web account manager

Question

I have a basic architecture question about "Web Account Manager" of windows 10 built into the OS

Hello,

As we know any desktop app can use WAM to get the necessary access-token from Azure-AD and then invoke the API

So when the app-code is updated with WAM-api and request the token,
Would WAM implementation work in browser-context in the event when WAM wants to collect credential from the user ?

OR
whatever popups are opened by app or WAM are totally native forms ?

Thanks.

Answer 1

Hi @testuser7 · Thank you for reaching out.

WAM uses browser context and is not a native form. If you try using a system without a web browser, such as Windows Server Core, WAM will fail to launch.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

@ thanks @AmanpreetSingh-MSFT

I have put 4 screens while I open the Teams app on my AAD joined Win10 laptop.

If you focus on the first screen, I can use any of the 3 accounts that are displayed.
Those are all Windows account meaning there is PRT in the system.
However, I decided to use different account
So I hit "use another account or sign up" link available at the bottom of the screen.

I was taken to the next screen to put my UPN as I have attached here in second screen
After completing the full authentication, I am on Teams app with this new account
by the way, all these screens that we I have attached where user is putting his credentials are in browser context. Right ?

as you can see in first screenshot, there are already 3 PRTs available in this windows-session.
Since that is the maximum number of PRTs possible in one windows-session, I will not be shown the screen “stay signed into all your apps” at the end after user finished authentication of new account as shown in the last 3 screenshots

So when app makes a call like
var pca = PublicClientApplicationBuilder.Create("client_id")
.WithExperimentalFeatures() // in public preview
.WithBroker()
.Build();

My question is, what is the purpose of involving the broker i.e., WAM when we already reached the maximum number of PRT possible.
What difference would it make if the app had used MSAL without WAM ?

My understanding since we are using WAM
the temp-oauth-code will go to WAM redirect-uri and WAM will collect refresh-token and hand it over to the app.

Thanks.