// the find
AzureAD/microsoft-identity-web
Helps creating protected web apps and web APIs with Microsoft identity platform and Azure AD B2C
Microsoft Identity Web is the official ASP.NET Core integration library for Microsoft Entra ID (formerly Azure AD) and B2C authentication. It wraps MSAL.NET and the ASP.NET Core authentication middleware into something you can wire up in a few lines. If you're building a .NET web app or API that needs to authenticate against Microsoft's identity platform, this is the library you're supposed to use — not something you roll yourself.
The DI setup is genuinely tidy: AddMicrosoftIdentityWebAppAuthentication and AddMicrosoftIdentityWebApiAuthentication handle the full OIDC/Bearer pipeline including token acquisition, caching, and downstream API calls without requiring you to understand all the MSAL internals. The token cache integration is solid — it supports distributed caches (Redis, SQL) out of the box, which matters when you're running multiple instances. The library ships dotnet new templates for Blazor Server, Blazor WebAssembly, and MVC, which means a new project gets the auth plumbing right from the start rather than having to copy-paste from samples. Active monthly releases and a clear support matrix (currently 3.x, v4 migration guide already posted) means security patches actually land.
The abstraction occasionally leaks badly — when something goes wrong with token acquisition or consent challenges, you end up digging through MSAL.NET internals anyway, so the simplicity is somewhat illusory once you hit edge cases. B2C support is treated as a first-class scenario in the docs but has historically lagged behind the Entra ID path in correctness; custom policy flows in particular have had quirks that required workarounds. The library is tightly coupled to Microsoft's identity stack — if your app needs to support a second IdP alongside Entra, you're fighting the abstractions rather than working with them. Documentation lives partly on GitHub Wiki and partly on learn.microsoft.com and they don't always agree or stay in sync.