An iOS field-service app lets technicians sign in with Microsoft Entra ID and then calls a protected Azure Functions HTTP API. The app is a public client and has no back-end component of its own. Which MSAL flow should it use to acquire tokens for the API?
Show answer and explanation
Answer: B
A native mobile app is a public client that cannot keep a secret. MSAL uses the authorization code flow with PKCE, which opens an interactive sign-in and binds the code exchange to a verifier the app generated itself. The resulting access token is then requested for the API's scope. On-behalf-of is used by a middle-tier service exchanging a user token, device code suits devices without a browser, and integrated Windows authentication needs a domain-joined Windows session.
Why the other options are wrong
- A. On-behalf-of is used by a middle-tier API that received a user token and needs to call a downstream API as that user. The iOS app is the originating client here, so this flow does not apply.
- C. Device code flow is intended for devices with limited input, where the user completes sign-in on a second device. An iPhone can present a full sign-in screen, so this flow is unnecessary.
- D. Integrated Windows authentication relies on a domain-joined Windows session and Kerberos. An iOS device has no such session, so this flow cannot be used at all.