Authentication broker
An authentication broker is a component that handles sign-in and token acquisition for applications, allowing them to share single sign-on support.
Letting another component handle sign-in
A supported application can ask an authentication broker to get a token instead of handling every sign-in interaction itself. The broker may use an account already signed in on the device or show a prompt when the user needs to do something.
Windows Web Account Manager, or WAM, is one example. Apps can use it through Microsoft’s authentication library to support single sign-on and use account information already on the device.
Who does what?
If a desktop app asks WAM for a Microsoft Graph token:
- The desktop app is the OAuth client asking for the token.
- WAM is the broker handling that request.
- Graph is the resource server that receives the access token and handles the API call.
A broker is software. A PRT is a credential used in supported Microsoft single sign-on flows. They are not two names for the same thing.
A browser appearing during sign-in does not necessarily mean the browser received the token. When tracing a sign-in, identify the client that requested it and the component that handled authentication.