@@ -444,9 +444,22 @@ def __init__(
444
444
New in version 1.19.0.
445
445
446
446
:param boolean allow_broker:
447
- Brokers provide Single-Sign-On, device identification,
448
- and application identification verification.
449
- This flag defaults to None, which means MSAL will not utilize broker.
447
+ A broker is a component installed on your device.
448
+ Broker implicitly gives your device an identity. By using a broker,
449
+ your device becomes a factor that can satisfy MFA (Multi-factor authentication).
450
+ This factor would become mandatory
451
+ if a tenant's admin enables a corresponding Conditional Access (CA) policy.
452
+ The broker's presence allows Microsoft identity platform
453
+ to have higher confidence that the tokens are being issued to your device,
454
+ and that is more secure.
455
+
456
+ An additional benefit of broker is,
457
+ it runs as a long-lived process with your device's OS,
458
+ and maintains its own cache,
459
+ so that your broker-enabled apps (even a CLI)
460
+ could automatically SSO from a previously established signed-in session.
461
+
462
+ This parameter defaults to None, which means MSAL will not utilize a broker.
450
463
If this parameter is set to True,
451
464
MSAL will use the broker whenever possible,
452
465
and automatically fall back to non-broker behavior.
0 commit comments