[Question] "Request Consent" function does not honour "Use System Browser for logon" setting

[mdi-db]

Version

3.x

How do you sign in?

Interactive, system browser (the default in v4)

Cloud

Public (commercial)

What are you trying to do?

I am trying to request consent for Graph scopes after signing in using the system browser login method.

What have you tried, and what happened?

I am signing into a tenant that requires the use of FIDO2 security keys. Therefore, I have enabled the Use System Browser for login setting. I am then able to sign-in. The next step is to click Request Consent, but the dialog used for this appears to still be the embedded window despite the fact I have enabled system browser login. This presents me with two issues:

1. The dialog asks me to sign in when I'm already signed in (presumably, because it can't use the auth context from the system browser sign-in?).
2. It doesn't support the use of FIDO2 security keys.

I thought I'd open a discussion as I'm not sure if this would be a bug report or a feature request. The setting does say "Use System Browser for login", so technically it's doing as described, but I would have thought it should also encompass any other Entra dialogs.

I appreciate that there are probably workarounds (which I'll probably end up using for now), but thought it was worth raising.

[mdi-db]

Quick update... disabling Use System Browser for login and enabling Use WAM for enhanced login methods has resolved the issue for me. The sign-in and consent prompts now appear in app dialogs again rather than the system browser, but I can now use FIDO2 security keys in both. The consent dialog still requires me to sign in again, but that could just be normal and I've not noticed before.

[Micke-K]

Hello,

Thanks for reporting this, and for the update!

You're right, this was a bug. The Request Consent link ran its own sign-in request, and that request didn't check the "Use System Browser for login" setting, so it always opened the embedded window. The embedded window can't see the browser's sign-in session, which is why it asked you to sign in again, and it doesn't support FIDO2 keys or passkeys.

It's fixed on the Development branch. Request Consent now uses the same sign-in method as the login, so with "Use System Browser for login" turned on, it opens in the system browser. That means FIDO2 works, and you shouldn't have to enter your credentials again because the browser already has your session.

The fix will be in the next 3.x release. Until then, WAM is a good workaround, as you found. The consent prompt asking you to sign in again under WAM is expected: consent is a separate interactive request, so Entra prompts again even though the account is filled in for you.

Cheers!

[mdi-db]

No worries - glad it was helpful! Thanks for replying and fixing so quickly!