My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I Zap forms-based authentication for a scenario like this? Is it doable?
Maybe you can achieve that integrating ZAP with testing/automation tools. Check out this:
For scanning microservices with token based authentication, the workaround is very different. If you need assistance with something like that, I could give you a more detailed solution.
There is a way to do this, it's too long to write as a comment but I will send a link to a blog post that I wrote two year ago.
Go to the section Setting up an active scan where I've written out the steps involved to scan a page with authentication. You may be able to do both, as long as the steps are followed but you have the same cookie/s?
Alternatively there is a owasp zaproxy user guide on Google which have been helpful.