Skip to content

Commit 73d7aa0

Browse files
rolling-coderolling-code
authored
Add files via upload
1 parent ad453ae commit 73d7aa0

2 files changed

Lines changed: 72 additions & 0 deletions

File tree

‎docs/oauth-training-multitenant.html‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<!doctype html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="utf-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<meta name="referrer" content="no-referrer">
7+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'">
8+
<title>Multi-tenant OAuth consent training</title>
9+
<style>
10+
:root{color-scheme:dark;--bg:#0f172a;--panel:#1e293b;--accent:#38bdf8;--warn:#fbbf24;--text:#f8fafc;--muted:#cbd5e1}
11+
*{box-sizing:border-box} body{margin:0;background:var(--bg);color:var(--text);font:17px/1.6 "Segoe UI",Arial,sans-serif}
12+
header{padding:1.25rem;text-align:center;background:var(--panel);color:var(--accent);font-weight:700;font-size:1.25rem}
13+
main{max-width:760px;margin:3rem auto;padding:2rem;background:var(--panel);border-radius:12px;box-shadow:0 8px 24px #0008}
14+
h1,h2{color:var(--accent)} .notice{padding:1rem;border-left:5px solid var(--warn);background:#422006;color:#fef3c7;border-radius:6px}
15+
footer{text-align:center;color:var(--muted);padding:1rem} li{margin:.45rem 0}
16+
</style>
17+
</head>
18+
<body>
19+
<header>OAuth consent security awareness training</header>
20+
<main>
21+
<h1>Multi-tenant application scenario</h1>
22+
<p class="notice"><strong>Controlled training page.</strong> This page does not collect credentials, authorization codes, tokens, query strings, analytics, or personal data.</p>
23+
<p>You reached a training page after reviewing a consent request from an application configured for users in multiple organizations.</p>
24+
<h2>What this demonstrates</h2>
25+
<ul>
26+
<li>An application can be registered in one tenant and presented to users in another tenant.</li>
27+
<li>The Microsoft-hosted sign-in and consent interface is genuine, while the requesting application remains independently controlled.</li>
28+
<li>Publisher identity, tenant context, and requested permissions must all be reviewed.</li>
29+
<li>Unexpected requests should be cancelled even when the sign-in domain is legitimate.</li>
30+
</ul>
31+
<h2>Safe response</h2>
32+
<p>Approve only recognized applications whose publisher and requested access align with an authorized business purpose.</p>
33+
</main>
34+
<footer>Controlled OAuth awareness demonstration</footer>
35+
</body>
36+
</html>

‎docs/oauth-training-success.html‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<!doctype html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="utf-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<meta name="referrer" content="no-referrer">
7+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'">
8+
<title>Organization-only OAuth consent training</title>
9+
<style>
10+
:root{color-scheme:dark;--bg:#0f172a;--panel:#1e293b;--accent:#38bdf8;--warn:#fbbf24;--text:#f8fafc;--muted:#cbd5e1}
11+
*{box-sizing:border-box} body{margin:0;background:var(--bg);color:var(--text);font:17px/1.6 "Segoe UI",Arial,sans-serif}
12+
header{padding:1.25rem;text-align:center;background:var(--panel);color:var(--accent);font-weight:700;font-size:1.25rem}
13+
main{max-width:760px;margin:3rem auto;padding:2rem;background:var(--panel);border-radius:12px;box-shadow:0 8px 24px #0008}
14+
h1,h2{color:var(--accent)} .notice{padding:1rem;border-left:5px solid var(--warn);background:#422006;color:#fef3c7;border-radius:6px}
15+
footer{text-align:center;color:var(--muted);padding:1rem} li{margin:.45rem 0}
16+
</style>
17+
</head>
18+
<body>
19+
<header>OAuth consent security awareness training</header>
20+
<main>
21+
<h1>Organization-only application scenario</h1>
22+
<p class="notice"><strong>Controlled training page.</strong> This page does not collect credentials, authorization codes, tokens, query strings, analytics, or personal data.</p>
23+
<p>You reached a training page after reviewing a consent request from an application registered in the same organization.</p>
24+
<h2>What to verify before accepting</h2>
25+
<ul>
26+
<li>The application name and publisher match the task you intended to perform.</li>
27+
<li>The requested permissions are necessary and proportionate.</li>
28+
<li>The application is approved by your organization.</li>
29+
<li>A genuine Microsoft sign-in page does not by itself prove that the requesting application is trustworthy.</li>
30+
</ul>
31+
<h2>Safe response</h2>
32+
<p>If the application, publisher, or requested access is unexpected, cancel the request and report it through your organization’s security process.</p>
33+
</main>
34+
<footer>Controlled OAuth awareness demonstration</footer>
35+
</body>
36+
</html>

0 commit comments

Comments
 (0)