Suthahar Jegatheesan MSDEVBUILD / blog Multi-Stack Dev Build · by Suthahar
Search
Azure

What Happens When You Tap Sign In

The full login journey on a secure Azure app, step by step.

What you'll learn

  • Why a secure app hands the password to Entra ID and not to your API
  • What a signed token is and why verifying it needs no network call
  • Why there is no password left anywhere in the chain, including the database
Azure Security 8 steps 25 seconds —views

Was this useful?

Share

Understand it one step at a time

The short runs these in order in about 25 seconds. Here they are written out — pick any step to jump the short straight to it.

1 Step 1 of 8

She taps Sign in

One tap on Sign in. Everything that matters here is which system actually receives her password next.

Frequently asked questions

Does your app's API ever see the user's password?
No — a secure app opens the system browser to Microsoft's own sign-in page rather than rendering its own password field, so the password reaches Entra ID and stops there. Your API only ever sees a signed token afterward.
Why doesn't verifying that token need a network call?
The API validates the token's signature, issuer, audience and expiry locally against Microsoft's cached signing keys, so each request check costs microseconds rather than a round trip to Entra ID.

Free app · no app store

These are built for a phone

Every short is drawn at full portrait height, the shape a phone already is. Installed, it opens full-bleed with no address bar across the top — and the whole library reads offline.

How it works

Read deeper on Azure

Twenty seconds gets the shape of an idea across. These go into how it behaves in production.

More shorts

Get new posts by email

New technical articles, Azure AI and GitHub Copilot updates, and upcoming events. No spam, unsubscribe anytime.

↑↓ navigate ↵ open