ConfidentialClientApplicationBuilder Class

Builds an instance of IConfidentialClientApplication from the parameters set in the ConfidentialClientApplicationBuilder.

Creates a ConfidentialClientApplicationBuilder from a clientID. See https://aka.ms/msal-net-application-configuration

Constructor of a ConfidentialClientApplicationBuilder from application configuration options. See https://aka.ms/msal-net-application-configuration

Adds a known Authority corresponding to an ADFS server. See https://aka.ms/msal-net-adfs

Adds a known Azure AD authority to the application to sign-in users specifying the sign-in audience (the cloud being the Azure public cloud). See https://aka.ms/msal-net-application-configuration.

Adds a known Azure AD authority to the application to sign-in users specifying the cloud instance and the sign-in audience. See https://aka.ms/msal-net-application-configuration.

Adds a known Azure AD authority to the application to sign-in users from a single organization (single tenant application) described by its cloud instance and its tenant ID. See https://aka.ms/msal-net-application-configuration.

Adds a known Azure AD authority to the application to sign-in users from a single organization (single-tenant application) described by its cloud instance and its domain name or tenant ID. See https://aka.ms/msal-net-application-configuration.

Adds a known Azure AD authority to the application to sign-in users specifying the full authority URI. See Application configuration options.

Adds a known Azure AD authority to the application to sign-in users from a single organization (single-tenant application) specified by its tenant ID. See Application configuration options.

Adds a known Azure AD authority to the application to sign-in users from a single organization (single-tenant application) described by its domain name. See https://aka.ms/msal-net-application-configuration.

Adds a known authority to the application. See Application configuration options. This constructor is mainly used for scenarios where the authority is not a standard Azure AD authority, nor an ADFS authority, nor an Azure AD B2C authority. For Azure AD, even in sovereign clouds, prefer using other overrides such as WithAuthority(AzureCloudInstance, AadAuthorityAudience, Boolean)

Instructs MSAL to use an Azure regional token service. This feature is currently available to first-party applications only.

Adds a known authority corresponding to an Azure AD B2C policy. See https://aka.ms/msal-net-b2c-specificities

Options for MSAL token caches.

MSAL maintains a token cache internally in memory. By default, this cache object is part of each instance of PublicClientApplication or ConfidentialClientApplication. This method allows customization of the in-memory token cache of MSAL.

MSAL's memory cache is different than token cache serialization. Cache serialization pulls the tokens from a cache (e.g. Redis, Cosmos, or a file on disk), where they are stored in JSON format, into MSAL's internal memory cache. Memory cache operations do not involve JSON operations.

External cache serialization remains the recommended way to handle desktop apps, web site and web APIs, as it provides persistence. These options do not currently control external cache serialization.

Detailed guidance for each application type and platform: https://aka.ms/msal-net-token-cache-serialization

When set to true, MSAL will lock cache access at the ConfidentialClientApplication level, i.e. the block of code between BeforeAccessAsync and AfterAccessAsync callbacks will be synchronized. Apps can set this flag to false to enable an optimistic cache locking strategy, which may result in better performance at the cost of cache consistency. Setting this flag to false is only recommended for apps which create a new ConfidentialClientApplication per request.

Sets the certificate associated with the application. Applicable to first-party applications only, this method also allows to specify if the x5c claim should be sent to Azure AD. Sending the x5c enables application developers to achieve easy certificate roll-over in Azure AD: this method will send the certificate chain to Azure AD along with the token request, so that Azure AD can use it to validate the subject name based on a trusted issuer policy. This saves the application admin from the need to explicitly manage the certificate rollover (either via portal or PowerShell/CLI operation). For details see https://aka.ms/msal-net-sni

Sets the certificate associated with the application.

Configures an async delegate that creates a client assertion. The delegate is invoked only when a token cannot be retrieved from the cache. See https://aka.ms/msal-net-client-assertion

Configures an async delegate that creates a client assertion. See https://aka.ms/msal-net-client-assertion

Configures a delegate that creates a client assertion. See https://aka.ms/msal-net-client-assertion

Sets the application client assertion. See https://aka.ms/msal-net-client-assertion. This will create an assertion that will be held within the client application's memory for the duration of the client. You can use WithClientAssertion(Func<String>) to set a delegate that will be executed for each authentication request. This will allow you to update the client assertion used by the client application once the assertion expires.

Microsoft Identity specific OIDC extension that allows resource challenges to be resolved without interaction. Allows configuration of one or more client capabilities, e.g. "llt"

Sets the certificate associated with the application along with the specific claims to sign. By default, this will merge the claimsToSign with the default required set of claims needed for authentication. If mergeWithDefaultClaims is set to false, you will need to provide the required default claims. See https://aka.ms/msal-net-client-assertion

Sets the certificate associated with the application along with the specific claims to sign. By default, this will merge the claimsToSign with the default required set of claims needed for authentication. If mergeWithDefaultClaims is set to false, you will need to provide the required default claims. See https://aka.ms/msal-net-client-assertion

Sets the Client ID of the application

Sets the name of the calling SDK API for telemetry purposes.

Sets the application secret

Sets the version of the calling SDK for telemetry purposes.

Sets the Debug logging callback to a default debug method which displays the level of the message and the message itself. For details see https://aka.ms/msal-net-logging

Allows usage of experimental features and APIs. If this flag is not set, experimental features will throw an exception. For details see https://aka.ms/msal-net-experimental-features

Sets Extra Query Parameters for the query string in the HTTP authentication request

Sets Extra Query Parameters for the query string in the HTTP authentication request

Call WithOidcAuthority(String) instead.

Uses a specific IMsalHttpClientFactory to communicate with the IdP. This enables advanced scenarios such as setting a proxy, or setting the Agent.

Uses a specific IMsalHttpClientFactory to communicate with the IdP. This enables advanced scenarios such as setting a proxy, or setting the Agent.

Allows developers to configure their own valid authorities. A json string similar to https://aka.ms/aad-instance-discovery should be provided. MSAL uses this information to:

• Call REST APIs on the environment specified in the preferred_network
• Identify an environment under which to save tokens and accounts in the cache
• Use the environment aliases to match tokens issued to other authorities

Lets an organization setup their own service to handle instance discovery, which enables better caching for microservice/service environments. A Uri that returns a response similar to https://aka.ms/aad-instance-discovery should be provided. MSAL uses this information to:

• Call REST APIs on the environment specified in the preferred_network
• Identify an environment under which to save tokens and accounts in the cache
• Use the environment aliases to match tokens issued to other authorities

Determines whether or not instance discovery is performed when attempting to authenticate. Setting this to false will completely disable instance discovery and authority validation. This will not affect the behavior of application configured with regional endpoints however.

Allows developers to configure their own valid authorities. A json string similar to https://aka.ms/aad-instance-discovery should be provided. MSAL uses this information to:

• Call REST APIs on the environment specified in the preferred_network
• Identify an environment under which to save tokens and accounts in the cache
• Use the environment aliases to match tokens issued to other authorities

Lets an organization setup their own service to handle instance discovery, which enables better caching for microservice/service environments. A Uri that returns a response similar to https://aka.ms/aad-instance-discovery should be provided. MSAL uses this information to:

• Call REST APIs on the environment specified in the preferred_network
• Identify an environment under which to save tokens and accounts in the cache
• Use the environment aliases to match tokens issued to other authorities

Enables legacy ADAL cache serialization and deserialization.

Sets the Identity Logger. For details see https://aka.ms/msal-net-logging

Sets the logging callback. For details see https://aka.ms/msal-net-logging

Adds a known authority corresponding to a generic OpenIdConnect Identity Provider. MSAL will append ".well-known/openid-configuration" to the authority and retrieve the OIDC metadata from there, to figure out the endpoints. See https://openid.net/specs/openid-connect-core-1_0.html#Terminology

Sets application options, which can, for instance have been read from configuration files. See https://aka.ms/msal-net-application-configuration.

Sets application options, which can, for instance have been read from configuration files. See https://aka.ms/msal-net-application-configuration.

Sets the redirect URI of the application. The URI must also be registered in the application portal. See https://aka.ms/msal-net-application-configuration

Generate telemetry aggregation events.

This method is obsolete. See https://aka.ms/msal-net-telemetry

Sets the tenant ID of the organization from which the application will let users sign-in. This is classically a GUID or a domain name. See https://aka.ms/msal-net-application-configuration. Although it is also possible to set tenantId to common, organizations, and consumers, it's recommended to use one of the overrides of WithAuthority(AzureCloudInstance, AadAuthorityAudience, Boolean).

Allows setting a callback which returns an access token, based on the passed-in parameters. MSAL will pass in its authentication parameters to the callback and it is expected that the callback will construct a AppTokenProviderResult and return it to MSAL. MSAL will cache the token response the same way it does for other authentication results.