So that code will always show the popup.
If you want to avoid the pop up you need to run the code in a button click handler. If you don’t run the code in a click handler then the browser might consider the page to be doing something malicious- like opening another tab without user interaction.
Anvil puts a safe guard in place. If your code tries to login with Microsoft and we’re not running in a click handler, then we show the intermediate alert so that the user can interact with the page in order to not be considered malicious by the browser.