You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/develop/msal-client-application-configuration.md
+25-24Lines changed: 25 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: develop
10
10
ms.topic: conceptual
11
11
ms.workload: identity
12
-
ms.date: 11/20/2020
12
+
ms.date: 07/15/2022
13
13
ms.author: marsma
14
14
ms.reviewer: saeeda
15
15
ms.custom: aaddev, has-adal-ref
@@ -33,12 +33,12 @@ The authority is a URL that indicates a directory that MSAL can request tokens f
33
33
34
34
Common authorities are:
35
35
36
-
| Common authority URLs | When to use |
37
-
|--|--|
38
-
|`https://login.microsoftonline.com/<tenant>/`| Sign in users of a specific organization only. The `<tenant>` in the URL is the tenant ID of the Azure Active Directory (Azure AD) tenant (a GUID), or its tenant domain. |
39
-
|`https://login.microsoftonline.com/common/`| Sign in users with work and school accounts or personal Microsoft accounts. |
40
-
|`https://login.microsoftonline.com/organizations/`| Sign in users with work and school accounts. |
41
-
|`https://login.microsoftonline.com/consumers/`| Sign in users with personal Microsoft accounts (MSA) only. |
|`https://login.microsoftonline.com/<tenant>/`| Sign in users of a specific organization only. The `<tenant>` in the URL is the tenant ID of the Azure Active Directory (Azure AD) tenant (a GUID), or its tenant domain. |
39
+
|`https://login.microsoftonline.com/common/`| Sign in users with work and school accounts or personal Microsoft accounts.|
40
+
|`https://login.microsoftonline.com/organizations/`| Sign in users with work and school accounts. |
41
+
|`https://login.microsoftonline.com/consumers/`| Sign in users with personal Microsoft accounts (MSA) only.|
42
42
43
43
The authority you specify in your code needs to be consistent with the **Supported account types** you specified for the app in **App registrations** in the Azure portal.
44
44
@@ -50,16 +50,16 @@ The authority can be:
50
50
51
51
Azure AD cloud authorities have two parts:
52
52
53
-
- The identity provider *instance*
54
-
- The sign-in *audience* for the app
53
+
- The identity provider _instance_
54
+
- The sign-in _audience_ for the app
55
55
56
56
The instance and audience can be concatenated and provided as the authority URL. This diagram shows how the authority URL is composed:
57
57
58
58
59
59
60
60
## Cloud instance
61
61
62
-
The *instance* is used to specify if your app is signing users from the Azure public cloud or from national clouds. Using MSAL in your code, you can set the Azure cloud instance by using an enumeration or by passing the URL to the [national cloud instance](authentication-national-cloud.md#azure-ad-authentication-endpoints) as the `Instance` member (if you know it).
62
+
The _instance_ is used to specify if your app is signing users from the Azure public cloud or from national clouds. Using MSAL in your code, you can set the Azure cloud instance by using an enumeration or by passing the URL to the [national cloud instance](authentication-national-cloud.md#azure-ad-authentication-endpoints) as the `Instance` member.
63
63
64
64
MSAL.NET will throw an explicit exception if both `Instance` and `AzureCloudInstance` are specified.
65
65
@@ -100,7 +100,7 @@ Currently, the only way to get an app to sign in users with only personal Micros
100
100
101
101
## Client ID
102
102
103
-
The client ID is the unique application (client) ID assigned to your app by Azure AD when the app was registered.
103
+
The client ID is the unique **Application (client) ID** assigned to your app by Azure AD when the app was registered.
104
104
105
105
## Redirect URI
106
106
@@ -110,40 +110,41 @@ The redirect URI is the URI the identity provider will send the security tokens
110
110
111
111
If you're a public client app developer who's using MSAL:
112
112
113
-
- You'd want to use `.WithDefaultRedirectUri()` in desktop or UWP applications (MSAL.NET 4.1+). This method will set the public client application's redirect URI property to the default recommended redirect URI for public client applications.
113
+
- You'd want to use `.WithDefaultRedirectUri()` in desktop or Universal Windows Platform (UWP) applications (MSAL.NET 4.1+). The `.WithDefaultRedirectUri()` method will set the public client application's redirect URI property to the default recommended redirect URI for public client applications.
| UWP | value of `WebAuthenticationBroker.GetCurrentApplicationCallbackUri()`. This enables SSO with the browser by setting the value to the result of WebAuthenticationBroker.GetCurrentApplicationCallbackUri() which you need to register |
119
-
| .NET Core |`https://localhost`. This enables the user to use the system browser for interactive authentication since .NET Core doesn't have a UI for the embedded web view at the moment. |
| UWP | value of `WebAuthenticationBroker.GetCurrentApplicationCallbackUri()`. This enables single sign-on (SSO) with the browser by setting the value to the result of WebAuthenticationBroker.GetCurrentApplicationCallbackUri(), which you need to register |
119
+
| .NET Core |`https://localhost`enables the user to use the system browser for interactive authentication since .NET Core doesn't have a UI for the embedded web view at the moment.|
120
120
121
-
- You don't need to add a redirect URI if you're building a Xamarin Android and iOS application that doesn't support the broker redirect URI. It is automatically set to `msal{ClientId}://auth` for Xamarin Android and iOS.
121
+
- You don't need to add a redirect URI if you're building a Xamarin Android and iOS application that doesn't support the broker redirect URI. It's automatically set to `msal{ClientId}://auth` for Xamarin Android and iOS.
122
122
123
123
- Configure the redirect URI in [App registrations](https://aka.ms/appregistrations):
124
124
125
-
125
+
126
126
127
127
You can override the redirect URI by using the `RedirectUri` property (for example, if you use brokers). Here are some examples of redirect URIs for that scenario:
For additional iOS details, see [Migrate iOS applications that use Microsoft Authenticator from ADAL.NET to MSAL.NET](msal-net-migration-ios-broker.md) and [Leveraging the broker on iOS](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Leveraging-the-broker-on-iOS).
133
-
For additional Android details, see [Brokered auth in Android](msal-android-single-sign-on.md).
132
+
For more iOS details, see [Migrate iOS applications that use Microsoft Authenticator from ADAL.NET to MSAL.NET](msal-net-migration-ios-broker.md) and [Leveraging the broker on iOS](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Leveraging-the-broker-on-iOS).
133
+
For more Android details, see [Brokered auth in Android](msal-android-single-sign-on.md).
134
134
135
135
### Redirect URI for confidential client apps
136
136
137
-
For web apps, the redirect URI (or reply URL) is the URI that Azure AD will use to send the token back to the application. This URI can be the URL of the web app/web API if the confidential app is one of these. The redirect URI needs to be registered in app registration. This registration is especially important when you deploy an app that you've initially tested locally. You then need to add the reply URL of the deployed app in the application registration portal.
137
+
For web apps, the redirect URI (or reply URL) is the URI that Azure AD will use to send the token back to the application. The URI can be the URL of the web app/web API if the confidential app is one of them. The redirect URI needs to be registered in app registration. The registration is especially important when you deploy an app that you've initially tested locally. You then need to add the reply URL of the deployed app in the application registration portal.
138
138
139
139
For daemon apps, you don't need to specify a redirect URI.
140
140
141
141
## Client secret
142
142
143
-
This option specifies the client secret for the confidential client app. This secret (app password) is provided by the application registration portal or provided to Azure AD during app registration with PowerShell AzureAD, PowerShell AzureRM, or Azure CLI.
143
+
This option specifies the client secret for the confidential client app. The client secret (app password) is provided by the application registration portal or provided to Azure AD during app registration with PowerShell AzureAD, PowerShell AzureRM, or Azure CLI.
144
144
145
145
## Logging
146
-
To help in debugging and authentication failure troubleshooting scenarios, the Microsoft Authentication Library provides built-in logging support. Logging is each library is covered in the following articles:
146
+
147
+
To help in debugging and authentication failure troubleshooting scenarios, the MSAL provides built-in logging support. Logging in each library is covered in the following articles:
0 commit comments