Authenticate .NET apps to Azure services during local development using brokered authentication

Windows provides an authentication broker called Web Account Manager (WAM). WAM enables identity providers such as Microsoft Entra ID to natively plug into the OS and provide secure login services to apps. Brokered authentication enables the app for all operations allowed by the interactive login credentials.

Personal Microsoft accounts and work or school accounts are supported. On supported Windows versions, the default browser-based UI is replaced with a smoother authentication experience, similar to built-in Windows apps.

macOS doesn't natively include a built-in authentication broker. Brokered authentication is supported via the Azure.Identity.Broker library, which uses platform-specific mechanisms and may integrate with apps like Microsoft Company Portal when devices are managed. For more information, see Microsoft Enterprise SSO plug-in for Apple devices.

Linux uses Microsoft single sign-on for Linux as its authentication broker.

The Azure Identity library supports brokered authentication using InteractiveBrowserCredential. For example, to use InteractiveBrowserCredential in a MAUI app to authenticate to Azure Key Vault with the SecretClient, follow these steps:

The Azure Identity library provide interactive brokered authentication using InteractiveBrowserCredential. For example, to use InteractiveBrowserCredential in a console app to authenticate to Azure Key Vault with the SecretClient, follow these steps:

1. Install the Azure.Identity and Azure.Identity.Broker packages.

   dotnet add package Azure.Identity
   dotnet add package Azure.Identity.Broker
   

2. Get a reference to the parent window on top of which the account picker dialog should appear.

3. Create an instance of InteractiveBrowserCredential using InteractiveBrowserCredentialBrokerOptions.

// Get the parent window handle for MAUI on Windows
Microsoft.Maui.Controls.Window? parentWindow = this.GetParentWindow();
Microsoft.UI.Xaml.Window? windowHandle = parentWindow?.Handler?.PlatformView as Microsoft.UI.Xaml.Window;
IntPtr hwnd = windowHandle != null ? WinRT.Interop.WindowNative.GetWindowHandle(windowHandle) : IntPtr.Zero;

// Configure InteractiveBrowserCredentialBrokerOptions with parent window reference
InteractiveBrowserCredentialBrokerOptions options = new(hwnd)
{
    UseDefaultBrokerAccount = true,
};

// Create credential that will use WAM broker on Windows
InteractiveBrowserCredential credential = new(options);

SecretClient client = new(new Uri(KeyVaultUrl), credential);
KeyVaultSecret secret = await client.GetSecretAsync(SecretName);

1. Install the Azure.Identity and Azure.Identity.Broker packages.

   dotnet add package Azure.Identity
   dotnet add package Azure.Identity.Broker
   

   Note

   macOS support exists in Azure.Identity.Broker versions 1.3.0 and later.

2. Get a reference to the parent window on top of which the account picker dialog should appear.

3. Create an instance of InteractiveBrowserCredential using InteractiveBrowserCredentialBrokerOptions.

// Get the parent window handle for MAUI on Mac Catalyst
Microsoft.Maui.Controls.Window? parentWindow = this.GetParentWindow();
UIWindow? uiWindow = parentWindow?.Handler?.PlatformView as UIWindow;
IntPtr hwnd = uiWindow != null ? uiWindow.Handle : IntPtr.Zero;

// Configure InteractiveBrowserCredentialBrokerOptions with parent window reference
InteractiveBrowserCredentialBrokerOptions options = new(hwnd)
{
    UseDefaultBrokerAccount = true,
};

// Create credential that will use the broker on macOS
InteractiveBrowserCredential credential = new(options);

SecretClient client = new(new Uri(KeyVaultUrl), credential);
KeyVaultSecret secret = await client.GetSecretAsync(SecretName);

1. Install the Azure.Identity and Azure.Identity.Broker packages.

   dotnet add package Azure.Identity
   dotnet add package Azure.Identity.Broker
   

   Note

   Linux support exists in Azure.Identity.Broker versions 1.3.0 and later.

2. Get a reference to the parent window on top of which the account picker dialog should appear.

3. Create an instance of InteractiveBrowserCredential using InteractiveBrowserCredentialBrokerOptions.

/// <summary>
/// Get the handle of the console window for Linux
/// </summary>
[DllImport("libX11")]
static extern IntPtr XOpenDisplay(string display);

[DllImport("libX11")]
static extern IntPtr XRootWindow(IntPtr display, int screen);

try
{
    IntPtr parentWindowHandle = XRootWindow(XOpenDisplay(null), 0);
    Func<IntPtr> consoleWindowHandleProvider = () => parentWindowHandle;

    InteractiveBrowserCredentialBrokerOptions options = new(parentWindowHandle)
    {
        UseDefaultBrokerAccount = true,
    };
    
    // Create the InteractiveBrowserCredential using broker support
    InteractiveBrowserCredential credential = new(options);

    Uri vaultUri = new("https://<your-key-vault-name>.vault.azure.net/");
    SecretClient client = new(vaultUri, credential);

    Console.WriteLine("Retrieving secret 'MySecret' from Key Vault...");
    KeyVaultSecret secret = await client.GetSecretAsync("MySecret");

    return 0;
}

The following screenshot shows the alternative interactive, brokered authentication experience:

The following screenshot shows the alternative interactive, brokered authentication experience:

The following video shows the alternative interactive, brokered authentication experience: