Search code examples
azure-active-directoryaccess-token

How to use Primary Refresh Token (PRT) to retrieve Access Token in AzureAD

Is it possible to use a Windows PRT in browser to receive Access Token to call an Azure protected web API from a web app?

Solution

  • Please check this concept of primary refresh token in Azure AD which says

    A Primary Refresh Token (PRT) is a key artifact of Azure AD authentication on Windows 10 or newer, Windows Server 2016 and later versions, iOS, and Android devices. It is a JSON Web Token (JWT) specially issued to Microsoft first party token brokers to enable single sign-on (SSO) across the applications used on those devices.

    Device registration is a prerequisite for device based authentication in Azure AD. A PRT is issued to users only on registered devices.

    According to Key considerations

    1. A PRT is only issued and renewed during native app authentication.A PRT is not renewed or issued during a browser session.
    2. When an app requests token through WAM, Azure AD issues a refresh token and an access token.

    (we know Access tokens enable clients to securely call protected web APIs, and are used by web APIs to perform authentication and authorization according to scenario-web-app-call-api) but PRT is not issued during browser session.

    Azure AD WAM plugin is an Azure AD specific plugin built on the WAM framework, that enables SSO to applications that rely on Azure AD for authentication.