# What Happens When You Tap Sign In

> The full login journey on a secure Azure app, step by step.

- **Format:** short video, 8 steps, ~25 seconds
- **Topic:** The complete journey of one sign-in on a secure Azure app — the app hands off to Microsoft Entra ID, the password never reaches your own API, a signed token comes back, your API verifies it locally, and it reaches the database with a managed identity.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-22
- **Tags:** azure, security, microsoftentraid, oauth, authentication, mobilesecurity, dotnet, apisecurity, jwt, mfa, cloudsecurity, backenddeveloper, microsoftazure, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/secure-login-journey/

---
## What you'll learn

- Why a secure app hands the password to Entra ID and not to your API
- What a signed token is and why verifying it needs no network call
- Why there is no password left anywhere in the chain, including the database

## Understand it one step at a time

### 1. She taps Sign in

One tap on Sign in. Everything that matters here is which system actually receives her password next.

### 2. The app hands it off

The app never renders its own password field — it opens the system browser to Microsoft’s own sign-in page instead.

### 3. Her password stops here

Her password goes to Microsoft Entra ID and stops there. Your API isn’t part of this exchange at all.

### 4. She approves it on her phone

MFA approval on her phone — the slow step, and it’s her doing it, not the system. A stolen password alone now does nothing.

### 5. A signed token comes back

What comes back isn’t her password — a JWT signed by Microsoft, typically valid 60 to 90 minutes, stored in Keychain or Keystore.

### 6. Your API checks the signature

Your API checks signature, issuer, audience and expiry against Microsoft’s cached signing keys — locally, no network call per request.

### 7. And no password below it either

Your API reaches Azure SQL the same way — a managed identity, so there’s no password in the connection string either.

### 8. Her password went one place

Her password touched exactly one system: Microsoft’s. Everything downstream of that was a signed, time-limited token.

---

## The takeaway

**Her password went to exactly one place.**

Everything after that was a signed token your API could verify on its own.