MSAL.NET supports multiple application architectures and multiple platforms

Why use MSAL.NET ?

MSAL.NET (Microsoft Authentication Library for .NET) enables developers of .NET applications to acquire tokens in order to call secured Web APIs. These Web APIs can be the Microsoft Graph, other Microsoft APIS, 3rd party Web APIs, or your own Web API.

MSAL.NET Supports multiple application architectures

MSAL.NET supports all the possible application topologies including:

• native client (mobile/desktop applications) calling the Microsoft Graph in the name of the user,
• daemons/services or web clients (Web Apps/ Web APIs) calling the Microsoft Graph in the name of a user, or without a user.

With the exception of:

• User-agent based client which is only supported in JavaScript

For details about the supported scenarios see Scenarios

MSAL.NET Supports multiple platforms

• .NET Framework,
• .NET Core,
• Xamarin Android,
• Xamarin iOS,
• UWP

Important

Not all the authentication features are available in all platforms, mostly because:

• mobile platforms (Xamarin and UWP) do not allow confidential client flows, because they are not meant to function as a backend and to store secrets,
• on public client (mobile and desktop), the default browser is different from platform to platform and broker availability varies.

Most of the pages in the wiki describe the most complete platform (.NET Framework), but, topic by topic, it occasionally calls out differences between platforms.

Added value by using MSAL.NET over OAuth libraries or coding against the protocol?

MSAL.NET is a token acquisition library. Depending on your scenario it provides you with various way of getting a token, with a consistent API for a number of platforms. It also adds value by:

• maintaining a token cache and refreshes tokens for you when they are close to expire.

  you don't need to handle expiration on your own.

• helping you specify which audience you want your application to sign-in (your org, several orgs, work and school and Microsoft personal accounts, Social identities with Azure AD B2C, users in sovereign and national clouds)
• helping you setting-up your application from configuration files
• helping you troubleshooting your app by exposing actionable exceptions, logging and telemetry.

MSAL.NET is about acquiring tokens, not protecting an API

MSAL.NET is used to acquire tokens. It's not used to protect a Web API. If you are interested in protecting a Web API with Azure AD, you might want to check out:

• Azure Active Directory with ASP.NET Core. Note that some of these examples present Web Apps which also call a Web API with ADAL.NET or MSAL.NET
• active-directory-dotnet-native-aspnetcore-v2 which demoes calling a ASP.NET Core Web API from a WPF application using Azure AD V2
• The IdentityModel extensions for .Net open source library providing middleware used by ASP.NET and ASP.NET Core to protect APIs