Skip to main content

Configure MSAL sign-in for the mobile app

Set up Microsoft Authentication Library (MSAL) sign-in so employees can access the Employee Hub mobile app through the Microsoft platform broker, such as Microsoft Authenticator or Company Portal. MSAL signs employees in with their Microsoft Entra ID (formerly Azure Active Directory, or Azure AD) accounts. Use MSAL for organizations that require Microsoft Intune or Conditional Access enrollment on mobile devices.

note

MSAL sign-in applies to the Employee Hub mobile app. SAML SSO continues to handle browser sign-in for the web Employee Hub.

Register the MSAL application in Microsoft Entra ID​

  1. In Microsoft Azure, open Microsoft Entra ID.
  2. In the left menu, select App registrations.
  3. Click New registration.
  4. Enter an app name, such as flair Hub MSAL.
  5. Click Register. Azure creates the registration and shows its Application (client) ID and Directory (tenant) ID.
  6. Copy the Application (client) ID and Directory (tenant) ID. You enter both in flair.

The application and directory IDs on the Microsoft Entra app registration overview

Add flair's redirect URIs to the app registration​

The mobile app uses a different fixed redirect URI on each platform:

PlatformRedirect URI
iOS/macOSmsauth.hr.flair.employee-hub://auth
Androidmsauth://hr.flair.employeehub/fEvcYu6H%2FUwtRD%2FgbcT9%2BPplE1A%3D
  1. In the Microsoft Entra ID app registration, open Authentication.
  2. Add msauth.hr.flair.employee-hub://auth as an iOS/macOS platform redirect URI.
  3. Add msauth://hr.flair.employeehub/fEvcYu6H%2FUwtRD%2FgbcT9%2BPplE1A%3D as an Android platform redirect URI.
  4. Click Save.

The iOS and Android redirect URIs on the Microsoft Entra Authentication page

Add the MSAL configuration to flair​

  1. In the flair HR app, open the App Launcher (⋮⋮ grid icon).
  2. Open Hub SAML Configurations.
  3. Click New.
  4. Enter a Name, such as Microsoft MSAL.
  5. Select Enabled.
  6. In Type, enter MSAL.
  7. In MSAL Client Id, enter the Application (client) ID from Microsoft Entra ID.
  8. In MSAL Tenant Id, enter the Directory (tenant) ID from Microsoft Entra ID.
  9. In MSAL Redirect URI (Android), enter msauth://hr.flair.employeehub/fEvcYu6H%2FUwtRD%2FgbcT9%2BPplE1A%3D.
  10. In MSAL Redirect URI (Ios), enter msauth.hr.flair.employee-hub://auth.
  11. Optional: If your Salesforce org runs multiple Employee Hubs, set Hub to limit this login option to one Hub. Leave Hub empty to show it on every Hub.
  12. Keep Show In Mobile selected so the button appears in the mobile app. Show In Hub controls the Employee Hub login page in the browser; both are selected by default.
  13. Click Save.

The MSAL type and redirect URI fields on a Hub SAML Configuration record

What employees see​

After employees enter your company domain in the mobile app, the sign-in screen shows a button labeled with the record's Name. Name the record Sign in with Microsoft to match the screenshot below. If MSAL is the only enabled record shown in the mobile app, the screen hides the email and password fields. To keep password sign-in available, also create an enabled Hub SAML Configuration record with Type PASSWORD and Show In Mobile selected.

If your organization also uses SAML SSO for the Employee Hub, the mobile app shows a button for each enabled record with Show In Mobile selected. To show only the Microsoft button in the app, clear Show In Mobile on the SAML record. For details, see Choose where a login option appears.

The mobile sign-in screen with the email and password fields and the Sign in with Microsoft button