Skip to main content

Configure MSAL sign-in for the mobile app

Set up Microsoft Authentication Library (MSAL) sign-in so employees can access the Employee Hub mobile app through the Microsoft platform broker, such as Microsoft Authenticator or Company Portal. Use MSAL for organizations that require Microsoft Intune or Conditional Access enrollment on mobile devices.

note

MSAL sign-in applies to the Employee Hub mobile app. SAML SSO continues to handle browser sign-in for the web Employee Hub.

Register the MSAL application in Microsoft Entra ID​

  1. In Microsoft Azure, open Microsoft Entra ID.
  2. In the left menu, select App registrations.
  3. Click New registration.
  4. Enter an app name, such as flair Hub MSAL.
  5. Click Register. Azure creates the registration and shows its Application (client) ID and Directory (tenant) ID.
  6. Copy the Application (client) ID and Directory (tenant) ID. You enter both in flair.

The application and directory IDs on the Microsoft Entra app registration overview

Add flair's redirect URIs to the app registration​

The mobile app uses a different fixed redirect URI on each platform:

PlatformRedirect URI
iOS/macOSmsauth.hr.flair.employee-hub://auth
Androidmsauth://hr.flair.employeehub/fEvcYu6H%2FUwtRD%2FgbcT9%2BPplE1A%3D
  1. In the Microsoft Entra ID app registration, open Authentication.
  2. Add msauth.hr.flair.employee-hub://auth as an iOS/macOS platform redirect URI.
  3. Add msauth://hr.flair.employeehub/fEvcYu6H%2FUwtRD%2FgbcT9%2BPplE1A%3D as an Android platform redirect URI.
  4. Click Save.

The iOS and Android redirect URIs on the Microsoft Entra Authentication page

Add the MSAL configuration to flair​

  1. In the flair HR app, open the App Launcher (⋮⋮ grid icon).
  2. Open Hub SAML Configurations.
  3. Click New.
  4. Enter a Name, such as Microsoft MSAL.
  5. Select Enabled.
  6. In Type, enter MSAL.
  7. In MSAL Client Id, enter the Application (client) ID from Microsoft Entra ID.
  8. In MSAL Tenant Id, enter the Directory (tenant) ID from Microsoft Entra ID.
  9. In MSAL Redirect URI (Android), enter msauth://hr.flair.employeehub/fEvcYu6H%2FUwtRD%2FgbcT9%2BPplE1A%3D.
  10. In MSAL Redirect URI (Ios), enter msauth.hr.flair.employee-hub://auth.
  11. Optional: If your Salesforce org runs multiple Employee Hubs, set Hub to limit this login option to one Hub. Leave Hub empty to show it on every Hub.
  12. Click Save.

The MSAL type and redirect URI fields on a Hub SAML Configuration record