diff --git a/docs/img/admin-signin.png b/docs/img/admin-signin.png
index 05c59ef..20cdf26 100644
Binary files a/docs/img/admin-signin.png and b/docs/img/admin-signin.png differ
diff --git a/docs/ui-guide.md b/docs/ui-guide.md
index be1f75c..92e73e4 100644
--- a/docs/ui-guide.md
+++ b/docs/ui-guide.md
@@ -38,10 +38,11 @@ credentials are keyed by them.
 
 ## `/admin` — operator console
 
-![Admin sign-in](img/admin-signin.png)
+![Admin sign-in on a token-only deployment](img/admin-signin.png)
 
-> The Microsoft button is always rendered here; on a deployment without
-> interactive login just ignore it and paste an admin token.
+As on `/me`, the Microsoft button appears only when interactive login is
+configured (the page checks `/health`); on a token-only deployment you get just
+the token box, shown above.
 
 ### Status
 
diff --git a/packages/gateway/public/admin.html b/packages/gateway/public/admin.html
index 324b50f..8ae5ff2 100644
--- a/packages/gateway/public/admin.html
+++ b/packages/gateway/public/admin.html
@@ -71,10 +71,10 @@ <h1>MSPStack Gateway</h1>
 <div id="login" class="panel section">
   <section class="panel">
     <h2>Admin sign in</h2>
-    <div class="row">
+    <div class="row hidden" id="oidc-row">
       <a class="btn" id="oidc-btn" href="/auth/login?returnTo=/admin">Sign in with Microsoft</a>
     </div>
-    <p class="muted">Or paste an <b>admin bearer token</b> (a static <code>MCP_TOKENS_ADMIN</code> token or an OIDC access token for this gateway) — break-glass for when interactive login is unavailable.</p>
+    <p class="muted">Paste an <b>admin bearer token</b> (a static <code>MCP_TOKENS_ADMIN</code> token or an OIDC access token for this gateway) — break-glass for when interactive login is unavailable.</p>
     <div class="row">
       <input id="token-input" type="password" placeholder="admin token" style="flex:1">
       <button class="btn secondary" id="login-btn">Sign in with token</button>
@@ -619,6 +619,11 @@ <h3>${esc(p.title)}</h3>
   roles: renderRoles, users: renderUsers, secrets: renderSecrets };
 
 async function boot() {
+  // Show the Microsoft button only when interactive login actually exists —
+  // /health reports it; on failure keep it hidden and rely on the token box.
+  fetch("/health").then(r => r.json())
+    .then(h => $("#oidc-row").classList.toggle("hidden", !h.login))
+    .catch(() => {});
   if (TOKEN) { login(TOKEN); return; }
   // No pasted token — try an existing cookie session (Sign in with Microsoft).
   try {