Introducing Native Authentication for Microsoft Entra External ID

Kaushik Kislay

Today, we’re excited to announce the public preview of Native Authentication for Microsoft Entra External ID. Native authentication empowers you to take complete control over the design of the sign-in experience of your mobile applications. It allows you to craft stunning, pixel-perfect authentication screens that are seamlessly integrated into your apps, rather than relying on browser-based solutions.

To learn more about native authentication, explore our docs.

Authentication on Mobile: Native authentication vs Browser-delegated

When it comes to implementing authentication for mobile apps on External ID, you have two options:

• Fully custom SDK based native authentication.
• Microsoft-hosted browser-delegated authentication.

In the browser-delegated mobile app sign-in process, users often experience a disruptive jump during authentication. They’re taken to a browser for authentication and then redirected back to the app when the sign-in is complete. This leads to a diluted experience and branding can be compromised. While browser-delegated methods can reduce attack vectors and support single sign-on (SSO), they suffer from limited UI customization and poor user experience.

Native authentication gives you full control over the user interface and experience.

When to use native authentication

The approach you choose will depend on your app’s specific requirements. While each app has unique authentication needs, there are some common considerations to keep in mind. Whether you choose native authentication or browser-delegated authentication, Microsoft Entra External ID supports both.

The following table compares the two authentication approaches to help you decide which one is right for your app.

How to use native authentication 

You can build apps that use native authentication by using our native authentication API or the Microsoft Authentication Library (MSAL) SDK for Android and iOS. Whenever possible, we recommend you use MSAL to add native authentication to your apps. If you are planning to create a mobile app on a framework currently not supported by MSAL, you can use our authentication API.

The MSAL SDK abstracts the underlying protocol and provides you with simple, intuitive scenario-based interfaces. For example, to sign a user in using the email one-time passcode flow, it captures the user’s email and sends them an email containing a one-time passcode to verify their email. When the user enters the valid one-time passcode, the app signs them in.

In the example below where we sign a user in, we use the library’s signIn(username) method, the function will return a result that you can assign to the actionResult field. The actionResult represents the result of the previously performed action and can take multiple states (forms).

To implement this, add a button to your application that calls the following code snippet when selected:

Kotlin

 CoroutineScope(Dispatchers.Main).launch {
     val actionResult = authClient.signIn(
         username = emailAddress
     )
     if (actionResult is SignInResult.CodeRequired) {
         val nextState = actionResult.nextState
         val submitCodeActionResult = nextState.submitCode(
             code = code
         )
         if (submitCodeActionResult is SignInResult.Complete){
             // Handle sign in success
             val accountState = submitCodeActionResult.resultValue
             val accessTokenResult = accountState.getAccessToken()
             if (accessTokenResult is GetAccessTokenResult.Complete) {
                 val accessToken = accessTokenResult.resultValue.accessToken
                 val idToken = accountState.getIdToken()
             }
         }
     }
 }

Error scenarios such as ‘user not found’ can be handled as shown in the code snippet below.

Kotlin

val actionResult = authClient.sign(
    username = emailAddress
)
if (actionResult is SignInResult.CodeRequired) {
    // Next step: submit code
} else if (actionResult is SignInError) {
    // Handle sign in errors
    when {
         actionResult.isUserNotFound() -> {
             // Handle "user not found" error
         }
         else -> {
             // Handle other errors
         }
     }
}

Ready to get started?

Stay connected and informed

To learn more or test out features in the Microsoft Entra suite of products, visit our developer center. Make sure you subscribe to the Identity blog for more insights and to keep up with the latest on all things Identity. And, follow us on YouTube for video overviews, tutorials, and deep dives.

Kaushik Kislay

Follow