MS Account Picker

Signed in to Microsoft with the wrong account, without ever being asked? On a managed Windows device the browser can carry your Windows identity into every browser profile. Open a Microsoft site and it signs you in with that account — no prompt, no choice. If you hold a second Microsoft account, that is the account you did not want. MS Account Picker gives the choice back. It adds a single query parameter to Microsoft's sign-in request, so that you either get the account chooser or land directly on the account you configured. WHAT IT DOES • Account picker — always shows the account chooser, so you pick each time. Sends no identity anywhere. • Direct sign-in — goes straight to the account you entered. • Per site — a site you use with more than one account can keep the picker while everything else goes direct, or the other way round. • Only the sites you list — for a deliberately narrow setup: nothing changes anywhere except on the sites you name yourself. • Off per profile — it does nothing at all until you switch it on in this browser profile. Install it everywhere, arm it where you want it. HOW IT WORKS The extension does not build sign-in URLs and does not read pages. It appends one parameter — prompt=select_account or login_hint — to the authorize request your Microsoft portal already makes. Everything else about that request is left exactly as the portal built it. That single parameter is why it works on any Microsoft portal without a list of sites to maintain, and it is why the extension needs access to exactly one address: login.microsoftonline.com. WHAT IT DOES NOT DO • No telemetry, no analytics, no error reporting. Nothing leaves your browser. • No account, no sign-up, no server. • No remote code and no third-party libraries — the extension has zero dependencies. • No access to the Microsoft portals themselves, only to the sign-in endpoint. • It never reads the content of any request. The parameter is added by the browser's own declarativeNetRequest engine, which the extension only supplies a rule to. WHAT IT CANNOT DO A site you are already signed in to does not ask again, so no setting can apply to it. The extension includes a sign-out link for that; a few sites hold their own session until the browser is restarted. Sign-in flows that use WS-Federation have no equivalent parameter and are not covered. OPEN SOURCE Source, documentation, security review and threat model: https://github.com/junisconsulting/ms-account-picker Licensed under Apache-2.0. Built by junis.