Skip to content

Broker authentication

Jump to bottom
Jiri Formacek edited this page Sep 5, 2026 · 4 revisions

Authentication broker support (WAM / Linux broker / macOS broker)

This module supports broker-based authentication for interactive user sign-in. Brokers integrate with the operating system to provide a more seamless sign-in experience, for example by reusing existing OS accounts and showing an account picker where available.

Fallback behavior: If a broker is not available or cannot be used in the current environment, MSAL can fall back to a browser-based flow; this module also supports alternate flows such as system browser and device code.

Prerequisites (by OS)

Broker availability depends on OS components and enrollment state:

Windows (WAM broker)

  • On Windows, broker authentication uses Web Account Manager (WAM), a Windows platform component available on supported Windows versions.
  • WAM integrates with accounts known to Windows and can provide an account picker experience and SSO benefits where applicable.

Linux (Microsoft SSO for Linux broker)

  • Linux broker authentication requires the Microsoft identity broker package installed (e.g., sudo apt install microsoft-identity-broker or sudo dnf install microsoft-identity-broker). 4
  • MSAL broker support on Linux is introduced with Microsoft.Identity.Client v4.69.1+. 4
  • For WSL-specific prerequisites, WebKitGTK installation, validation, and troubleshooting, see Broker authentication on Ubuntu in WSL.

macOS (Company Portal broker)

  • On macOS, the broker comes with the Company Portal app. 5
  • Microsoft recommends enrolling the macOS device with Company Portal and ensuring the SSO extension integration is working. 5
  • MSAL broker support on macOS requires Microsoft.Identity.Client v4.73.1+. 5

WAM-based authentication (Windows)

This option provides transparent SSO with accounts available through Windows WAM. It is Windows-only. 13

New-AadAuthenticationFactory -TenantId 'mytenant.com' -AuthMode WAM
Get-AadToken -Scopes 'https://management.azure.net/.default' | Test-AadToken -PayloadOnly

Clone this wiki locally