Brokered authentication and Conditional Access for the Warehouse Management mobile app

The Warehouse Management mobile app supports brokered authentication, a sign-in method where an OS-level identity broker, such as Microsoft Authenticator or Intune Company Portal, handles authentication and token management on behalf of the app. When you use brokered authentication, the broker provides Microsoft Entra ID with device identity, compliance status, and security signals during every authentication request.

Brokered authentication isn't a separate authentication method. It's an option of username/password authentication that does two things: it enables single sign-on (SSO), and it makes the app compatible with Microsoft Entra Conditional Access policies that depend on device signals. This article covers both. Use it as the single reference for brokered authentication, whether or not you use Conditional Access.

Microsoft Entra Conditional Access is an optional policy engine that controls access based on conditions such as user identity, device compliance, location, and risk level. It isn't required to run the Warehouse Management mobile app.

This article explains how to enable brokered authentication on the Warehouse Management mobile app so that your organization can enforce Conditional Access policies.

How brokered authentication works

When you use brokered authentication, the following flow occurs during sign-in:

1. The Warehouse Management mobile app delegates authentication to the broker app (Microsoft Authenticator or Intune Company Portal) installed on the device.
2. The broker validates the app's identity and retrieves the device's primary refresh token (PRT), which is a device-bound token that carries device identity and compliance claims.
3. The broker sends the authentication request to Microsoft Entra ID, including the device signals.
4. Microsoft Entra ID evaluates any Conditional Access policies that apply to the user, device, or app, and either grants or denies access.
5. If access is granted, the broker returns the authentication token to the Warehouse Management mobile app.

This process enables features such as single sign-on (SSO) across apps, MFA enforcement, and device-bound token protection—all without requiring the Warehouse Management mobile app to manage these security concerns directly.

Device requirements

To use brokered authentication, your device must meet the following requirements:

• You must be running Warehouse Management mobile app version 4.0.28 or later.
• Your device must be running a supported version of Windows, Android, or iOS.
• The device must be registered with Microsoft Entra ID. The broker can perform this registration (Workplace Join) as part of the first sign-in, so it isn't necessarily something that you set up in advance. The app itself doesn't require any particular registration state. Learn more in Device registration requirements.
• A broker app must be installed on the device (see the following table). If no broker is installed, the app falls back to browser-based sign-in, and device signals aren't available to Conditional Access.

Set up Microsoft Authenticator (Android and iOS)

Follow these steps to set up Microsoft Authenticator. The procedure is the same for both Android and iOS.

1. Install Microsoft Authenticator from the device's app store (Google Play for Android, App Store for iOS).
2. Open the app and select the Menu button.
3. Select Settings.
4. Select Device registration.
5. Enter your email or organizational account.
6. Select Register device.

App registration

Brokered authentication works with the global Microsoft Entra ID application—you don't need a manual app registration. We recommend the global application because it's simpler to set up and maintain.

The global application is provided as a Microsoft first-party application (FPA) and is available on the Azure commercial cloud. If your environment is deployed on a US government cloud—such as US Government Community Cloud (GCC) or GCC High—the global application isn't available, and you must use a manual app registration instead.

If you already use a manual app registration for other reasons (such as on-premises environment requirements or a government cloud deployment), it also works with brokered authentication. Learn more in Create a custom application registration.

Configure devices to use brokered authentication

When you use the global application, the "UseBroker" setting defaults to true on all platforms, so the app tries to use a broker without extra configuration. A broker still has to be present on the device for brokered authentication to take effect. You can configure devices manually through the app UI or automatically by distributing a JSON file via QR code or MDM.

If you don't want to use brokered authentication, set the Brokered authentication option to No on the Edit connection page (or set "UseBroker": false in the JSON configuration). If the device doesn't have Microsoft Authenticator installed, the app falls back to a standard username and password connection.

Configure the connection manually

To manually set up a connection, follow these steps on each device:

1. Open the Warehouse Management mobile app and open the Edit connection page by doing one of the following steps:

   • If your device doesn't yet have any defined connections, select Connect to create a new one.
   • To edit an existing connection, select Tap to change, choose the target connection, and then select Edit connection settings.
   • To add a new connection, select Set up connection and then select Input manually.

2. Make the following settings on the Edit connection page:

   • Authentication method – Set to Username and Password.
   • Cloud – Set to Azure Global (recommended). If you use a custom app registration, set this field to Manual and provide the Microsoft Entra ID client ID value.

   Configure all the other settings as described in Manually configure the application.

3. Select Save.

4. Sign in with the worker's Microsoft Entra credentials.

Configure the connection by using a connection setup QR code or MDM system

To distribute connection settings through a connection setup QR code or MDM system, create a connection configuration JSON file that contains the connection details. Learn more in Connection settings reference.

A connection setup QR code imports connection settings. It isn't the same as a sign-in QR code. Learn more in QR code and PIN sign-in for the Warehouse Management mobile app.

For all platforms, the connection must use username/password authentication, which you specify as follows in the connection configuration JSON file:

• "ConnectionType": "UsernamePassword"

When you use the global application ("AuthCloud": "AzureGlobal"), brokered authentication is enabled by default, so you don't have to set "UseBroker" explicitly.

The following example shows a JSON configuration that uses the global application with brokered authentication enabled:

{
    "ConnectionList": [
        {
            "ConnectionName": "Connection1",
            "ActiveDirectoryResource": "https://yourenvironment.cloudax.dynamics.com",
            "Company": "USMF",
            "ConnectionType": "UsernamePassword",
            "AuthCloud": "AzureGlobal"
        }
    ]
}

Learn more about distributing the JSON file to your devices in Import connection settings from a QR code and Mass deploy the mobile app with user-based authentication.

Conditional Access policy configuration

After you enable brokered authentication on your devices, your organization's IT administrators decide which Conditional Access policies to apply and configure them in the Microsoft Entra admin center. The following examples show the kinds of policies that organizations commonly apply. They're examples only, not recommendations, and the choice depends on your organization's security requirements:

• Require MFA – Require multifactor authentication for all users or specific groups.
• Require compliant device – Block access from devices that don't meet your organization's compliance requirements.
• Location-based access – Restrict access to specific network locations or IP ranges.
• Risk-based access – Block or challenge sign-ins that Microsoft Entra ID detects as risky.

The Warehouse Management mobile app doesn't need any extra configuration to work with these policies, and it has no settings that override them. When you use brokered authentication, the broker passes the required device and user signals to Microsoft Entra ID, which evaluates the policies and grants or denies access accordingly. If a sign-in is blocked, the policy evaluation occurred in Microsoft Entra ID, so your IT administrators must review the policy and the sign-in logs there.

For more information, see the Microsoft Entra Conditional Access documentation.

Related information

• Microsoft Entra Conditional Access overview
• Install and configure the Warehouse Management mobile app
• User-based authentication for the Warehouse app
• Mass deploy the mobile app with user-based authentication
• User-based authentication FAQ