MSAL Python

MSAL Python (Microsoft Authentication Library) is the officially maintained SDK for authenticating applications and users against the Microsoft identity platform, including Microsoft Entra ID, external identities, Microsoft Accounts, and Azure AD B2C. It implements industry-standard OAuth2 and OpenID Connect flows behind PublicClientApplication and ConfidentialClientApplication classes.

Maintained by Microsoft under the AzureAD GitHub organization, MSAL Python is the recommended successor to the deprecated ADAL library and is the standard way Python apps acquire access tokens for Microsoft Graph and other Microsoft-identity-protected APIs.

What You Get

• PublicClientApplication and ConfidentialClientApplication classes covering native/mobile and server/web app scenarios
• Silent token acquisition (acquire_token_silent) with automatic cache-based refresh
• Support for authorization code, device code, client credentials, and username/password flows
• Built-in token cache serialization for persisting sessions across process restarts
• Managed identity and broker support for Azure-hosted and OS-integrated authentication

Common Use Cases

• Signing users into a Python web or desktop application via Microsoft Entra ID
• Acquiring access tokens to call Microsoft Graph APIs (mail, calendar, files) on behalf of a user
• Server-to-server (daemon) authentication using client credentials for backend services
• Migrating existing ADAL Python applications to a maintained, standards-compliant auth library

Under The Hood

Architecture - MSAL Python centers on application.py’s ClientApplication base class, subclassed into PublicClientApplication and ConfidentialClientApplication, which delegate protocol mechanics to the internal oauth2cli package while authority.py and mex.py/wstrust_*.py handle Microsoft-identity-specific authority discovery and WS-Trust federation for hybrid scenarios. Tech Stack - Pure Python (99.9% of the codebase) with minimal external dependencies, distributed under MIT license, supporting broker-based auth via optional native extensions and managed-identity flows for Azure-hosted compute. Code Quality - The tests/ directory includes live-tenant integration tests (broker-test.py, fixture XML files for WS-Trust/MEX responses) alongside unit tests, and the project runs a GitHub Actions benchmark suite tracked publicly, reflecting the security-sensitive rigor expected of an identity library. API Design - The library exposes a deliberately small, three-step usage pattern (create app -> check cache via acquire_token_silent -> fall back to an explicit flow) that keeps the common case simple while still surfacing the full complexity of OAuth2/OIDC flows for less common scenarios.