Authenticates against the mymsp.io Microsoft 365 tenant. Two-factor is enforced by tenant policy. Only allow-listed platform staff can sign in.
Issues an HS256 platform token via packages/auth's dev-mode secret. The Platform API verifies it on every call. The session expires after 8h.