Microsoft sign in and Entra for HQs and Apps

We're aware Chipp supports Bring‑Your‑Own‑Auth (a custom-hosted login page that transfers a token to Chipp), but that requires us to build and host our own auth layer. What we're asking for is native Microsoft/Entra integration, which we'd break into three levels — ordered from most to least needed:

1. "Sign in with Microsoft" (most needed): A generic Microsoft sign-in option available to users of the HQ and Apps, similar to the existing Google sign-in option — no connection to our specific Entra tenant required, just a standard Microsoft account login option alongside existing sign-in methods.

2. Direct Entra tenant connection for group-based access control and provisioning: Ability to connect our specific Entra tenant to Chipp HQ and individual apps for more granular control — specifically, mapping Entra/AD groups to determine which apps a user can see and access, and potentially using Entra for user provisioning (e.g., SCIM or a similar sync mechanism) so access can be managed centrally from our directory rather than manually inside Chipp. Note: we use an RBAC structure in AD where users are members of role-based security groups, which are then nested inside resource-based security groups (rather than being added to resource groups directly). If group mapping is supported, it would need to account for nested/transitive group membership, not just direct membership, in order to work with our setup.

3. Multi-tenant support (lowest priority): Ability to connect more than one Entra tenant to the same Chipp workspace, since our organization spans multiple tenants. This is something we could work around in the near term if needed.

We see these as three levels of the same overall request, and would value each one, but wanted to be clear about relative priority in case they're not all feasible at once.