You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn to customize prompt behavior in interactive calls using the Microsoft Authentication Library for JavaScript (MSAL.js).
2
+
title: Prompt behavior with MSAL.js
3
+
description: Learn to customize prompt behavior using the Microsoft Authentication Library for JavaScript (MSAL.js).
4
4
services: active-directory
5
5
author: mmacy
6
6
manager: CelesteDG
@@ -16,34 +16,76 @@ ms.custom: aaddev
16
16
#Customer intent: As an application developer, I want to learn about customizing the UI prompt behaviors in MSAL.js library so I can decide if this platform meets my application development needs and requirements.
17
17
---
18
18
19
-
# Prompt behavior in MSAL.js interactive requests
19
+
# Prompt behavior with MSAL.js
20
20
21
-
When a user has established an active Azure AD session with multiple user accounts, the Azure AD sign in page will by default prompt the user to select an account before proceeding to sign in. Users will not see an account selection experience if there is only a single authenticated session with Azure AD.
21
+
MSAL.js allows passing a prompt value as part of its login or token request methods. Based on your application scenario, you can customize the Azure AD prompt behavior for a request by setting the **prompt** parameter in the [request object](https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest):
22
22
23
-
The MSAL.js library (starting in v0.2.4) does not send a prompt parameter during the interactive requests (`loginRedirect`, `loginPopup`, `acquireTokenRedirect` and `acquireTokenPopup`), and thereby does not enforce any prompt behavior. For silent token requests using the `acquireTokenSilent` method, MSAL.js passes a prompt parameter set to `none`.
Based on your application scenario, you can control the prompt behavior for the interactive requests by setting the prompt parameter in the request parameters passed to the methods. For example, if you want to invoke the account selection experience:
26
+
constpca=newPublicClientApplication({
27
+
auth: {
28
+
clientId:"YOUR_CLIENT_ID"
29
+
}
30
+
});
26
31
27
-
```javascript
28
-
var request = {
32
+
constloginRequest= {
29
33
scopes: ["user.read"],
30
34
prompt:'select_account',
31
35
}
32
36
33
-
userAgentApplication.loginRedirect(request);
37
+
pca.loginPopup(loginRequest)
38
+
.then(response=> {
39
+
// do something with the response
40
+
})
41
+
.catch(error=> {
42
+
// handle errors
43
+
});
34
44
```
35
45
46
+
## Supported prompt values
47
+
48
+
The following prompt values can be used when authenticating with the Microsoft identity platform:
|`login`| Forces the user to enter their credentials on that request, negating single-sign on. |
53
+
|`none`| Ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns a *login_required* or *interaction_required* error. |
54
+
|`consent`| Triggers the OAuth consent dialog after the user signs in, asking the user to grant permissions to the app. |
55
+
|`select_account`| Interrupts single sign-on by providing an account selection experience listing all the accounts in session or an option to choose a different account altogether. |
56
+
|`create`| Triggers a sign-up dialog allowing external users to create an account. For more information, see: [Self-service sign-up](../external-identities/self-service-sign-up-overview.md)|
57
+
58
+
MSAL.js will throw an `invalid_prompt` error for any unsupported prompt values:
59
+
60
+
```console
61
+
invalid_prompt_value: Supported prompt values are 'login', 'select_account', 'consent', 'create' and 'none'. Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest Given value: my_custom_prompt
62
+
```
63
+
64
+
## Default prompt values
65
+
66
+
The following shows default prompt values that MSAL.js uses:
36
67
37
-
The following prompt values can be passed when authenticating with Azure AD:
**login:** This value will force the user to enter credentials on the authentication request.
77
+
> [!NOTE]
78
+
> Note that **prompt** is a protocol-level parameter and signals the desired authentication behavior to the identity provider. It does not affect MSAL.js behavior and MSAL.js does not have control over how the service will ultimately handle the request. In most circumstances, Azure AD will try to honor the request. If this is not possible, it may return an error response, or completely ignore the given prompt value.
40
79
41
-
**select_account:** This value will provide the user with an account selection experience listing all the accounts in session.
80
+
## Interactive requests with prompt=none
42
81
43
-
**consent:** This value will invoke the OAuth consent dialogue that allows users to grant permissions to the app.
82
+
Generally, when you need to make a silent request, use a silent MSAL.js method (`ssoSilent`, `acquireTokenSilent`), and handle any *login_required* or *interaction_required* errors with an interactive method (`loginPopup`, `loginRedirect`, `acquireTokenPopup`, `acquireTokenRedirect`).
44
83
45
-
**none:** This value will ensure that the user does not see any interactive prompt. It is recommended not to pass this value to interactive methods in MSAL.js as it can have unexpected behaviors. Instead, use the `acquireTokenSilent` method to achieve silent calls.
84
+
In some cases however, the prompt value `none` can be used together with an interactive MSAL.js method to achieve silent authentication. For instance, due to the third-party cookie restrictions in some browsers, `ssoSilent` requests will fail despite an active user session with Azure AD. As a remedy, you can pass the prompt value `none`to an interactive request such as `loginPopup`. MSAL.js will then open a popup window to Azure AD and Azure AD will honor the prompt value by utilizing the existing session cookie. In this case, the user will see a brief popup window but will not be prompted for a credential entry.
46
85
47
86
## Next steps
48
87
49
-
Read more about the `prompt` parameter in the [OAuth 2.0 implicit grant](v2-oauth2-implicit-grant-flow.md) protocol which MSAL.js library uses.
88
+
-[Single sign-on with MSAL.js](msal-js-sso.md)
89
+
-[Handle errors and exceptions in MSAL.js](msal-error-handling-js.md)
90
+
-[Handle ITP in Safari and other browsers where third-party cookies are blocked](reference-third-party-cookies-spas.md)
Copy file name to clipboardExpand all lines: articles/active-directory/enterprise-users/directory-delegated-administration-primer.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: barclayn
6
6
manager: amycolannino
7
7
ms.author: barclayn
8
8
ms.reviewer: yuank
9
-
ms.date: 06/23/2022
9
+
ms.date: 09/13/2022
10
10
ms.topic: overview
11
11
ms.service: active-directory
12
12
ms.subservice: enterprise-users
@@ -23,7 +23,7 @@ Managing permissions for external partners is a key part of your security postur
23
23
24
24
## Delegated administration relationships
25
25
26
-
Delegated administration relationships enable technicians at a Microsoft CSP to administer Microsoft services such as Microsoft 365, Dynamics, 365, and Azure on behalf of your organization. These technicians administer these services for you using the same roles and permissions as administrators in your organization. These roles are assigned to security groups in the CSP’s Azure AD tenant, which is why CSP technicians don’t need user accounts in your tenant in order to administer services for you.
26
+
Delegated administration relationships enable technicians at a Microsoft CSP to administer Microsoft services such as Microsoft 365, Dynamics 365, and Azure on behalf of your organization. These technicians administer these services for you using the same roles and permissions as your organization's own administrators. These roles are assigned to security groups in the CSP’s Azure AD tenant, which is why CSP technicians don’t need user accounts in your tenant in order to administer services for you.
27
27
28
28
There are two types of delegated administration relationships that are visible in the Azure AD admin portal experience. The newer type of delegated admin relationship is known as Granular Delegated Admin Permission. The older type of relationship is known as Delegated Admin Permission. You can see both types of relationship if you sign in to the Azure AD admin portal and then select **Delegated administration**.
0 commit comments