microsoft-authentication-library-for-dotnet: [Bug] Windows integrated authentication Azure AD and WinForms, Integrated Windows Auth is not supported for managed users

Which Version of MSAL are you using ? MSAL 4.10

Platform .net 4.6.1

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Auth
  • Username Password
  • Device code flow (browserless)
• Web App
  • Authorization code
  • OBO
• Web API
  • OBO

Other? - please describe;

Is this a new or existing app?

c. This is a new app or experiment

Repro

using: authResult = await app.AcquireTokenSilent(scopes, accounts.FirstOrDefault()) and authResult = await app.AcquireTokenByIntegratedWindowsAuth(scopes)

Get error: Integrated Windows Auth is not supported for managed users

using the method:

app.AcquireTokenInteractive The application shows a prompt for the user to select what account wants to use (the prompt shows connected to windows) and I don’t need to enter the password, right after I click the user it sings in and gets the token. After I get the token and it is saved using PublicClientApp.UserTokenCache the next logins even if the token is expired I don’t need to select the account, the user sing in automatically. using the method app.AcquireTokenSilent

Expected behavior it should get the token without user interaction

Actual behavior methods returns:

Microsoft.Identity.Client.MsalClientException: Integrated Windows Auth is not supported for managed users. See https://aka.ms/msal-net-iwa for details.

at Microsoft.Identity.Client.Internal.Requests.IntegratedWindowsAuthRequest

Possible Solution

Additional context/ Logs / Screenshots I have tried 2 options (none worked):

• A user created in Windows AD and then synced to AAD
• A user created in AAD and then created in Windows AD

other info:

• Treat application as a public client is marked yes in the app registration.​

• I used the same app registration with a web application (SPA) and using Microsoft Edge I can login without the user interaction, it signs in automatically

• in azure AD -> Seamless single sign-on | Enabled | 1 domain