diff --git a/src/teampulse/auth.py b/src/teampulse/auth.py
new file mode 100644
index 0000000..99b712a
--- /dev/null
+++ b/src/teampulse/auth.py
@@ -0,0 +1,35 @@
+from pathlib import Path
+
+from playwright.sync_api import BrowserContext, Playwright
+
+SESSION_DIR = Path.home() / ".teampulse" / "session"
+
+
+def create_context(playwright: Playwright, headless: bool = True) -> BrowserContext:
+    SESSION_DIR.mkdir(parents=True, exist_ok=True)
+    return playwright.chromium.launch_persistent_context(
+        str(SESSION_DIR),
+        headless=headless,
+        args=["--no-sandbox"],
+        locale="de-DE",
+    )
+
+
+def ensure_logged_in(context: BrowserContext) -> None:
+    page = context.pages[0] if context.pages else context.new_page()
+    page.goto("https://teams.microsoft.com")
+
+    if _is_login_page(page):
+        print("Bitte im Browser-Fenster anmelden (SSO/MFA)...")
+        page.wait_for_url("**/teams.microsoft.com/**", timeout=120_000)
+        print("Anmeldung erfolgreich.")
+
+    page.close()
+
+
+def _is_login_page(page) -> bool:
+    try:
+        page.wait_for_url("**/login**", timeout=3000)
+        return True
+    except Exception:
+        return False