Edit

User-based authentication for the Warehouse Management mobile app

The Warehouse Management mobile app supports the following types of user-based authentication:

Important

Microsoft strongly recommends that you use username/password authentication for all new and existing deployments. Device code flow is inherently more vulnerable to phishing attacks because a threat actor can trick a user into entering a legitimate device code on the user's behalf, and Microsoft Entra ID has no reliable way to verify that the person entering the code is signing in from the device that generated it. Starting July 1, 2026, Microsoft Entra ID security default settings block device code flow in new tenants—including new tenants that are created for testing. Existing tenants aren't automatically affected unless they already have security defaults enabled. If your environment still requires device code flow (for example, for legacy scripts or test scenarios that can't yet be updated), see Device code flow authentication for information about how it can be enabled, and update your setup to use username/password authentication as soon as possible.

All Microsoft Entra ID accounts that are used to sign in must be granted only the minimum set of permissions that they require to perform their warehousing tasks. Permissions should be strictly limited to warehouse mobile device user activities. Never use an admin account to sign in to devices.

Scenarios for managing devices, Microsoft Entra ID users, and mobile device users

The Warehouse Management mobile app uses Microsoft Entra ID to authenticate with Dynamics 365 Supply Chain Management. Choose one of two scenarios for managing Microsoft Entra ID accounts. In both scenarios, each warehouse worker has a warehouse worker record in the Warehouse management module with one or more mobile device user accounts.

Use one Microsoft Entra ID user account per device

In this scenario, each mobile device has its own Microsoft Entra ID account. Workers don't need individual Microsoft Entra ID accounts.

It works like this:

  1. The admin configures the app with username/password authentication (recommended) by using the device's Microsoft Entra ID account. (Device code flow also works in this scenario, but it isn't recommended.)
  2. After the app authenticates, workers sign in by using their mobile device user account credentials (user ID and password).
  3. When a worker signs out, the app stays authenticated with Supply Chain Management and shows the sign-in page for the next worker.

This approach works best when multiple workers share devices at a location.

Use one Microsoft Entra ID user account per worker

In this scenario, each worker has their own Microsoft Entra ID account linked to their warehouse worker record in Supply Chain Management.

It works like this:

  1. The worker signs in with their Microsoft Entra ID credentials.
  2. If a default user ID is configured for the worker's warehouse worker account, this single sign-in authenticates the app and signs them in as a worker in one step.
  3. The same Microsoft Entra ID session can be shared across other apps on the device (such as Microsoft Teams or Outlook).

This approach supports single sign-on (SSO) and is best when workers use dedicated devices or when you need tighter identity controls.

Username/password authentication

When you use username/password authentication, each human worker must enter the Microsoft Entra ID username and password associated either with the device or with themselves (depending on the authentication scenario you're using). They might also need to enter a mobile device user account ID and password, depending on their warehouse worker record setup. This authentication method supports single sign-on (SSO), which also enhances the convenience of mobile mass deployment (MDM).

Microsoft recommends username/password authentication for all new and existing deployments. You can optionally enable brokered authentication to support SSO.

The app has no mandatory broker dependency. It can authenticate through the system browser or a native web view, without Microsoft Authenticator, Intune Company Portal, or any other companion app. Most frontline scenarios don't require brokered authentication. Whether you use it is a security design decision that your organization owns.

Microsoft Entra ID also offers QR code and PIN sign-in, which lets workers sign in quickly on shared devices by scanning a QR code and entering a PIN, instead of typing a full username and password every time. This flow works without Microsoft Authenticator or Intune Company Portal. Licensing and tenant prerequisites are listed in Prerequisites to enable the QR code authentication method.

Note

In the current version of the Warehouse Management mobile app, QR code and PIN sign-in works only when the app authenticates through the browser (browser-based authentication). It isn't supported when a broker handles the sign-in natively on the device. Therefore, you can't combine it with brokered authentication yet. Broader QR code sign-in support is planned for a future version of the app.

This QR code is a Microsoft Entra ID sign-in credential for workers. It's not the same as the QR code that you use to distribute connection settings to devices. Learn more in Read connection settings from a QR code.

Manually create an application registration in Microsoft Entra ID

The Warehouse Management mobile app uses a Microsoft Entra ID application registration to authenticate and connect to your Supply Chain Management environment. You can use a global application that's provided and maintained by Microsoft, or you can register your own application in Microsoft Entra ID by following the procedure in this section.

Important

Use the global application if possible. It's easier to set up and maintain, and it supports most scenarios, including Microsoft Entra Conditional Access. When you use the global application, you don't have to provide a client ID or tenant in the app's connection settings.

You only need your own app registration (and therefore a client ID) in the following cases:

  • You connect to a Dynamics 365 Finance + Operations (on-premises) environment.
  • You connect to a cloud other than Azure Global (for example, a sovereign cloud such as Microsoft Azure operated by 21Vianet in China).
  • You have specific requirements that the global application doesn't meet.

If you're able to use the global application, you can skip this section. For more information about how to use the global application, see Install the Warehouse Management mobile app. If you require a manual application registration, continue with this section.

The following procedure shows one way to register an application in Microsoft Entra ID. For detailed information and alternatives, use the links after the procedure.

  1. In a web browser, go to https://portal.azure.com.

  2. Enter the name and password of the user who has access to the Azure subscription.

  3. Use the search field at the top of the page to find and open the Microsoft Entra ID service.

  4. Make sure that you're working with the instance of Microsoft Entra ID that's used by Supply Chain Management.

  5. On the left navigation pane, expand Manage and select App registrations.

  6. On the toolbar, select New registration to open the Register an application wizard.

  7. Enter a name for the application, select the Accounts in this organizational directory only option, and then select Register.

  8. Your new app registration opens. Make a note of the Application (client) ID value, because you need it later. This ID is referred to later in this article as the client ID.

  9. In the Manage list, select Authentication.

  10. On the Authentication page for the new app, open the Settings tab, set Allow public client flows to Enabled, and select Save.

  11. Open the Redirect URI configuration tab and select Add redirect URI.

  12. In the dialog, select Android. Then set the following fields:

    • Package name – Enter the following value (case sensitive):

      com.Microsoft.WarehouseManagement

    • Signature hash – Enter the following value:

      hpavxC1xAIAr5u39m1waWrUbsO8=

    Select Configure to save your settings and close the dialog to return to the Authentication page, which now shows your new platform configurations.

  13. On the Redirect URI configuration tab, select Add redirect URI.

  14. In the dialog, select iOS / macOS.

  15. Set the Bundle ID field to the following value:

    com.microsoft.WarehouseManagement

  16. Select Configure to save your settings. Close the dialog to return to the Authentication page, which now shows your new platform configurations.

  17. On the left navigation pane, expand Manage and select API permissions.

  18. Select Add a permission.

  19. In the Request API permissions dialog, on the Microsoft APIs tab, select the Dynamics ERP tile and then the Delegated permissions tile. Under CustomService, select the CustomService.FullAccess checkbox. Finally, select Add permissions to save your changes.

  20. Use the search field at the top of the page to find and open the Microsoft Entra ID service.

  21. On the left navigation pane, expand Manage and select Enterprise applications. Then, in the new Manage list, select All applications.

  22. In the search form, enter the name that you entered for the app earlier in this procedure. Confirm that the Application ID value for the app matches the client ID that you copied earlier. Then select the link in the Name column to open the properties for the app.

  23. On the left navigation pane, expand Manage and select Properties.

  24. Set the Assignment required? option to Yes and the Visible to users? option to No. Then select Save on the toolbar.

  25. On the left navigation pane, expand Manage and select Users and groups.

  26. On the toolbar, select Add user/group.

  27. On the Add Assignment page, select the link under the Users heading.

  28. In the Users dialog, select each user that you use to authenticate devices with Supply Chain Management.

  29. Select Select to apply your settings and close the dialog. Then select Assign to apply your settings and close the Add Assignment page.

  30. In the Security list, select Permissions.

  31. Select Grant admin consent for <your tenant>, and grant admin consent on behalf of your users. If you lack the necessary permissions, return to the Manage list, open Properties, and set the Assignment required? option to False. Each user can then provide consent individually.

For more information about how to register an application in Microsoft Entra ID, see the following resources:

Set up employee, user, and warehouse worker records in Supply Chain Management

Before workers can sign in by using the mobile app, each Microsoft Entra ID account that you assign to the enterprise app in Azure must have a corresponding employee record, user record, and warehouse worker record in Supply Chain Management. For information about how to set up these records, see Mobile device user accounts.

Single sign-on

Single sign-on (SSO) lets workers sign in to the Warehouse Management mobile app without entering a password. It works by reusing credentials from another app on the device, such as Intune Company Portal, Microsoft Authenticator, or Microsoft Teams.

SSO requires username/password authentication. It doesn't work with device code flow.

You turn SSO on by enabling brokered authentication. For the setup steps and the device requirements that apply, see Brokered authentication and Conditional Access.

Note

SSO is optional. When it isn't enabled, the app signs workers in through the system browser or a native web view, and no broker is required.

Important

Device registration requirements

The Warehouse Management mobile app doesn't require a specific Microsoft Entra ID device registration state. Sign-in works on Microsoft Entra joined, Microsoft Entra registered, and unregistered devices, including new and never-registered devices.

However, your own Conditional Access policies can require a specific device state or compliance status. In that case, the requirement comes from your policies, not from the app. Brokered authentication also requires the device to be registered because the broker relies on a device-bound token to pass device signals to Microsoft Entra ID. Learn more in What is a device identity?.

Remove access for a device that uses user-based authentication

If a device is lost or compromised, revoke its access to Supply Chain Management immediately. Disabling the associated Microsoft Entra ID user account revokes access for all devices that use that account. This limitation is why the one account per device approach is recommended. It lets you isolate and revoke access for a single device without affecting others.

To revoke access, follow these steps:

  1. Sign in to the Azure portal.
  2. On the left navigation pane, select Microsoft Entra ID, and ensure that you're in the correct directory.
  3. In the Manage list, select Users.
  4. To open the user's profile, find the user account that's associated with the device or worker, and select the name.
  5. On the toolbar, select Revoke sessions to revoke the user account's sessions.

Note

Depending on how you set up your authentication system, you might also want to change the user account's password or completely disable the user account.

Device code flow authentication (not recommended)

Important

This section describes a legacy authentication method that Microsoft no longer recommends. It's documented only to support existing deployments that haven't migrated yet. For all new and existing deployments, use username/password authentication.

Device code flow is a two-step sign-in method that was originally designed for devices that don't provide a web browser. Microsoft doesn't recommend it for the Warehouse Management mobile app for the following reasons:

  • It's a frequent target of phishing attacks – A threat actor can ask a victim to sign in with a device code that the attacker generated, and then use the resulting token to access the victim's account from the attacker's own device. Microsoft Entra ID has no reliable way to verify that the person who enters the code is signing in from the device that generated it.
  • It's blocked by default in new tenants – Starting July 1, 2026, Microsoft Entra ID security default settings block device code flow on new tenants. This behavior commonly affects new tenants that are created for testing purposes. If you create a new tenant to test the Warehouse Management mobile app, expect device code flow to be blocked by default. Existing tenants aren't automatically affected unless they already have security defaults enabled.
  • It isn't available everywhere – Device code flow isn't supported on iOS, and it isn't supported for Android devices that connect to on-premises environments.
  • It doesn't support SSO – It can't be combined with brokered authentication.

If your environment still depends on device code flow (for example, because you're using legacy test scripts or workflows that aren't updated yet), an admin can choose to unblock device code flow for that tenant by disabling security defaults. Disabling this protection lowers the tenant's overall security posture and increases exposure to identity-related attacks. Treat it strictly as a temporary measure while you update your setup, scripts, and workflows to use username/password authentication. For information about security defaults, see Microsoft Entra security defaults.

How device code flow works

When you use device code authentication, the Warehouse Management mobile app generates and shows a unique device code. The admin who sets up the device enters this device code into an online form, along with the credentials (name and password) for a Microsoft Entra ID user account. This account can represent either the device itself or the human worker who signs in, depending on how the admin implements the system. In some cases, depending on how the Microsoft Entra ID user account is configured, the admin might also have to approve the sign-in. In addition to the unique device code, the mobile app shows the URL where the admin must enter the code and the credentials for the Microsoft Entra ID user account.

Requirements and restrictions

If you must temporarily continue to use device code authentication, be aware of the following extra requirements and restrictions:

  • Create a unique Microsoft Entra ID user account for each device or human worker. In addition, strictly limit these accounts so that they can perform only warehouse mobile device user activities.
  • While a worker is signing in by using the Warehouse Management mobile app, the app shows a generated device code. This code expires after 15 minutes and is then hidden by the app. If the code expires before sign-in is completed, the worker must generate a new code by selecting Connect again in the app.
  • How long a device stays authenticated is controlled by your Microsoft Entra ID token lifetime and Conditional Access policies, not by the app. When the tokens for a device expire or are revoked, the device must be authenticated again. Learn more in Refresh tokens in the Microsoft identity platform.
  • Single sign-on (SSO) isn't supported when you use device code flow authentication together with a mobile mass deployment (MDM) system (such as Intune) to distribute the Warehouse Management mobile app. You can still use an MDM system to deliver the app to each mobile device and deliver a connections.json file that sets up connections using device code. The only difference is that workers must manually sign in when they start to use the app. (This step is required only once.)

Move from device code flow to username/password authentication

To move an existing deployment away from device code flow, follow these steps:

  1. Confirm that the Microsoft Entra ID accounts that the devices use can sign in with a username and password, and that the app registration you use allows public client flows. Learn more in Manually create an application registration in Microsoft Entra ID.
  2. Optional: If you want SSO, enable brokered authentication. On Android and iOS, that requires a broker app on the device.
  3. Update your connection settings to specify "ConnectionType": "UsernamePassword" (and, when you use a broker, "UseBroker": true). Then redistribute them through your MDM provider, a connections.json file, or a QR code. Learn more in Create a connection settings file or QR code and Read connection settings from a QR code.
  4. Sign in one time on each device to complete the authentication with the new method.
  • Last updated on