ReturnsAsync(user);
-        var tokens = new Mock<ITokenRepository>(MockBehavior.Strict);
-        tokens.Setup(repository => repository.GetByTypeAndUserIdAsync(TokenType.Authentication, user.Id, null)).ReturnsAsync(FindResults<Token>.Empty);
-        tokens.Setup(repository => repository.AddAsync(It.IsAny<Token>(), It.IsAny<CommandOptionsDescriptor<Token>>()))
-            .ReturnsAsync((Token token, CommandOptionsDescriptor<Token> _) => token);
-        var oauthTokens = new Mock<IOAuthTokenRepository>(MockBehavior.Strict);
-        var provider = new Mock<IOAuthProviderClient>(MockBehavior.Strict);
-        provider.Setup(client => client.GetMicrosoftUserInfoAsync(It.IsAny<ExternalAuthInfo>(), "microsoft-client-id", "microsoft-client-secret"))
-            .ReturnsAsync(new OAuth2.Models.UserInfo { ProviderName = "Microsoft", Id = providerUserId, Email = user.EmailAddress });
-        var handler = CreateHandler(users.Object, tokens.Object, oauthTokens.Object, provider.Object);
-
-        // Act
-        var result = await handler.Handle(new MicrosoftLogin(new ExternalAuthInfo(), new DefaultHttpContext()));
-
-        // Assert
-        Assert.Equal(ResultStatus.Forbidden, result.Status);
-        Assert.Contains("link Microsoft", result.Message);
-        Assert.Empty(user.OAuthAccounts);
-        users.Verify(repository => repository.SaveAsync(It.IsAny<User>(), It.IsAny<CommandOptionsDescriptor<User>>()), Times.Never);
-        tokens.VerifyNoOtherCalls();
-        oauthTokens.VerifyNoOtherCalls();
-    }
-
     [Theory]
     [InlineData("facebook")]
     [InlineData("windowslive")]
diff --git a/tests/Exceptionless.Tests/Mail/CountingMailer.cs b/tests/Exceptionless.Tests/Mail/CountingMailer.cs
index 9e2862ad1e..2967a84886 100644
--- a/tests/Exceptionless.Tests/Mail/CountingMailer.cs
+++ b/tests/Exceptionless.Tests/Mail/CountingMailer.cs
@@ -6,10 +6,8 @@ namespace Exceptionless.Tests.Mail;
 public class CountingMailer : IMailer
 {
     private int _organizationNoticeCount;
-    private int _userEmailVerificationCount;
 
     public int OrganizationNoticeCount => _organizationNoticeCount;
-    public int UserEmailVerificationCount => _userEmailVerificationCount;
 
     public List<OrganizationNoticeCall> OrganizationNoticeCalls { get; } = [];
 
@@ -64,7 +62,6 @@ public Task SendProjectDailySummaryAsync(User user, Project project, IEnumerable
 
     public Task SendUserEmailVerifyAsync(User user)
     {
-        Interlocked.Increment(ref _userEmailVerificationCount);
         return Task.CompletedTask;
     }
 
@@ -76,7 +73,6 @@ public Task SendUserPasswordResetAsync(User user)
     public void Reset()
     {
         Interlocked.Exchange(ref _organizationNoticeCount, 0);
-        Interlocked.Exchange(ref _userEmailVerificationCount, 0);
         lock (OrganizationNoticeCalls)
         {
             OrganizationNoticeCalls.Clear();

From 35a95995dd75d1a9c75ef4a6e1742bc23cff19ad Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Thu, 22 Oct 2026 10:49:25 -0500
Subject: [PATCH 12/12] Add Arrange Act Assert comments to linked provider
 email test

---
 tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
index 652a31d69c..890328f40f 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/UserEndpointTests.cs
@@ -1061,18 +1061,21 @@ public async Task UpdateEmailAddressAsync_ValidEmail_ReturnsResult()
     [InlineData("Google")]
     public async Task UpdateEmailAddressAsync_LinkedProviderEmail_MarksAddressVerified(string provider)
     {
+        // Arrange
         const string email = "linked-provider@exceptionless.test";
         var user = await _userRepository.GetByEmailAddressAsync(SampleDataService.TEST_ORG_USER_EMAIL);
         Assert.NotNull(user);
         user.AddOAuthAccount(provider, "provider-user", email);
         await _userRepository.SaveAsync(user, o => o.ImmediateConsistency().Cache());
 
+        // Act
         var result = await SendRequestAsAsync<UpdateEmailAddressResult>(r => r
             .Post()
             .AsTestOrganizationUser()
             .AppendPaths("users", user.Id, "email-address", email)
             .StatusCodeShouldBeOk());
 
+        // Assert
         Assert.NotNull(result);
         Assert.True(result.IsVerified);
         var updatedUser = await _userRepository.GetByIdAsync(user.Id);