Configuring Microsoft Authenticator SSO (Android)

Set up Microsoft Authenticator SSO on Android devices to streamline sign-in across Microsoft Authentication Library (MSAL) apps, such as Microsoft Teams or Outlook.

Use Microsoft Entra ID to enable Single Sign-On (SSO) on Android devices managed through SOTI MobiControl. This configuration supports SSO across apps that use Microsoft Authentication Library (MSAL) without relying on the SSO for Shared Devices feature.

Prerequisites

  • Manage Profile permissions. See General Permissions.
  • Microsoft Entra ID (formerly Azure AD) Premium 1 or higher licenses with Microsoft Conditional Access enabled.
  • A supported Microsoft license plan ( See Microsoft license plans), such as:

    • Microsoft 365 E3, E5, F1, or F3

    • Enterprise Mobility + Security (EMS) E3 or E5

      See Assign User Licenses in Microsoft Entra ID/Azure AD for instructions on assigning these licenses.
      Note: When adding a license for a user, select all services. Services may differ based on the subscription type.
Important: To perform SSO, the device must be registered in Microsoft Shared Mode. Steps one to five to register the device in Microsoft Shared Mode. Once registered, step six instructs how to activate SSO for seamless login in MSAL applications.

Workflow

  1. Assign User Licenses in Microsoft Entra ID/Azure AD

  2. Add a Microsoft Authenticator SSO Payload (Android)

  3. Connect Microsoft Entra ID for Microsoft Authenticator SSO (Android)
  4. Configure Microsoft Access Management for Microsoft Authenticator SSO (Android)
  5. Deploying the Microsoft Authenticator SSO Payload and an App Policy for Microsoft Shared Mode Device Registration (Android)
  6. Activating Microsoft Authenticator SSO for MSAL (Android) Applications