[Bug] Unable to work without consenting tracking

Which version of MSAL.NET are you using? MSAL.NET 4.35.0

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive

The app is in production, I haven’t upgraded MSAL, but started seeing this issue.

I’m facing a problem with my app’s Apple store submission.

This is what they are claiming:

We discovered one or more bugs in your app. Specifically, after we tapped in “Don’t Allow”, no action occurred, and we were unable to access to the app.

I’ve tried to skip this prompt using “Prompt.NoPrompt” and it worked in previous submissions (the latest working one was in May) but not anymore.

So we have three issues here:

• Why Microsoft started tracking this kind of data?
• Clicking on “Don’t allow” is preventing the user from logging succesfully.
• iOSHidePrivacyPrompt and NoPrompt are not working

Is there any workaround to be able to login (pressing scape seems to work) or just not showing the prompt?

Repro

        SystemWebViewOptions systemWebViewOptions = new SystemWebViewOptions()
        {
          iOSHidePrivacyPrompt = true,
        };
        authResult = await publicClientApp.AcquireTokenInteractive(new[] { "wl.basic", "wl.signin", "wl.offline_access", "wl.emails" }).WithPrompt(Prompt.NoPrompt).WithSystemWebViewOptions(systemWebViewOptions).ExecuteAsync();

Additional context / logs / screenshots

[SameerK-MSFT]

Here are the findings with more options: AzureAdMultipleOrgs Corp account - no prompt no problem Personal account - not allowed prompt not applicable

AzureAdAndPersonalMicrosoftAccount Corp account - no prompt no problem Personal account - no prompt no problem

It appears that the issue happens only when there is mismatch in the account type and the authority.

[Mikozans]

If I change it to AzureAdAndPersonalMicrosoftAccount there’s another issue.

I use different scopes depending if it’s a corp account ({AadBackendId/user_impersonation", “user.read”}) or not ({ “wl.basic”, “wl.signin”, “wl.offline_access”, “wl.emails” }).

So using AzureAdAndPersonalMicrosoftAccount + { “wl.basic”, “wl.signin”, “wl.offline_access”, “wl.emails” } throws

Error: AADSTS70011: The provided value for the input parameter ‘scope’ is not valid. The scope ‘offline_access openid profile wl.basic wl.emails wl.offline_access wl.signin’ is not configured for this tenant.