Sign in users in sample Android (Kotlin) mobile app by using native authentication

This guide shows how to run an Android sample application that demonstrates sign-up, sign in, sign out, and password reset scenarios using Microsoft Entra's native authentication.

In this article, you learn how to:

• Register application in the external tenant.
• Enable public client and native authentication flows.
• Create user flow in the external tenant.
• Associate your application with the user flow.
• Update the Android configuration code sample file to use your own Microsoft Entra External ID for external tenant details.
• Run and test the sample native Android mobile application.

Prerequisites

• Android Studio.
• An external tenant. If you don't already have one, sign up for a free trial.

Register an application

To enable your application to sign in users with Microsoft Entra, Microsoft Entra External ID must be made aware of the application you create. The app registration establishes a trust relationship between the app and Microsoft Entra. When you register an application, External ID generates a unique identifier known as an Application (client) ID, a value used to identify your app when creating authentication requests.

The following steps show you how to register your app in the Microsoft Entra admin center:

1. Sign in to the Microsoft Entra admin center as at least an Application Developer.

2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to your external tenant from the Directories + subscriptions menu.

3. Browse to Identity >Applications > App registrations.

4. Select + New registration.

5. In the Register an application page that appears;

   1. Enter a meaningful application Name that is displayed to users of the app, for example ciam-client-app.
   2. Under Supported account types, select Accounts in this organizational directory only.

6. Select Register.

7. The application's Overview pane displays upon successful registration. Record the Application (client) ID to be used in your application source code.

Enable public client and native authentication flows

To specify that this app is a public client and can use native authentication, enable public client and native authentication flows:

1. From the app registrations page, select the app registration for which you want to enable public client and native authentication flows.
2. Under Manage, select Authentication.
3. Under Advanced settings, allow public client flows:
   1. For Enable the following mobile and desktop flows select Yes.
   2. For Enable native authentication, select Yes.
4. Select Save button.

Grant API permissions

1. From the App registrations page, select the application that you created (such as ciam-client-app) to open its Overview page.

2. Under Manage, select API permissions.

3. Under Configured permissions, select Add a permission.

4. Select Microsoft APIs tab.

5. Under Commonly used Microsoft APIs section, select Microsoft Graph.

6. Select Delegated permissions option.

7. Under Select permissions section, search for and select offline_access, openid, and profile permissions.

8. Select the Add permissions button.

9. At this point, you've assigned the permissions correctly. However, since the tenant is a customer's tenant, the consumer users themselves can't consent to these permissions. You as the admin must consent to these permissions on behalf of all the users in the tenant:

   1. Select Grant admin consent for <your tenant name>, then select Yes.
   2. Select Refresh, then verify that Granted for <your tenant name> appears under Status for both scopes.

   

Create a user flow

Follow these steps to create a user flow.

1. Sign in to the Microsoft Entra admin center as at least an Application Developer.

2. If you have access to multiple tenants, make sure you use the directory that contains your external tenant:

   1. Select the Directories + subscriptions icon in the toolbar.
   2. On the Portal settings | Directories + subscriptions page, find your external tenant directory in the Directory name list, and then select Switch.

3. On the sidebar menu, select Identity.

4. Select External Identities > User flows.

5. Select + New user flow.

6. On the Create page:

   1. Enter a Name for the user flow, such as SignInSignUpSample.

   2. In the Identity providers list, select Email Accounts. This identity provider allows users to sign-in or sign-up using their email address.

   3. Under Email accounts, you can select one of the two options. For this tutorial, select Email one-time passcode.

      • Email with password: Allows new users to sign up and sign in using an email address as the sign-in name and a password as their first factor credential.
      • Email one-time passcode: Allows new users to sign up and sign in using an email address as the sign-in name and email one-time passcode as their first factor credential. For this option to be available at the user flow level, make sure you enable email one-time passcode (OTP) at the tenant level (Select All Identity Providers > Email One-time passcode, select Yes option, then select Save).

   4. Under User attributes, you can choose the attributes you want to collect from the user upon sign-up. For this guide, select Country/Region and City.

7. Select Create. The new user flow appears in the User flows list. If necessary, refresh the page.

Associate the app with the user flow

Although many applications can be associated with your user flow, a single application can only be associated with one user flow. A user flow allows configuration of the user experience for specific applications. For example, you can configure a user flow that requires users to sign in or sign up with email address.

1. On the sidebar menu, select Identity.

2. Select External Identities, then User flows.

3. In the User flows page, select the User flow name you created earlier, for example, SignInSignUpSample.

4. Under Use, select Applications.

5. Select Add application.

6. Select the application from the list such as ciam-client-app or use the search box to find the application, and then select it.

7. Choose Select.

Clone sample Android mobile application

1. Open Terminal and navigate to a directory where you want to keep the code.

2. Clone the application from GitHub by running the following command:

   git clone https://github.com/Azure-Samples/ms-identity-ciam-native-auth-android-sample 
   

Configure the sample Android mobile application

1. In Android Studio, open the project that you cloned.

2. Open app/src/main/res/raw/native_auth_sample_app_config.json file.

3. Find the placeholder:

   • Enter_the_Application_Id_Here and replace it with the Application (client) ID of the app you registered earlier.
   • Enter_the_Tenant_Subdomain_Here and replace it with the Directory (tenant) subdomain. For example, if your tenant primary domain is contoso.onmicrosoft.com, use contoso. If you don't know your tenant subdomain, learn how to read your tenant details.

You've now configured the app and it's ready to run.

Run and test the sample Android mobile application

To build and run your app, follow these steps:

1. In the toolbar, select your app from the run configurations menu.

2. In the target device menu, select the device that you want to run your app on.

   If you don't have any devices configured, you need to either create an Android Virtual Device to use the Android Emulator or connect a physical Android device.

3. Select the Run button. The app opens the Email & OTP screen.

   

4. Enter a valid email address and select then Sign up button. The app opens the submit code screen and you receive an OTP code in the email address.

   

5. Enter the OTP code that you receive in the email inbox and select Next. If the sign-up is successful, the app signs you in automatically. If you don't receive the OTP code in your email inbox, you can resend it after a while by selecting Resend Passcode.

   

6. To sign out, select the Sign out button.

Other scenarios that this sample supports

This sample app also supports the following authentication flows:

• Email + password covers sign-in or sign-up flows with an email with password.
• Email + password sign-up with user attributes covers sign-up with email and password, and submitting user attributes.
• Password reset covers self-service password reset (SSPR).
• Access Protected API covers call a protected API after the user successfully signs up or signs in and acquires an access token.
• Fallback to web browser covers the use the browser-based authentication as a fallback mechanism when the user can't complete authentication through native authentication for whatever reason.

Test email with password flow

In this section, you test email with password flow, with its variants such as, email with password sign-up with user attributes and SSPR:

1. Use the steps in create a user flow to create a new user flow, but this time select Email with password as your authentication method. You need to configure Country/Region and City as the user attributes. Alternatively, you can modify the existing user flow to use Email with password (Select External Identities > User flows > SignInSignUpSample > Identity providers > Email with password > Save).

2. Use the steps in associate the application with the new user flow to add an app to your new user flow.

3. Run the sample app, then select the ellipsis menu (...) to open more options.

4. Select the scenario you want to test, such as Email + password or Email + password sign-up with user attributes or Password reset, then follow the prompts. To test Password reset, you need to first sign up a user, and enable email one-time passcode for all users in your tenant.

Test call a protected API flow

Use the steps in Call a protected web API in a sample Android mobile app by using native authentication to call a protected web API from a sample Android mobile app.

Next steps

• Tutorial: Prepare your Android app for native authentication.