Regarding : Shared device support with conditional access

[vramasam]

Hello team.

We would like to achieve the "Shared device sign-out support" with Microsoft authenticator app.

We are using "SingleAccountPublicClientApplication" to create the account code detail.

`PublicClientApplication.createSingleAccountPublicClientApplication(applicationContext, file,
new IPublicClientApplication.ISingleAccountApplicationCreatedListener()
{
@OverRide
public void onCreated(ISingleAccountPublicClientApplication application)
{
mSingleAccountApp = (SingleAccountPublicClientApplication) application;

                boolean isShared = mSingleAccountApp.isSharedDevice();
                file.delete();
                loadAccount();
            }

            @Override
            public void onError(MsalException e)
            {

            }
        });`

Till now we are passing the following information in the file:

{"client_id":"proper_client_id","broker_redirect_uri_registered":true,"power_opt_check_for_network_req_enabled":false,"shared_device_mode_supported":true,"power_opt_check_enabled":false,"multiple_clouds_supported":true,"authorization_user_agent":"DEFAULT","redirect_uri":"proper_redirect_uri","account_mode":"SINGLE","authorities":[{"type":"AAD","authority_url":"https://login.microsoftonline.com/common/"}]}

With this device gets registered in the authenticator and generated token send to back end to make the compliant work properly.

Now Customer wants to support Shared device , when they Sign-out , they need to global Sign-out in Microsoft authenticator. We have seen Authenticator app also have an option for that https://learn.microsoft.com/en-us/entra/identity-platform/tutorial-mobile-android-device-shared-mode

https://learn.microsoft.com/en-us/entra/msal/android/shared-devices

We have tried setting this value "shared_device_mode_supported":true while registering the device.

{"client_id":"proper_client_id","broker_redirect_uri_registered":true,"power_opt_check_for_network_req_enabled":false,"shared_device_mode_supported":true,"power_opt_check_enabled":false,"multiple_clouds_supported":true,"authorization_user_agent":"DEFAULT","redirect_uri":"proper_redirect_uri","account_mode":"SINGLE","authorities":[{"type":"AAD","authority_url":"https://login.microsoftonline.com/common/"}]}

With this change also we are able to fetch the token but still Authenticator app is not register as shared device, we are seeing this value is returning as false

` public boolean isSharedDevice()
{
try {
return mSingleAccountApp != null && mSingleAccountApp.isSharedDevice();
}
catch (Exception e) {
}

    return false;
}`

And also when we try to call Sign-out the expectation is it will get Sign-out from Authenticator app also, Kindly confirm our understanding is correct:

ISingleAccountPublicClientApplication app = PublicClientApplication.createSingleAccountPublicClientApplication(applicationContext, file); signOutCompleted = app.signOut();

We would like to know are we missing something here to achieve the shared device functionality.
Already we are using SingleAccountPublicClientApplication and also "shared_device_mode_supported":true is that not sufficient to register the device as shared device mode? If there is additional steps required Kindly let us know what needs to be done

[github-actions]

Thank you for opening this issue!

Labels Applied:
User-Error: The issue arises because the shared device mode configuration and initialization required for proper implementation appear to be incomplete. This is not necessarily an issue with the library itself but rather a mistake in implementation..
needs-more-info: The issue does not specify the MSAL version being used nor whether the Microsoft Authenticator app has been correctly registered as a shared device. We need to know if the prerequisite steps for shared device mode, such as enabling shared device mode on the Microsoft Authenticator app from Azure AD and initializing the PublicClientApplication object explicitly for shared device mode, have been completed..

🤖 AI Analysis

To enable shared device mode with the Microsoft Authenticator app, follow the steps below:

1. Pre-requirements:

   • Ensure the Microsoft Authenticator app is installed on the device. It must be the latest version supporting shared device mode.
   • Ensure that the device is registered in Azure AD for shared device mode and the corresponding shared device mode has been enabled in Azure.
   • Follow the steps outlined in the documentation: https://learn.microsoft.com/en-us/entra/msal/android/shared-devices.

2. Ensure proper configuration: Verify that your auth_config.json file includes the property "shared_device_mode_supported": true. This is necessary but not sufficient to enable shared device mode.

3. Shared Device Mode Activation: Use the enableSharedDeviceMode API to explicitly place the device into shared device mode. Add the following to your code, after the successful creation of the SingleAccountPublicClientApplication:

mSingleAccountApp = (SingleAccountPublicClientApplication) application;
mSingleAccountApp.performSharedDeviceRegistration(applicationContext, new ISingleAccountApplicationCreatedListener() {
    @Override
    public void onCreated(ISingleAccountPublicClientApplication application) {
        Log.d("MSAL", "Device successfully registered in shared mode");
    }

    @Override
    public void onError(MsalException e) {
        Log.e("MSAL", "Failed to register in shared mode", e);
    }
});

4. Shared Device Mode Verification: Once shared mode is enabled, you can confirm it by calling mSingleAccountApp.isSharedDevice(). Ensure this is being called after the device has been properly registered in shared device mode.

5. Global Sign-Out: Use the signOut() method to perform a global device sign-out, which will remove the account from both your application and the authenticator app:

mSingleAccountApp.signOut(new ISingleAccountPublicClientApplication.SignOutCallback() {
    @Override
    public void onSignOut() {
        Log.d("MSAL", "Global sign-out successful");
    }

    @Override
    public void onError(@NonNull MsalException exception) {
        Log.e("MSAL", "Sign-out failed", exception);
    }
});

6. Verify Shared Mode is Functioning: Ensure that authentication and sign-out behavior are consistent with shared mode expectations (e.g., global sign-out).

If the issue persists, verify:

• The proper configuration of shared device mode in the Azure AD portal.
• That the Microsoft Authenticator app is updated and supports shared device mode.

7. Upgrade MSAL if Needed: The issue does not specify the MSAL library version. If you are using an outdated version, update to the latest version (8.3.2 as of the latest release).

implementation "com.microsoft.identity.client:msal:8.3.2"

8. Enable Verbose Logging: Add verbose logging and check for additional information to debug the issue during initialization or shared sign-out failures:

Logger.getInstance().setLogLevel(Logger.LogLevel.VERBOSE);
Logger.getInstance().setEnableLogcatLog(true);
Logger.getInstance().setEnablePII(true); // Only enable for debugging, not production.

See the following guide for more details and examples: https://learn.microsoft.com/en-us/entra/msal/android/shared-devices

Related Issues: #1567, #1543, #2172

---

To help us assist you, please provide:

• MSAL version (latest: 8.3.2)
• Android version and device
• Complete error message/stack trace
• Steps to reproduce

---

Need help? Comment with:

PING-COPILOT: <your question>

Privacy: Do not include credentials, tokens, or PII in PING-COPILOT requests.

[vramasam]

MSAL Version : 8.3.0
Android version : Pixel 8 and Android 16

From app side we are doing all the required data like already we are using Single Account publication and we are passing the required configuration "shared_device_mode_supported":true.

Now from admin point of view how to get the Microsoft authenticator app in Shared device mode? can you please explain more on this ?
Via appconfig we made the device as Shared device and then we tried to register the device we are getting the following error PFA Screen shot and error log file

[Error_Msal.rtf](https://github.com/user-attachments/files/27594118/Error_Msal.rtf)

[vramasam]

We would like to know how to register the device in shared device mode? We are seeing app Config is available as shown in the below screenshot , but we would like to how to generate the token for other MDM solution (Other than Intune) and use it via app Config. And also please confirm with the app Config, authenticator app will get register in Shared Device mode end to end.