Edit

User-based authentication FAQ

This article answers frequently asked questions about user-based authentication for the Warehouse Management mobile app.

Where can I learn more about user-based authentication?

For more information about user-based authentication, read the following articles:

Why did Microsoft deprecate service-based authentication for the Warehouse Management mobile app?

User-based authentication offers the following advantages over service-based authentication for the Warehouse Management mobile app:

  • It's easier to configure and use.
  • It's more secure in contexts where the Warehouse Management mobile app is used.
  • It provides more robust security and more configuration options in Microsoft Entra ID.
  • It enables single sign-on (SSO) authentication across apps on the same device.

Is service-based authentication deprecated everywhere?

No. Service-based authentication is deprecated only for the Warehouse Management mobile app. Other applications continue to support it.

Which authentication method should I use?

Use username/password authentication for all new and existing deployments. It works on all supported platforms, supports mass deployment, and needs no companion app on the device. If you want single sign-on (SSO) or Conditional Access policies that depend on device signals, add brokered authentication, which is an advanced option. Microsoft Entra ID QR code and PIN sign-in currently requires browser-based authentication, so it can't be combined with brokered authentication yet.

Device code flow is still accepted for backward compatibility, but it's no longer recommended. Learn more in What is device code flow, and why is it no longer recommended? later in this article.

Does importing a connection setup QR code sign in the worker?

No. A connection setup QR code contains connection settings in JSON format and is scanned by going to Connection setup > Add from QR code in the mobile app. It sets up the connection without signing in on Android, iOS/iPadOS, and Windows. However, on Android and iOS/iPadOS only, workers can use another kind of code (a sign-in QR code) together with a PIN number to sign in. QR code and PIN sign-in isn't supported on Windows. Learn more in QR code and PIN sign-in for the Warehouse Management mobile app.

How many Microsoft Entra ID apps do I need to register in Azure?

The Warehouse Management mobile app uses a Microsoft Entra ID application to authenticate and connect to your Supply Chain Management environment. You can use a global application that's provided and maintained by Microsoft, or you can register your own application in Microsoft Entra ID.

We recommend that you use the global application, because it's easier to set up, use, and maintain. In this case, you don't need to register any Microsoft Entra ID applications in Azure. All your devices can connect through the global application.

If you have specific requirements that the global application doesn't meet (such as the requirements for some on-premises environments), you can register your own application in Microsoft Entra ID as described in Create a custom application registration. You still need to create just one Microsoft Entra ID app registration. All your devices can then connect through it.

For information about how to configure your devices to connect through either of these methods, see Install the Warehouse Management mobile app.

How many Microsoft Entra ID users do I need?

Choose the approach that fits your warehouse. Your choice depends on how you manage identities and on your risk tolerance. Learn more in Choose an authentication approach.

Scenario Notes
Use the same Microsoft Entra ID account for all devices

Not recommended.

This scenario, where you use a single Microsoft Entra ID user for all your devices, is less secure than other scenarios. It can lead to confusion in Supply Chain Management. For example, all warehouse processes are associated with a single system user, even when multiple warehouse workers use multiple warehouse devices to process work. You also can't revoke access for one device without affecting every other device.
Use a unique Microsoft Entra ID account for each device

Each worker must manually sign in to the app when they start to use the device.

When you set up one Microsoft Entra ID user for each device, it's easy to block the Microsoft Entra ID user for just one device if that device is stolen or damaged. (Learn more in Remove access for a device that uses user-based authentication.)
Use a unique Microsoft Entra ID account for each worker

Single sign-on (SSO) is supported. Therefore, a worker who signs in to a device is automatically signed in to the Warehouse Management mobile app and all other apps that use the same Microsoft Entra ID account.

Conditional Access policies are most effective in this scenario, because the signed-in identity represents a person.

Note

The number of Microsoft Entra ID accounts that you create isn't the same as the number of licenses that you need. Sharing one device account among many workers doesn't reduce your license count. Learn more in Licensing considerations.

Do I need to map users on the Microsoft Entra ID applications page in Supply Chain Management when I use user-based authentication?

No, you don't need to map users on the Microsoft Entra ID applications page in Supply Chain Management when you use user-based authentication.

How often do workers need to sign in to the Warehouse Management mobile app?

There's no fixed sign-in interval in the app, and the app doesn't apply a session timeout of its own. The amount of time a device or worker stays signed in is controlled entirely by your Microsoft Entra ID configuration, by configurations such as token lifetimes and Conditional Access policies (for example, sign-in frequency). Workers must sign in again when the tokens on the device expire or are revoked. Learn more in Refresh tokens in the Microsoft identity platform and Configure adaptive session lifetime policies.

Will the current worker sign-in page change or be removed?

Although the worker sign-in page is required in some authentication scenarios, it can be skipped in others (for example, when a default user ID is set for the warehouse worker account). For more information, see Scenarios for managing devices, Microsoft Entra ID users, and mobile device users.

How can I sign out a device?

Follow these steps to sign out the Microsoft Entra ID account that's signed in on a device:

  1. Open the Warehouse Management mobile app.
  2. Select Select a connection.
  3. Select Sign out.

What's the difference between Log off and Sign out in the Warehouse Management mobile app?

The Warehouse Management mobile app provides two similar-sounding actions that end different sessions. They aren't interchangeable.

  • Log off is a menu item that you configure in Supply Chain Management on the Mobile device menu items page (with Mode set to Activity code and Activity code set to Log off). When a worker selects Log off, the worker's session ends on the server. The worker's stored state (such as the last screen they were viewing) is cleared, and the next worker who signs in starts from the menu that's configured for their work user.
  • Sign out is a built-in button in the Warehouse Management mobile app. It signs the Microsoft Entra ID account out of the app on the current device, but it doesn't end the work user session in Supply Chain Management. The worker's server-side state is preserved, so the next time the same worker signs in on any device, the app returns to the screen that they last had open.

Note

If a worker uses Sign out while a screen other than the main menu is open, that screen reappears on the next sign-in, even if Menu name is set to Main for the work user on the Work users page. To always start at the configured main menu, the worker must use the Log off menu item before they sign out of the app. This behavior is by design.

Can I just use the Microsoft Entra ID as a worker and skip the worker sign-in page?

Yes. You can map Microsoft Entra ID users to worker IDs in Supply Chain Management. Workers can then authenticate the app with Supply Chain Management and sign in as a worker at the same time. For more information, see Scenarios for managing devices, Microsoft Entra ID users, and mobile device users.

Can I mass deploy the mobile app with user-based authentication?

Yes. For details and instructions, see Mass deploy the mobile app with user-based authentication.

What about single sign-on? Can I use the mobile app alongside Microsoft Teams to chat with my coworkers?

Yes, the app supports single sign-on (SSO). Among other capabilities, SSO lets you chat with coworkers through Microsoft Teams while you use the same account to sign in to the Warehouse Management mobile app.

If you're using SSO and sign out from one SSO app (such as Microsoft Teams), you also sign out of all other apps that use that same account (including the Warehouse Management mobile app).

Does user-based authentication work with Dynamics 365 Finance + Operations (on-premises)?

Yes. On-premises installations use Active Directory Federation Service (AD FS) instead of Microsoft Entra ID. However, the settings are similar, including the settings for user-based authentication methods such as username/password authentication. Learn more in Configure the Warehousing app for on-premises deployments.

Is it mandatory to have Microsoft Authenticator installed on the same mobile device as the Warehouse Management mobile app?

No, it's not mandatory for normal use. The app authenticates through the system browser or a native web view, without Microsoft Authenticator, Intune Company Portal, or any other companion app. Microsoft Entra ID QR code and PIN sign-in also work without these apps.

You need Microsoft Authenticator on Android and iOS devices if you want either of the following advanced capabilities:

  • Brokered authentication, which provides single sign-on (SSO). On Android, Intune Company Portal can act as the broker instead.
  • Conditional Access policies that depend on device signals, such as device compliance. These policies need a broker on the device to supply the signals.

Both options are advanced. Most frontline deployments don't use them. Whether you deploy a broker is a security design decision that your organization owns. Learn more in Brokered authentication and Conditional Access.

What Microsoft Entra ID device registration state does the app require?

The app doesn't require any specific device registration state. The app works on a device in any Microsoft Entra ID registration state: Microsoft Entra joined, Microsoft Entra registered, not joined, and not registered at all. You don't have to join or register a device before workers can sign in, and the app-level authentication flow works even on a device that's new and never registered.

If your organization requires a specific device state, that requirement comes from your own Conditional Access policies, not from the app. Learn more in Device registration requirements.

Can I authenticate by using Microsoft Entra Conditional Access?

Yes. Use Microsoft Entra Conditional Access to enforce policies such as multifactor authentication (MFA), device compliance, and location-based access controls. This feature requires Warehouse Management mobile app version 4.0.28 or later. Policies that depend on device signals, such as device compliance, also require brokered authentication, because the broker passes those signals to Microsoft Entra ID. Your IT department decides which policies to apply and configures them in Microsoft Entra ID.

Here are some resources to help you work with Conditional Access:

Can I authenticate using Microsoft Entra Guest User Access?

Yes. You can add an external user as a guest in the Microsoft Entra admin center. Learn how in Quickstart: Add a guest user and send an invitation.

After you send the invitation, create a warehouse worker account in Supply Chain Management and link it to the Microsoft Entra ID guest user account. If the guest user uses the Warehouse Management mobile app, you must assign appropriate roles and permissions to the warehouse worker account.

To set up the Warehouse Management mobile app to accept guest users, make the following connection settings:

  • Cloud – Set to Manual.
  • Microsoft Entra ID client ID – Enter the client ID of the Microsoft Entra ID application that you want to use.
  • Microsoft Entra ID tenant – Enter the tenant of the host organization, in the form https://login.windows.net/<host-organization-domain-name>. Although this setting is optional for most connections, you must specify it for guest user access, so that workers are authenticated against the host organization instead of their home organization.

What is device code flow, and why is it no longer recommended?

Device code flow provides a two-step process that authenticates users on devices or operating systems that don't necessarily provide a web browser. For example, a media streaming app might use device code flow to allow users to sign in on smart TVs, game consoles, and other devices. For devices and operating systems that don't provide a web browser, device code flow lets you sign in by using another device (such as a computer or mobile phone).

Device code flow is a user-based authentication method that lets you enter a Microsoft Entra ID user name and password to sign in from a device. After the app is signed in, individual workers still sign in by entering their Supply Chain Management worker ID.

Microsoft no longer recommends it, mainly because it's a common target of phishing attacks. It's also blocked by default in new tenants, isn't available on iOS, and doesn't support SSO. Use username/password authentication instead.

For the full reasoning, see Device code flow authentication.

Why is device code flow blocked by default in new tenants, and how can I unblock it if I still need it?

Device code flow is vulnerable to phishing, so Microsoft Entra ID security defaults block it in new tenants. Existing tenants aren't affected unless they already have security defaults enabled. If you create a new tenant for testing, expect device code flow to fail there.

If a test environment or legacy workflow still depends on it, an admin can unblock it for that tenant by disabling security defaults. Because security defaults protect the whole tenant, treat this change as a temporary step while you update your setup to use username/password authentication. Learn more in Microsoft Entra security defaults.

Follow the steps in Move from device code flow to username/password authentication. In short, verify that the Microsoft Entra ID accounts can sign in with a username and password, optionally install a broker app on Android and iOS devices if you want SSO, update your connection settings to use "ConnectionType": "UsernamePassword" (with "UseBroker": true when you use a broker), redistribute the settings, and then sign in one time on each device.

  • Last updated on