Problem with MAUI and Entra Login

Question

Problem with MAUI and Entra Login

Jai Holloway 115

Hi there

I have downloaded the PublicSingletonClient to use for logging into our Azure platform for a MAUI app that we rewrote from Xamarin.

The app was working fine, but all of a sudden I am having problems. It fails to interactively login if you are already logged in. It goes through the login process for silent, then goes to the interactive bit and fails. It gives different MAUI errors each time it fails, but it's the login that's failing. I don't know how to get around this problem and the app now doesn't work at all. I need help please.

public async Task<string> SignInUserAndAcquireAccessToken(string[] scopes)
{
    Exception<NullReferenceException>.ThrowOn(() => this.PublicClientApplication == null, PCANotInitializedExceptionMessage);

    var existingUser = await FetchSignedInUserFromCache().ConfigureAwait(false);

    try
    {
        // 1. Try to sign-in the previously signed-in account
        if (existingUser != null)
        {
                    
            this.AuthResult = await this.PublicClientApplication
                .AcquireTokenSilent(scopes, existingUser)
                .ExecuteAsync()
                .ConfigureAwait(false);
        }
        else
        {
            if (this.IsBrokerInitialized)
            {
                Console.WriteLine("No accounts found in the cache. Trying Window's default account.");

                this.AuthResult = await this.PublicClientApplication
                    .AcquireTokenSilent(scopes, Microsoft.Identity.Client.PublicClientApplication.OperatingSystemAccount)
                    .ExecuteAsync()
                    .ConfigureAwait(false);
            }
            else
            {
                this.AuthResult = await SignInUserInteractivelyAsync(scopes);
            }
        }
    }
    catch (MsalUiRequiredException ex)
    {
        // A MsalUiRequiredException happened on AcquireTokenSilentAsync. This indicates you need to call AcquireTokenInteractive to acquire a token interactively
        Debug.WriteLine($"MsalUiRequiredException: {ex.Message}");
        this.AuthResult = await this.SignInUserInteractivelyAsync(scopes);
    }
    catch (MsalException msalEx)
    {
        Debug.WriteLine($"Error Acquiring Token interactively:{Environment.NewLine}{msalEx}");
        throw msalEx;
    }

    return this.AuthResult.AccessToken;
}

        public async Task<AuthenticationResult> SignInUserInteractivelyAsync(string[] scopes, IAccount existingAccount = null)
        {
            Exception<NullReferenceException>.ThrowOn(() => this.PublicClientApplication == null, PCANotInitializedExceptionMessage);

            if (this.PublicClientApplication == null)
                throw new NullReferenceException();

            // If the operating system has UI
            if (this.PublicClientApplication.IsUserInteractive())
            {

                if (PublicClientSingleton.Instance.UseEmbedded)
                {
#if ANDROID
                    return await this.PublicClientApplication.AcquireTokenInteractive(scopes)
						.WithLoginHint(existingAccount?.Username ?? String.Empty)
						.WithUseEmbeddedWebView(true)
						.WithParentActivityOrWindow(Platform.CurrentActivity)
						.ExecuteAsync()
						.ConfigureAwait(false);
#else
					return await this.PublicClientApplication.AcquireTokenInteractive(scopes)
                        .WithLoginHint(existingAccount?.Username ?? String.Empty)
                        .WithUseEmbeddedWebView(true)
                        .WithParentActivityOrWindow(new MainPage(new TourGrosses.ViewModels.MainPageViewModel(new TourGrosses.Services.ApiService())))
                        .ExecuteAsync()
                        .ConfigureAwait(false);
#endif
                }
                else
                {
                    SystemWebViewOptions systemWebViewOptions = new SystemWebViewOptions();
#if IOS
                    // Hide the privacy prompt in iOS
                    systemWebViewOptions.iOSHidePrivacyPrompt = true;
#endif
                    return await this.PublicClientApplication.AcquireTokenInteractive(scopes)
                        .WithLoginHint(existingAccount?.Username ?? String.Empty)
                        .WithSystemWebViewOptions(systemWebViewOptions)
                        .WithParentActivityOrWindow(PlatformConfig.Instance.ParentWindow)
                        .ExecuteAsync()
                        .ConfigureAwait(false);
                }
            }

            // If the operating system does not have UI (e.g. SSH into Linux), you can fallback to device code, however this
            // flow will not satisfy the "device is managed" CA policy.
            return await this.PublicClientApplication.AcquireTokenWithDeviceCode(scopes, (dcr) =>
            {
                Console.WriteLine(dcr.Message);
                return Task.CompletedTask;
            }).ExecuteAsync().ConfigureAwait(false);
        }

0 comments

3 answers

Your answer

Answer 1

The failure pattern matches the silent-first flow reaching interactive sign-in, which is expected when AcquireTokenSilent throws MsalUiRequiredException. That exception means interactive authentication is required because the cache cannot satisfy the request or extra user interaction is needed.

For a .NET MAUI app, the most important fixes are:

Keep the silent-first pattern The AcquireTokenSilent call should stay first, and MsalUiRequiredException should fall back to AcquireTokenInteractive. That part of the flow is correct.
On Android, always pass the current activity to interactive sign-in AcquireTokenInteractive must use:
```
   .WithParentActivityOrWindow(Platform.CurrentActivity)
```
Omitting the Android parent activity causes a runtime crash because MSAL cannot find a parent window for the sign-in UI.
Ensure Platform.CurrentActivity is initialized In MainActivity.OnCreate, Platform.Init(this, savedInstanceState) must be called so Platform.CurrentActivity is set correctly before interactive sign-in runs.
Do not create a new page just to supply a parent window This code is a likely problem:
```
   .WithParentActivityOrWindow(new MainPage(...))
```
The parent window should be the platform window/activity configured by the app, not a newly created MAUI page instance. Use the platform-specific parent window that is initialized during app startup.
For Android, verify the redirect URI and activity wiring The app registration must include an Android redirect URI in this format:
```
   msal{ClientId}://auth
```
The Android activity handling the auth callback must use the same scheme and auth host in its intent filter.
Set the Android parent window during startup In the MAUI Android setup, the current activity should be assigned as the parent window for authentication operations during MainActivity.OnCreate.

A safer shape for the interactive call is:

return await this.PublicClientApplication
    .AcquireTokenInteractive(scopes)
    .WithLoginHint(existingAccount?.Username ?? string.Empty)
#if ANDROID
    .WithParentActivityOrWindow(Platform.CurrentActivity)
#endif
    .ExecuteAsync();

If embedded web view is required, keep it, but still use the correct parent activity/window.

Also note:

If AcquireTokenSilent() fails with MsalUiRequiredException, that does not mean the app is broken by itself. It means the app must continue with interactive sign-in.
If the app is failing only when a user was previously signed in, the issue is more likely the interactive UI host/window setup than the silent token call.

Recommended checks in order:

In Platforms/Android/MainActivity.cs, confirm Platform.Init(this, savedInstanceState) is called.
Confirm interactive Android sign-in uses .WithParentActivityOrWindow(Platform.CurrentActivity).
Remove any use of new MainPage(...) as the parent window.
Confirm the app registration redirect URI exactly matches msal{ClientId}://auth.
Confirm the Android auth callback activity intent filter uses the same client ID-based scheme and auth host.
Keep AcquireTokenSilent first, and only fall back to interactive on MsalUiRequiredException.

One code issue should also be corrected:

catch (MsalException msalEx)
{
    Debug.WriteLine($"Error Acquiring Token interactively:{Environment.NewLine}{msalEx}");
    throw;
}

Using throw; preserves the original stack trace.

Answer 2

Jai Holloway 115

The correct Enttitlements have been selected. As a note, this used to work. I was on leave for 2 weeks and it stopped working about a week before I went on leave. I actually have a working version on my phone, but I need to install it on another users phone and I can't get it to work.

Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-16T11:04:39.9466667+00:00
Thanks for your question.

Since the app works on your phone, your device likely still has a cached token and is using the Silent Login. The new user's phone has an empty cache, which forces it to use the Interactive Login. This confirms the issue is specifically with the interactive popup on a physical iOS device.

Because your code uses the System Webview on iOS, it opens Safari to log in. When the login finishes, Safari needs a "return address" to send the data back to your app. If this is missing or was accidentally changed before your leave, the login will fail.

Please check these two essential iOS configurations:

Ensure your Info.plist has the correct redirect URL registered. It should look like msal[YOUR_CLIENT_ID].

Your AppDelegate.cs must contain this code so the app can receive the message back from Safari:

public override bool OpenUrl(UIApplication app, NSUrl url, NSDictionary options) { AuthenticationContinuationHelper.SetAuthenticationContinuationEventArgs(url); return true; }
Jai Holloway 115 Reputation points

2026-07-16T11:44:52.81+00:00

This did not solve the problem
Jai Holloway 115 Reputation points

2026-07-16T11:45:21.2666667+00:00

And it no longer works on my phone. It works in the simulator
Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-17T09:36:27.42+00:00
Thanks for your update.

Since the app now crashes immediately on launch on the physical device, this suggests the issue may no longer be with the MSAL sign-in logic, but rather with the iOS device provisioning, signing, or capability configuration. The simulator does not enforce these checks, which is likely why it works there but not on a real device. The timing you mentioned also aligns with a provisioning profile expiration or capability change.

Please check the following, in this order:

Retrieve the device crash log by connecting the iphone to a Mac, then open Xcode → Window → Devices and Simulators → View Device Logs, locate the crash for your app, and review the top of the stack trace.

Verify the provisioning profile in the Apple Developer Portal. If it has expired or was regenerated recently, download the updated profile and re-select it in your project.

Please perform a clean rebuild by deleting the bin/ and obj/ folders, uninstall the app from the device, then rebuild and redeploy.

Please check whether this works on your end and let me know. I'm happy to assist further if any issues remain.

Thank you.

Answer 3

Nancy Vo (WICLOUD CORPORATION) 7,985 Microsoft External Staff Moderator

Hello @Jai Holloway ,

Thanks for your question.

In your SignInUserInteractivelyAsync method, you have this line: .WithParentActivityOrWindow(new MainPage(...)).

You may want to avoid using new MainPage() here. That creates a brand-new, invisible screen in the background. The Microsoft login popup needs to attach to the actual, active screen the user is currently looking at. Because it tries to attach to an invisible screen, the app gets confused and crashes.

Also, when your silent login fails, it drops down to the catch (MsalUiRequiredException ex) block, but you are not passing the existingUser into the interactive method. This means the app forgets who is trying to log in.

You can refer to these following steps:

In your catch block, please make sure to pass the user context:

catch (MsalUiRequiredException ex)
{
    Debug.WriteLine($"MsalUiRequiredException: {ex.Message}");
    this.AuthResult = await this.SignInUserInteractivelyAsync(scopes, existingUser);
}

In your SignInUserInteractivelyAsync method, please do not create a new page. Point it to the actual active window:

#else
return await this.PublicClientApplication.AcquireTokenInteractive(scopes)
    .WithLoginHint(existingAccount?.Username ?? String.Empty)
    .WithUseEmbeddedWebView(true)
    .WithParentActivityOrWindow(PlatformConfig.Instance.ParentWindow)
    .ExecuteAsync()
    .ConfigureAwait(false);
#endif

Please check and let me know how it goes. If you encounter any issues, I'll be happy to assist further.

I hope this addresses your question. If this response was helpful, please consider following the guidance to provide feedback. Thank you.

Jai Holloway 115 Reputation points

2026-07-15T10:03:16.68+00:00

Hi, thanks for your answer.

I have already changed the WithParentActivityOrWindow(PlatformConfig.Instance.ParentWindow). This now works in the simulator, but doesn't work on a device. This is iOS only. I don't understand why it works on one but not the other
Jai Holloway 115 Reputation points

2026-07-15T10:35:40.6433333+00:00

I don't know what happened to my comment.

I had already changed it to ParentWindow, as suggested by the AI answer. This made some difference. It works consistently in the simulator now, no more crashes. Problem is it doesn't work on the device. It launches and immediately crashes. No message, nothing. Just crashes. I can't understand why it works in the simulator but not on the device.
Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-15T11:00:39.5733333+00:00
Hi @Jai Holloway

Thanks for the update.

The reason your login works on the iOS Simulator but fails on a real physical device comes down to Apple's security rules for the Keychain.

The iOS Simulator has relaxed security and lets your app save the login token automatically. However, a real physical device is very strict. It blocks the app from saving the token unless you explicitly add a specific permission to your project.

You can refer to these following steps:

Open your Platforms/iOS/Entitlements.plist file.

Add the Keychain Sharing permission and set the group to com.microsoft.adalcache.

If you are looking at the raw XML code of that file, it should look exactly like this:

<key>keychain-access-groups</key> <array> <string>$(AppIdentifierPrefix)com.microsoft.adalcache</string> </array>

Finally, go to your project properties (under iOS Bundle Signing) and make sure Custom Entitlements is actually pointing to this Entitlements.plist file when you build the app for a physical device.

Hope this helps.
Jai Holloway 115 Reputation points

2026-07-15T11:37:37.6266667+00:00

Somehow your response is not showing in this form. I have an Entitlements file, it is correctly configured and it has the Keychain Access entitlement. This is not the problem. I have had to revert to a previous version of the app for now. The problem is, I need to install this on another users phone and I can't until I fix the crash. Like I said, it works in the simulator.
Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-16T03:45:06.88+00:00

Have you also enabled Keychain Sharing in your Apple Developer account online?

For a physical iPhone to accept this, you must log into the Apple Developer Portal, find your App ID, and turn on the Keychain Sharing capability. The simulator ignores this online check.

Please check if your App ID on the Apple portal has this enabled, update your provisioning profile if needed, and let me know how it goes. Thank you.
Jai Holloway 115 Reputation points

2026-07-17T10:34:19.5266667+00:00

It's not the provisioning profile. An older release of the app works on my phone, but it is buggy. This just suddenly started happening. I have updated the nuget packages to make sure it wasn't that, it still doesn't work. I really don't know what the problem. I have an abort code 6, with no details when I attached it to my mac and checked the logs.
Jai Holloway 115 Reputation points

2026-07-17T10:35:51.27+00:00

It's not the provisioning. A prior release of the app works on my phone. It suddenly started happening. I have updated all the nuget packages to ensure that wasn't the cause, still not working. I got an abort code 6 when I checked the log file on a mac. No detail.
Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-17T11:04:06.4033333+00:00
Hi @Jai Holloway ,

The SIGABRT (abort code 6) may indicate that the application is terminating due to an unhandled exception during startup rather than a provisioning or signing issue. Since an older build continues to run on the device, that observation could suggest signing is not the primary factor.

One possibility worth investigating is iOS Release linking/trimming behavior. In some cases, types used through reflection (including those used by MSAL) may be removed during the Release build process, which can result in startup failures on physical devices while the simulator continues to work as expected.

Please try these following steps:

Add the following to MauiProgram.CreateMauiApp():

AppDomain.CurrentDomain.UnhandledException += (s, e) =>2 System.Diagnostics.Debug.WriteLine($"UNHANDLED: {e.ExceptionObject}");

Then deploy to the device with the debugger attached and review the Output window for any exception details logged before the crash.

In your .csproj:

<PropertyGroup Condition="'$(TargetFramework)'=='net10.0-ios' and '$(Configuration)'=='Release'"> <MtouchLink>None</MtouchLink> <PublishTrimmed>false</PublishTrimmed> </PropertyGroup>

If the application launches after this change, it may indicate that trimming or linking is contributing to the issue.

If there were any recent updates to Microsoft.Identity.Client or Microsoft.Maui.\* packages, comparing them with the versions used in the last known working build may help isolate the cause.

If the issue persists, please share any exception details captured from step 1, as they may provide additional insight into the startup failure. Thanks so much for your patience.
Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-21T02:10:10.3933333+00:00

Hi,

I wonder if there is any update on this post. If you have any question, feel free to reach out. I'm happy to support you.
Jai Holloway 115 Reputation points

2026-07-22T06:38:02.4833333+00:00

It still isn't working. Like I said, it works in the simulator but doesn't work on the device and it's iOS only. A previous build works, but it has bugs that need correcting. Also, I need to install this on another users phone
Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-22T08:05:13.7466667+00:00

Could you please collect and share the relevant logs or any error messages you encounter? This information will help me investigate the issue more effectively and identify the root cause. I look forward to your update.

Again, thanks for your patience.
Jai Holloway 115 Reputation points

2026-07-22T08:07:21.0466667+00:00

I am actually busy with the logs at the moment. All I get is a standard Abort Code 6 abort log. I have put log lines in the code, but they don't seem to be coming up in the logs. I don't know how to get a log file with actual printed log lines in it
Jai Holloway 115 Reputation points

2026-07-22T09:56:38.6633333+00:00

It works now. I deleted the bin/obj folders and that got it working
Nancy Vo (WICLOUD CORPORATION) 7,985 Reputation points Microsoft External Staff Moderator

2026-07-22T10:08:55.6233333+00:00

I'm glad to hear the issue has been resolved.

As mentioned in my previous response, performing a clean rebuild by deleting the bin and obj folders and then rebuilding the project was one of the recommended troubleshooting steps.

Thank you for taking the time to share the outcome. This information may also be helpful for others who encounter a similar problem where the application behaves differently on a physical device than in the simulator.

If any part of my explanation helped address your question, I would greatly appreciate it if you could follow the instructions here. This can also help other community members facing similar scenarios.

Thanks so much for your time.