Recommended Free Tools
“Microsoft login popup” can describe three different things: a sign-in panel rendered in the page DOM, a new tab or window, or a browser-managed prompt. Selenium Java handles each differently. Configure Chrome with --headless=new, wait for the exact state your application needs, switch windows by handle when a second browsing context appears, and use WebDriver’s prompt controls for browser prompts. None of these techniques bypasses Microsoft Entra requirements such as credentials, MFA, consent, passwordless verification or Conditional Access.
Identify what kind of popup you have
Start by classifying the interruption. The classification determines both the Selenium API and the limit of what automation can accomplish.
DOM sign-in panel or redirect page
A panel inside the page, or a full-page redirect to Microsoft Entra ID, is ordinary web content. Inspect the actual DOM presented by your application and locate its controls. There is no universal Microsoft login selector: markup varies by application, tenant, account type and authentication flow. Use an explicit wait for the state you need rather than a fixed sleep.
New tab or browser window
Some applications open authentication in another browsing context. Save the original window handle before clicking, wait until the handle set grows, switch to the new handle, and then wait for its URL, title or an application-specific element.
#1 Best Overall
Browser-managed prompt
A browser prompt is outside the page DOM. Do not try to find it with By.id or CSS. Configure WebDriver’s prompt behavior or use the prompt interface appropriate to the prompt type. The exact action—accept, dismiss or leave it untouched—depends on the test’s purpose.
Start headless Chrome correctly
Selenium’s Chrome setup uses ChromeOptions and passes those options to ChromeDriver. The modern headless mode is selected with --headless=new. Selenium’s Chrome guidance also says the Chrome and ChromeDriver major versions should match; verify the installed versions in your CI image rather than assuming a local browser version.
import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.chrome.ChromeOptions;
ChromeOptions options = new ChromeOptions();
options.addArguments("--headless=new");
WebDriver driver = new ChromeDriver(options);
try {
driver.get("https://your-application.example/login");
// Test steps go here.
} finally {
driver.quit();
}Headless startup only changes how Chrome is displayed. It does not make an interactive sign-in unattended. Tenant policy, account type, consent, MFA, passwordless verification and device or location conditions still apply.
Wait for the page state, not an arbitrary delay
Page-load completion does not guarantee that a dynamic login panel or post-login state exists. Use WebDriverWait with a condition tied to your application. Avoid mixing implicit and explicit waits; Selenium warns that the combination can produce unpredictable timing.
import java.time.Duration;
import org.openqa.selenium.By;
import org.openqa.selenium.WebDriver;
import org.openqa.selenium.support.ui.ExpectedConditions;
import org.openqa.selenium.support.ui.WebDriverWait;
WebDriverWait wait = new WebDriverWait(driver, Duration.ofSeconds(15));
wait.until(ExpectedConditions.visibilityOfElementLocated(
By.cssSelector("your-app-specific-selector")));
Replace the selector with one discovered in the page under test. Do not publish or depend on an assumed Microsoft-wide selector. Other useful conditions include a URL containing your callback path, a title change, invisibility of a loading element, or visibility of a post-authentication control.
Handle a login opened in a new tab or window
Window handles are opaque identifiers. Capture the original set before the action, wait for a new handle, switch to it, and wait for the state you intend to verify.
import java.time.Duration;
import java.util.Set;
import org.openqa.selenium.By;
import org.openqa.selenium.support.ui.ExpectedConditions;
import org.openqa.selenium.support.ui.WebDriverWait;
String original = driver.getWindowHandle();
Set<String> before = driver.getWindowHandles();
driver.findElement(By.cssSelector("your-app-login-trigger")).click();
WebDriverWait wait = new WebDriverWait(driver, Duration.ofSeconds(15));
wait.until(d -> d.getWindowHandles().size() > before.size());
String loginWindow = driver.getWindowHandles().stream()
.filter(handle -> !handle.equals(original))
.findFirst()
.orElseThrow(() -> new IllegalStateException("No login window appeared"));
driver.switchTo().window(loginWindow);
wait.until(ExpectedConditions.titleContains("your expected title"));
// Interact with the app-specific page, then return if required.
driver.close();
driver.switchTo().window(original);Do not assume the second handle is always the login window when an application can open more than one tab. Compare handles and, when necessary, inspect each candidate’s URL or title before switching.
Handle browser prompts with WebDriver
If the interruption is a JavaScript alert, confirmation or prompt, use Selenium’s prompt API rather than a DOM locator.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
import org.openqa.selenium.Alert;
Alert alert = wait.until(ExpectedConditions.alertIsPresent());
String message = alert.getText();
// Choose the behavior required by the test:
alert.accept(); // or alert.dismiss();
For prompts that appear while navigation is in progress, configure the browser’s unhandled-prompt behavior through the relevant Chrome/WebDriver capability. A browser-managed credential or security dialog may not be controllable through the page DOM; record its type and follow the approved browser and identity configuration for your environment.
Microsoft identity requirements are not Selenium timing bugs
Microsoft’s web sign-in flow redirects the browser to the identity platform, authenticates the user, then redirects back so the application can validate a token and establish an identity cookie. The identity tenant can require credentials, MFA, passwordless verification, administrator consent or Conditional Access checks.
- MFA or passwordless verification: a headless browser cannot legitimately “click through” a second-factor challenge that requires a person, device or authenticator.
- Consent: an administrator or user may need to approve requested permissions before the callback succeeds.
- Conditional Access: device, location, browser and account conditions can block a flow even when the password is correct. A Chrome-specific device requirement is an environment issue, not a general headless-mode fix.
- Account and tenant policy: personal, work and school accounts can follow different policies. Ask the identity administrator which test account and tenant configuration are approved.
When a policy page appears, capture it as a policy outcome and diagnose the tenant configuration. Do not keep increasing wait times and call the result a popup-selector failure.
Choose the right authentication design
| Approach | Best fit | Handles | Limitation |
|---|---|---|---|
| Selenium UI with headless Chrome | Testing the application’s browser experience | DOM interactions and navigation | Tenant sign-in policy, MFA, consent and UI variation remain. |
| Selenium UI with visible Chrome | Diagnosing what the flow actually presents | The same browser UI with easier visual inspection | Still subject to identity policy; use only where the environment permits it. |
| MSAL Java device-code flow | A browserless client obtaining tokens for Microsoft APIs | The user authenticates on another device, including required consent or MFA | It tests an API-client flow, not a website’s browser login UI. |
| ROPC in a controlled test scenario | Specific tenant-approved automated tests discussed in Microsoft guidance | Non-interactive credential submission | MFA does not work with ROPC, and security and policy constraints are substantial. |
When device code is appropriate
MSAL Java’s device-code flow displays a code. The user opens a browser on another device, completes normal authentication and consent, and the client receives tokens for API calls. This is a documented browserless design for an application that needs API access. It does not automate the website’s Microsoft login UI and therefore cannot validate your site’s redirect, cookie or rendered sign-in experience.
Rank #3
When ROPC is considered
Microsoft’s automated-testing guidance discusses Resource Owner Password Credential for some controlled test contexts and explicitly notes that MFA does not work with it. Treat it as a tenant-approved test design only; never present it as a way to defeat an organization’s security requirements.
A diagnostic sequence that separates UI, browser and policy failures
- Where permitted, run one diagnostic pass with a visible browser. Save the URL, a screenshot and the page state at the stall.
- Classify the interruption as DOM content, a new tab/window or a browser prompt.
- For DOM content, inspect the actual page and wait for the application-specific condition.
- For another window, wait for the handle count to change, select the new handle and verify its URL or title.
- For a browser prompt, use the prompt interface or configured prompt behavior.
- If the page requests MFA, consent, passwordless verification or a device claim, stop changing selectors. Use an approved test tenant/account design or, for a genuinely browserless API client, device-code authentication.
- Record Chrome, ChromeDriver, Selenium, Java, operating system, account type, tenant and the exact prompt text. These details distinguish version mismatches from identity policy.
Common failures and fixes
“No such element” on the Microsoft sign-in control
Cause: the control is in a different document state, the app redirected, or the selector was assumed rather than inspected.
Fix: log the current URL and page source or screenshot, switch to the correct window or frame if applicable, and wait for an app-specific condition.
The test times out waiting for a new window
Cause: the application reused the current tab, blocked the popup, or the click did not occur.
Fix: compare the handle set before and after the action. If no handle appears, test the current URL and inspect browser or application logs instead of forcing a window switch.
Headless mode stalls while visible mode reaches a policy page
Cause: environment or Conditional Access differences, not necessarily Selenium timing.
Rank #4
Fix: compare browser, driver, operating system, account and tenant policy. Consult the identity administrator about device-specific requirements.
Authentication completes but the app remains logged out
Cause: the callback, token validation or identity cookie step failed.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Fix: wait for the callback URL or post-login element, verify that the original window is active, and capture the final URL and browser console/network diagnostics where permitted.
Mixing implicit and explicit waits causes erratic timing
Cause: each wait contributes its own polling and timeout behavior.
Fix: remove the global implicit wait and use explicit waits around the states that matter.
Performance, reliability and security considerations
- Use a bounded explicit timeout appropriate to your environment; a longer timeout cannot solve a policy that requires human action.
- Reuse a prepared browser profile only when your security policy allows it. Persisted cookies can hide the sign-in path and make tests less representative.
- Keep test credentials, client secrets and captured screenshots out of logs and artifacts. Login pages can contain personal or organizational data.
- Pin and report browser and driver major versions in CI. A mismatch can fail before your test reaches the popup.
- Separate a browser-UI test from an API-authentication test. The former validates redirects and rendered controls; the latter validates token acquisition and API authorization.
Or skip the browser setup
If your goal is to capture the resulting page rather than exercise the Microsoft login UI, ScreenshotNeo provides a one-request screenshot API and an MCP server for AI agents. It accepts cookie and consent banners before capture and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be disabled. Bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesUse the ScreenshotNeo API documentation for all options. A cURL request is:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpThe equivalent Python request is:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)From Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo also supports full-page and element capture, device and viewport settings, retina scale, PDF output, custom CSS and JavaScript, clicks, selector waits, network-idle waits, request blocking, headers, cookies, user agents, authorization, timezone and geolocation, transparent backgrounds, resizing, chosen cache TTLs, signed links, asynchronous webhooks and bulk capture of up to 100 URLs per call. Its MCP tools—take_screenshot, get_page_info and capture_pdf—work with Claude, Cursor and other MCP clients.
Every feature is included on every plan: 1,000 screenshots per month free with no card, then $5 for 3,000, $15 for 15,000, $39 for 60,000, $99 for 250,000 and $249 for 1,000,000; annual billing provides two months free. Sign up free to get the 1,000 monthly screenshots without entering a card.
What a reliable test should assert
Assert the application outcome, not merely that a popup disappeared. Depending on the scenario, verify the expected callback URL, authenticated application element, account identity shown by the app, or API response. If the requirement is to prove the Microsoft UI works, keep Selenium and an approved interactive test account. If the requirement is only to obtain API tokens without hosting a browser, use the device-code design instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
Frequently Asked Questions
Can headless Chrome automatically complete Microsoft MFA?
No. Headless mode does not remove MFA, passwordless verification, consent or Conditional Access. Use an approved test design or a browserless device-code flow for an API client.
Why can’t I locate the Microsoft popup with Selenium?
It may be a new window or a browser-managed prompt rather than DOM content. Classify it first, then use window handles or WebDriver prompt APIs.
Is MSAL Java device code a replacement for Selenium login tests?
No. Device code authenticates a browserless application for Microsoft APIs; it does not exercise a website’s redirect and rendered login UI.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
