User-based authentication for the Warehouse Management mobile app

The Warehouse Management mobile app supports two types of user-based authentication:

• Username/password authentication – The standard method for new and existing deployments. It works without any extra configuration and doesn't require a companion app.
• Device code flow authentication – A legacy method that remains available for deployments that still use it. Plan a move to username/password authentication, because Microsoft Entra ID security defaults block device code flow in new tenants.

To work out which combination of accounts and sign-in methods fits your warehouse, start with Choose an authentication approach.

Choose an authentication approach

Two decisions determine how you set up authentication. Answer them in order. The following sections give general guidance about what each combination supports. Your IT department makes the final decision, based on your organization's security policies.

1. Whose identity does the app sign in with? Use either a worker identity, where every warehouse worker has their own Microsoft Entra ID account, or a device identity, where a shared account such as device1@contoso.com represents the device itself.
2. Where is the sign-in completed? Choose either locally (on the warehouse device) or remotely (on a separate machine such as an admin's PC). Remote sign-in is typically used when devices are deployed at a site that's far from the people who hold the credentials.

The following table summarizes the four combinations.

In every combination, each warehouse worker still has a warehouse worker record with one or more mobile device user accounts in the Warehouse management module. The Microsoft Entra ID account authenticates the app with Supply Chain Management. The mobile device user account identifies the person who does the work. Learn more in Mobile device user accounts.

Worker identity, local sign-in

Example: At the Contoso Seattle distribution center, each of the 40 pickers has a Microsoft Entra ID account, such as maria@contoso.com. Handhelds are stored in a charging rack. A worker takes any device from the rack and signs in with their own credentials.

It works like this:

1. The worker signs in on the device with their Microsoft Entra ID credentials. Use whichever method suits your security requirements: username/password, QR code and PIN, or MFA.
2. If a default user ID is configured for the worker's warehouse worker record, this single sign-in authenticates the app and signs the worker in as a warehouse worker in one step.
3. Optionally, brokered authentication shares the same Microsoft Entra ID session with other apps on the device, such as Microsoft Teams or Outlook. This step is an advanced option, and it isn't required.

This combination gives you the strongest identity controls, because every action traces back to a named person, and Conditional Access policies apply to a real user.

Worker identity, remote sign-in

Example: Contoso opens a small satellite warehouse with no on-site IT staff. An administrator at headquarters completes the initial sign-in for each device before shipping the device to the site.

The same methods that are available for local sign-in also work here. You can also use device code flow. However, Microsoft no longer recommends it because it's a common target of phishing attacks. Your IT department can decide whether it's acceptable in your environment.

Because the person who enters the credentials often isn't the person who uses the device, plan for the following points:

• Prefer a method that lets the worker complete their own sign-in on the device, even when the device is configured remotely.
• Ensure that you can revoke sessions for a single account without affecting other workers.

Device identity, local sign-in

Example: Contoso mounts terminals on forklifts. Each terminal authenticates with a shared Microsoft Entra ID account, such as device1@contoso.com. Drivers then enter their own mobile device user account credentials to start work.

It works like this:

1. The admin configures the app with username/password authentication by using the device's Microsoft Entra ID account.
2. After the app is authenticated, workers sign in with their mobile device user account credentials (user ID and password).
3. When a worker signs out, the app stays authenticated with Supply Chain Management and shows the worker sign-in page for the next person.

This combination works best when many workers share a device, and when you don't want to create a Microsoft Entra ID account for every worker. Be aware of the following limitations:

• Conditional Access policies are harder to apply in a meaningful way. The signed-in identity is a device, not a person, so policies that evaluate user risk or per-user MFA don't produce useful results.
• Supply Chain Management attributes app authentication to the device account. Worker-level traceability comes from the mobile device user account instead.
• Give the device account only the permissions that warehouse mobile device work requires. Learn more in Mobile device user accounts.

Device identity, remote sign-in

Example: Contoso ships preconfigured terminals to a third-party logistics provider. An administrator at headquarters authenticates each device before it leaves.

This combination behaves like worker identity with remote sign-in, but the risk is higher because many people use a single shared account and the device is out of your physical control.

Take the following precautions:

• Use username/password authentication, ideally with MFA. Device code flow isn't recommended for this combination, but whether it's acceptable is a decision for your IT department to make, based on your security policies.
• Use a separate Microsoft Entra ID account for each device, rather than one account for all devices. You can then disable or revoke sessions for a single lost device without disrupting the rest of the fleet.
• Keep the device account's permissions strictly limited to warehouse mobile device work.

Licensing considerations

The Warehouse Management mobile app doesn't introduce its own identity licensing requirements. It requires only that your organization has a Microsoft Entra ID identity provider, and standard Microsoft Entra licensing terms apply.

Features that you layer on top of sign-in have their own licensing requirements. Check the requirements for each feature that you plan to use:

• Conditional Access – See What is Conditional Access?.
• QR code and PIN sign-in – See Prerequisites to enable the QR code authentication method.
• Microsoft Entra ID plans in general – See Microsoft Entra licensing.

Confirm your specific entitlements with your licensing contact and the Dynamics 365 Licensing Guide. This article doesn't replace either. Learn more in Microsoft Product Terms.

Username/password authentication

The Username and password option uses standard interactive Microsoft Entra ID authentication for the account associated either with the device or with the worker (depending on the approach you choose). Workers might also need to enter a mobile device user account ID and password, depending on their warehouse worker record setup.

Microsoft recommends username/password authentication for all new and existing deployments. It works without any configuration: the app signs workers in through the system browser or a native web view, and it doesn't need Microsoft Authenticator, Intune Company Portal, or any other companion app. Most frontline deployments need nothing more than this.

If you later want single sign-on or Conditional Access policies that depend on device signals, see Advanced: brokered authentication and single sign-on.

Despite its name, the Username and password option also supports interactive sign-in methods that don't use a user name and password. One of them is QR code and PIN sign-in, which is available only on Android and iOS/iPadOS, not Windows. It lets workers sign in quickly on shared devices by scanning a QR code and entering a PIN instead of typing a full username and password every time. This flow works without Microsoft Authenticator or Intune Company Portal. Learn more about how to enable and use this sign-in method in QR code and PIN sign-in for the Warehouse Management mobile app.

Use a custom application registration

By default, the app uses a global application that's provided and maintained by Microsoft, and no application registration is required.

You need to register your own application in Microsoft Entra ID only if you connect to an on-premises environment, connect to a cloud other than Azure Global, or have specific requirements that the global application doesn't meet. For the procedure, see Create a custom application registration for the Warehouse Management mobile app.

Set up employee, user, and warehouse worker records in Supply Chain Management

Before workers can sign in by using the mobile app, each Microsoft Entra ID account that you assign to the enterprise app in Azure must have a corresponding employee record, user record, and warehouse worker record in Supply Chain Management. For information about how to set up these records, see Mobile device user accounts.

Advanced: brokered authentication and single sign-on

Brokered authentication is an advanced capability. You don't have to use it. The app signs workers in through the system browser or a native web view, and it doesn't need Microsoft Authenticator, Intune Company Portal, or any other companion app.

Consider it only if you want one of the following things:

• Single sign-on (SSO) – Workers sign in to the app without entering a password, because the app reuses credentials from another app on the device.
• Conditional Access policies that depend on device signals – For example, a policy that requires a compliant or managed device. A broker supplies those signals.

If you don't need either, you can ignore brokered authentication entirely.

If you already use brokered authentication, keep it. Nothing about it is deprecated, and no change is required. It's described as advanced because it's optional, not because it's going away.

For the concepts, requirements, and setup steps, see Brokered authentication and Conditional Access.

Device registration requirements

The Warehouse Management mobile app works on a device in any Microsoft Entra ID registration state. You can sign in on all of the following types of devices:

• Microsoft Entra ID joined devices
• Microsoft Entra ID registered devices
• Devices that aren't joined
• Devices that aren't registered at all, including a device that's new and has never been registered

You don't have to join or register a device before workers can sign in.

Two things can still introduce a registration requirement, and neither comes from the app itself:

• Your Conditional Access policies. If a policy requires a specific device state or compliance status, that requirement comes from your policy. Learn more in Brokered authentication and Conditional Access.
• Brokered authentication. A broker passes device signals to Microsoft Entra ID by using a device-bound token, so it works with a registered device. The broker can perform the registration itself during the first sign-in, so this requirement usually isn't something that you set up in advance.

Learn more in What is device identity in Microsoft Entra ID?.

Remove access for a device that uses user-based authentication

If a device is lost or compromised, revoke its access to Supply Chain Management immediately. Disabling the associated Microsoft Entra ID user account revokes access for all devices that use that account. This limitation is why you should use a separate account for each device or each worker, as described in Choose an authentication approach. It lets you isolate and revoke access for a single device without affecting others.

To revoke access, follow these steps:

1. Sign in to the Azure portal.
2. On the left navigation pane, select Microsoft Entra ID, and ensure that you're in the correct directory.
3. In the Manage list, select Users.
4. Find the user account that's associated with the device or worker, and select the name to open the user's profile.
5. On the toolbar, select Revoke sessions to revoke the user account's sessions.

Device code flow authentication (not recommended)

Device code flow is a two-step sign-in method that was originally designed for devices that don't provide a web browser. Microsoft doesn't recommend it for the Warehouse Management mobile app for the following reasons:

• It's a frequent target of phishing attacks – A threat actor can ask a victim to sign in with a device code that the attacker generated, and then use the resulting token to access the victim's account from the attacker's own device. Microsoft Entra ID has no reliable way to verify that the person who enters the code is signing in from the device that generated it.
• It's blocked by default in new tenants – Starting July 1, 2026, Microsoft Entra ID security default settings block device code flow on new tenants. This behavior commonly affects new tenants that are created for testing purposes. If you create a new tenant to test the Warehouse Management mobile app, expect device code flow to be blocked by default. Existing tenants aren't automatically affected unless they already have security defaults enabled.
• It isn't available everywhere – Device code flow isn't supported on iOS, and it isn't supported for Android devices that connect to on-premises environments.
• It doesn't support SSO – It can't be combined with brokered authentication.

If your environment still depends on device code flow (for example, because you use test scripts or workflows that aren't updated yet), an admin can unblock it for the tenant by disabling security defaults. Because security defaults protect the whole tenant, treat this change as a temporary step while you update your setup to use username/password authentication. For more information, see Microsoft Entra ID security defaults.

How device code flow works

When you use device code authentication, the Warehouse Management mobile app generates and shows a unique device code. The admin who sets up the device enters this device code into an online form, along with the credentials (name and password) for a Microsoft Entra ID user account. This account can represent either the device itself or the human worker who signs in, depending on how the admin implements the system. In some cases, depending on how the Microsoft Entra ID user account is configured, the admin might also have to approve the sign-in. In addition to the unique device code, the mobile app shows the URL where the admin must enter the code and the credentials for the Microsoft Entra ID user account.

Requirements and restrictions

If you must temporarily continue to use device code authentication, be aware of the following extra requirements and restrictions:

• Create a unique Microsoft Entra ID user account for each device or human worker. In addition, strictly limit these accounts so that they can perform only warehouse mobile device user activities.
• While a worker is signing in by using the Warehouse Management mobile app, the app shows a generated device code. This code expires after 15 minutes and is then hidden by the app. If the code expires before sign-in is completed, the worker must generate a new code by selecting Connect again in the app.
• How long a device stays authenticated is controlled by your Microsoft Entra ID token lifetime and Conditional Access policies, not by the app. When the tokens for a device expire or are revoked, the device must be authenticated again. Learn more in Refresh tokens in the Microsoft identity platform.
• Single sign-on (SSO) isn't supported when you use device code flow authentication together with a mobile mass deployment (MDM) system (such as Intune) to distribute the Warehouse Management mobile app. You can still use an MDM system to deliver the app to each mobile device and deliver a connections.json file that sets up connections using device code. The only difference is that workers must manually sign in when they start to use the app. (This step is required only once.)

Move from device code flow to username/password authentication

To move an existing deployment away from device code flow, follow these steps:

1. Confirm that the Microsoft Entra ID accounts that the devices use can sign in with a username and password. If you use the global application that Microsoft provides, nothing else is required. If you use a custom application registration, also confirm that it allows public client flows.
2. Optional: If you want SSO, enable brokered authentication. On Android and iOS, that requires a broker app on the device.
3. Update your connection settings to specify "ConnectionType": "UsernamePassword" (and, when you use a broker, "UseBroker": true). Then redistribute them through your MDM provider, a connections.json file, or a QR code. Learn more in Connection settings reference and Choose how to distribute connection settings.
4. Sign in one time on each device to complete the authentication with the new method.

Related information

• User-based authentication FAQ
• Brokered authentication and Conditional Access
• Create a custom application registration
• Install the Warehouse Management mobile app