How to apply Entra External Id "keep me signed in" functionality in ASP.NET web app

Question

I'm updating a legacy .Net Framework 4.8 Webforms app to use Extra External Id for authentication. This is working and I can sign in and out no problem.

The issue I have is with the Entra "keep me signed in" functionality.

The following code always creates a session cooke when the Entra sign in process is successful:

    Protected Sub SignIn_Click(sender As Object, e As EventArgs)
        If Not Request.IsAuthenticated Then
            HttpContext.Current.GetOwinContext().Authentication.Challenge(
                New AuthenticationProperties With {.RedirectUri = "/"},
                OpenIdConnectAuthenticationDefaults.AuthenticationType, CookieAuthenticationDefaults.AuthenticationType)
        End If
    End Sub

I can set the .IsPersistent property of AuthenticationProperties to make the cookie persist for 1 hour:

    Protected Sub SignIn_Click(sender As Object, e As EventArgs)
        If Not Request.IsAuthenticated Then
            HttpContext.Current.GetOwinContext().Authentication.Challenge(
                New AuthenticationProperties With {.RedirectUri = "/", .IsPersistent = True},
                OpenIdConnectAuthenticationDefaults.AuthenticationType, CookieAuthenticationDefaults.AuthenticationType)
        End If
    End Sub

However, both the above don't seem to be linked to the "keep me signed in" feature in Entra.

What is the best way to ensure that my app correctly applies the user's "keep me signed in" selection from the Entra flow?

Thanks.

Answer 1

Hello @simgib,

Thank you for posting your query on Microsoft Q&A.

I understand that you are updating a legacy .Net Framework 4.8 Webforms app to use Entra External Id for authentication. This is working and you can sign in and out no problem.

The issue you have is with the Entra "keep me signed in" functionality.

You want to know what is the best way to ensure that your app correctly applies the user's "keep me signed in" selection from the Entra flow?

Please note that if you have configured your application in normal Microsoft Entra ID Workforce tenant, then there is an option available in Microsoft Entra admin center to enable Keep me signed in(KMSI) prompt for the users in your tenant when accessing the application.

The Stay signed in? prompt appears after a user successfully signs in. This process is known as Keep me signed in (KMSI).

Prerequisites

Configuring the 'keep me signed in' (KMSI) option requires one of the following licenses:

• Microsoft Entra ID Free
• Office 365 (for Office apps)
• Microsoft 365

You must have the Global Administrator role to enable the 'Stay signed in?' prompt.

How does it work?

If a user answers Yes to the 'Stay signed in?' prompt, a persistent authentication cookie is set. The cookie must be stored in session for KMSI to work. KMSI doesn't work with locally stored cookies. If KMSI isn't enabled, a non-persistent cookie is issued and lasts for 24 hours or until the browser is closed.

Steps to Enable the 'Stay signed in?' prompt

The KMSI setting is managed in User settings.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Browse to Identity > Users > User settings.
3. Set the Show keep user signed in toggle to Yes.

Please note that this Show keep user signed in setting is a tenant wide settings and will be applicable to all the users in your Microsoft Entra ID Workforce tenant.

For additional information regarding Keep me signed in(KMSI) prompt, please refer to the below document for your reference.

Manage the 'Stay signed in' prompt in Microsoft Entra ID - Microsoft Entra | Microsoft Learn

Since you have mentioned that you are updating a legacy .Net Framework 4.8 Webforms app to use Entra External Id for authentication, please note that 'Keep me signed in (KMSI)' option is not yet available in Microsoft Entra External tenant.

For additional information on what is supported in external tenants see Supported features in workforce and external tenants.

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".