Add Entra sign-in to your application

Overview

Application sign-in, downstream delegated consent and Insights operator sign-in are distinct. Use immutable identifiers to map the authenticated user to a FabrCore principal; display email can change. Blazor server state must be scoped to that signed-in user.

Login establishes the application session

Entra sign-in returns a validated identity to the application through its configured authentication handler. Map stable tenant/object identifiers to the FabrCore principal. The visible email address is useful UI text but can change. A Blazor circuit should retain the current user's scoped context rather than reading another request's identity from a shared singleton.

Login does not grant every downstream permission

A successful session lets the user access your application according to your policy. Calling Graph may require different consent and a resource-specific token. The same distinction applies to cloud-console operators: their administrative identity cannot be reused as the user's delegated grant. The example configuration belongs to your application's auth integration.

Map signed-in users to principals

1. Register the application and exact development/deployed redirect URIs. Configure ASP.NET Core OpenID Connect through a supported Entra integration.
2. Validate tenant/issuer/audience and map the authenticated identity to the Surface/Host principal context. Keep proxy forwarding inside the trusted boundary.
3. For MAUI, use a public-client browser sign-in flow and supported redirect handling. Store credentials using platform-protected facilities and clear account-specific state on sign-out.

"Microsoft365Copilot": {
  "UserAuthorization": {
    "DefaultHandlerName": "graph",
    "AutoSignIn": true,
    "PassUserTokenToAgent": true,
    "Handlers": {
      "graph": {
        "Settings": {
          "AzureBotOAuthConnectionName": "<oauth-connection-name>",
          "OBOConnectionName": "ServiceConnection",
          "OBOScopes": [ "https://graph.microsoft.com/.default" ]
        }
      }
    }
  }
}

public override async Task<AgentMessage> OnMessage(AgentMessage message)
{
    if (message.Args?.TryGetValue("Microsoft365Copilot:UserToken", out var userToken) == true)
    {
        // Call Microsoft Graph / your API with Bearer userToken — acting as the user.
    }
    ...
}

Go deeper

Explore the related documentation.

• FabrCore Microsoft Integrations
• FabrCore Connections
• FabrCore Microsoft 365 Copilot
• FabrCore A2A
• Entra Sso Setup