Azure AD token Issuer

Abhay Chandramouli 991

What is the difference between sts.windows.net login.microsoft.online issuers in token ?

Shweta Mathur 29,756 Reputation points Microsoft Employee

2024-05-16T11:25:07.2433333+00:00

@Abhay Chandramouli Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Shweta Mathur 29,756 Reputation points Microsoft Employee

2024-05-10T05:44:55.6833333+00:00

Hi @Abhay Chandramouli ,

Thanks for reaching out.

The sts.windows.net and login.microsoftonline.com are both Security Token Services (STS) that issue tokens for Azure Active Directory (Azure AD). The sts.windows.net is the original STS for Azure AD v1, while login.microsoftonline.com is a newer STS that was introduced to support newer authentication protocols like OpenID Connect. Both issuers can issue tokens for Azure AD, but the tokens issued by login.microsoftonline.com are generally newer and support more features.

Both the sample tokens have been provided here - https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens#token-formats

You can decode those tokens using jwt.ms and then compare the slightly varying claims of the tokens.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.
Please sign in to rate this answer.
Abhay Chandramouli 991 Reputation points

2024-05-11T18:20:45.73+00:00

Hi Shweta,

Can you let us know the recommended one ? sts or login.microsoft ? Is there an end of life for the sts one ?

Also what additional features are there in the new one ? How does it impact systems using the sts one ?

Shweta Mathur 29,756 Reputation points Microsoft Employee

2024-05-13T08:32:57.9633333+00:00

Abhay Chandramouli

V1 authenticate Azure AD identities (work and school accounts) by requesting tokens from the Azure AD v1.0 endpoint, using Azure AD Authentication Library (ADAL), Azure portal, and Azure AD Graph API.

However, V2 authenticate a broader set of Microsoft identities (personal accounts as well) through what has been known as the Azure AD v2.0 endpoint, using Microsoft Authentication Library (MSAL), Azure portal, and Microsoft Graph API.

The recommended one is v2 endpoint.

V1 recommend ADAL client library which has not been supported now and all the applications has been asked to migrate to MSAL which supports V2 endpoint.

Reference - https://learn.microsoft.com/en-us/entra/identity-platform/msal-migration

Hope this will help.

Thanks,

Shweta
Sign in to comment

Share via

Azure AD token Issuer

1 answer