> For the complete documentation index, see [llms.txt](https://docs.bluefletch.com/bluefletch-enterprise/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bluefletch.com/bluefletch-enterprise/product-guides/authentication-and-sso/technical-guide/msal.md).

# MSAL

Auth - MSAL supports shared device mode from Microsoft. This connection supports Brokered authentication via MS Authenticator and Browser based authentication.

<table><thead><tr><th width="374">Field</th><th>Description</th></tr></thead><tbody><tr><td>client_id</td><td><strong>string</strong> The client ID used to register this application in Azure AD.</td></tr><tr><td>authorization_user_agent</td><td><strong>string</strong> Set to <code>"DEFAULT"</code>, or set to <code>"BROWSER"</code> to use the BlueFletch Browser. Support for BlueFletch Browser introduced in Auth version 4.8.0.</td></tr><tr><td>redirect_uri</td><td><strong>string</strong> The configured redirect callback URI for this application. For the MSAL library, the redirect must use the application ID and its signature. Use <code>"msauth://com.bluefletch.ems.auth/KUKEusfKtqAOu9UB6jgjtTMKYas%3D"</code>.</td></tr><tr><td>authority_type</td><td><strong>string</strong> Set to <code>"AAD"</code> for Azure AD.</td></tr><tr><td>authority_url</td><td><strong>string</strong> The directory from which MSAL can request tokens. Typically, set to <code>"https://login.microsoftonline.com/&#x3C;audience_tenant_id>"</code>, where <code>&#x3C;audience_tenant_id></code> is the Azure Tenant ID.</td></tr><tr><td>logout_url</td><td><strong>string</strong> Set to <code>"https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F%3Fref%3Dlogout"</code>, which will also log the user out of office365.</td></tr><tr><td>limit_to_launcher_groups</td><td><strong>boolean</strong> If set to <code>true</code>, only the groups identified in the <a href="/bluefletch-enterprise/product-guides/bluefletch-launcher/launcher3/technical-guide.md#group-inclusions"><code>group_inclusion</code></a> and <a href="/bluefletch-enterprise/product-guides/bluefletch-launcher/launcher3/technical-guide.md#layouts"><code>layouts</code></a> in the launcher configuration file will be passed into the session.</td></tr><tr><td>scopes</td><td><strong>string</strong> OIDC scope values required for the identity provider. For MSAL, the values should be <code>"openid email profile User.Read GroupMember.Read.All"</code>.</td></tr><tr><td>audience_tenant_id</td><td><strong>string</strong> Set to the Azure Tenant ID. Replaces <code>tenant_id</code> starting in Auth version 4.5.9.</td></tr><tr><td>shared_device_mode_supported</td><td><strong>boolean</strong> Set to <code>true</code> if using the Microsoft Authenticator application in Shared Device Mode on the device.  If not in Shared Device mode, must be defined and set to <code>false</code> .  Default is <code>true</code>.</td></tr><tr><td>broker_redirect_uri_registered</td><td><p><strong>boolean</strong> If <code>true</code>, the Auth module will defer authentication to Microsoft's authentication broker (e.g. MS Authenticator or Company Portal) if installed on the device.  </p><p>Must set value to <code>true</code> if using Microsoft Intune Shared Device Mode.</p><p>Must set value to <code>false</code> if not using Microsoft Intune Shared Device mode and using the BF Browser.  Default is <code>true</code>.</p></td></tr><tr><td>limit_groups_to_direct_membership</td><td><strong>boolean</strong> If set to <code>true</code>, only direct group membership information will be returned from Azure. If <code>false</code>, all inherited/related group information (indentified as <code>transitiveMemberOf</code> in Azure) is returned. Default is <code>false</code>. Introduced in Auth version 4.7.8.</td></tr><tr><td>ignoreAccountChangeBroadcast</td><td><strong>boolean</strong> if set to <code>true</code>, Auth will ignore the change account broadcast coming from the shared device broker, and will prevent Launcher from performing a force logout when a user signs out from MS Edge or other MS application. Default is <code>false</code>, which is the Microsoft recommended setting. Introduced in Auth version 4.8.31.</td></tr><tr><td>audience_type</td><td><strong>string</strong> If set, overrides the default audience type of "AzureADMyOrg".</td></tr><tr><td>auth_default_group</td><td><strong>string</strong> If set, is the default group assigned to a logged in user.</td></tr><tr><td>account_mode</td><td><strong>string</strong> If set, overrides the default account mode of "SINGLE".</td></tr><tr><td>idpPasswordChangePolicyDays</td><td><strong>string</strong> The number of days set in the IdP after which the password needs to be changed.</td></tr><tr><td>idpPasswordChangeReminderDays</td><td><strong>string</strong> Number of days prior to password expiration to start notifying users of upcoming password expirations.</td></tr></tbody></table>

**Auth4 Example:**

```
...
"auth_msal" : {
    "client_id": "<client_id during registration>",
    "authorization_user_agent" : "DEFAULT",
    "redirect_uri": "msauth://com.bluefletch.ems.auth/KUKEusfKtqAOu9UB6jgjtTMKYas%3D",
    "authority_type": "AAD",
    "authority_url": "https://login.microsoftonline.com/<audience_tenant_id>",
    "audience_tenant_id" : "<audience_tenant_id>",
    "logout_url": "https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F%3Fref%3Dlogout",
    "limit_to_launcher_groups": true,
    "scopes": "openid email profile User.Read GroupMember.Read.All",
    "shared_device_mode_supported": true,
    "broker_redirect_uri_registered": true,
    "limit_groups_to_direct_membership": true,
    "auth_default_group": "Associates"
}
...
```

For more information on configuring, see the [AppAuth/OIDC IdP](/bluefletch-enterprise/product-guides/authentication-and-sso/technical-guide/appauth-oidc.md) section.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.bluefletch.com/bluefletch-enterprise/product-guides/authentication-and-sso/technical-guide/msal.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.