SSO (CloudAPAuthEnabled) not working in CefSharp even with Chrome runtime enabled

[petrdrabek]

When embedding CefSharp we need automatic SSO with Microsoft accounts (Azure AD / MSA).
On a normal Chrome installation this works correctly when the CloudAPAuthEnabled policy is set to 1 (Enable Microsoft® cloud authentication). Users signed into Windows with a Microsoft account or AzureAD account are automatically signed into Microsoft cloud properties without showing a login dialog.

In CefSharp:

• 3rd party cookies are allowed.
• Chrome runtime (CefSharpSettings.RuntimeStyle = CefRuntimeStyle.Chrome;) was tested.
• Flags like --enable-chrome-browser-cloud-management were tested.
• Policies in Windows registry (CloudAPAuthEnabled) are applied correctly for Chrome, but CefSharp ignores them.
• WebView2 with AllowSingleSignOnUsingOSPrimaryAccount = true option set works.

Expected behavior:
When CloudAPAuthEnabled=1 is set in Windows policies, CefSharp with Chrome runtime should inherit this behavior and sign the user in automatically, just like Chrome does.

Actual behavior:
Even with the same machine/user where Chrome auto-signs in, CefSharp still prompts the user with a Microsoft login dialog.

Steps to reproduce:

1. Join Windows 10/11 machine to Azure AD or sign in with a Microsoft account.
2. Enable the CloudAPAuthEnabled policy.
3. Launch Chrome → open a Microsoft property (e.g., outlook.office.com) → user is signed in automatically.
4. Launch CefSharp browser (WinForms/WPF, any example app) → navigate to the same property → login prompt is shown instead of automatic sign-in.

Question / Feature request:
Is there a way to enable CloudAPAuthEnabled support in CefSharp (Chrome runtime), or is this functionality intentionally not supported in CEF?
If not currently supported, can this be exposed so that embedded Chromium respects the CloudAPAuthEnabled policy or can it be somehow set? Possible workaroud?

[amaitland]

Best place to ask would be on https://magpcss.org/ceforum/index.php

Last I checked it was done via extension, that was years ago though.

https://magpcss.org/ceforum/viewtopic.php?f=6&t=18560

I don't know the current state of play. This isn't likely to be something that can be implemented in cefsharp. CEF would need to add support.

[amaitland]

https://www.magpcss.org/ceforum/viewtopic.php?f=6&t=19618 looks like a slightly newer discussion.

[petrdrabek]

@amaitland We were able to get this working on our side. Since CEF doesn’t currently expose CloudAP integration, we implemented the missing piece ourselves by calling the Windows COM interface IProofOfPossessionCookieInfoManager (CLSID A9927F85-A304-4390-8B23-A75F1C668600).

At navigation time we check if the request is targeting an IdP origin (from registry under IdentityStore / fallback to login.microsoftonline.com etc.). For those requests we:

• Create the PoP manager (new ProofOfPossessionCookieInfoManagerClass() via COM).

• Call GetCookieInfoForUri() for the target URL.

• Convert returned ProofOfPossessionCookieInfo entries:

  • if the cookie name starts with x-ms- we add it as a dedicated header,
  • otherwise we aggregate into the Cookie: header.

• Free the array with FreeProofOfPossessionCookieInfoArray().

With this approach, on AAD-joined devices with a valid PRT, SSO is silent exactly like in Chrome/Edge. If PoP manager isn’t available (REGDB_E_CLASSNOTREG, or no account joined) we just fall back to the normal login page.

So this works reliably for our kiosk scenario.

Would it make sense to contribute a small sample or helper back (either here or on the CEF forum) so others can benefit, or is this too far outside the scope of CefSharp itself?

[amaitland]

@petrdrabek Sounds like you've come up with a very clever workaround 👍 Congrats!

If you'd like to submit a PR that includes your code in one of the example projects within your repo that would be most welcome.

Ideally this would be resolved in CEF so the behavior is exactly the same as Chromium, it would still be worth someone raising an issue on the CEF issue tracker to see if support can be fixed/added.

[amaitland]

https://github.com/chromiumembedded/cef/issues

[Patte72]

We would love to get this as a part of CefSharp itself. SSO is mandatory nowadays.

[amaitland]

As above, support needs to be fixed/added in CEF so the behavior mimics Chromium.

[petrdrabek]

I agree with @amaitland, this should not be part of the CefSharp it self. I will add my workaround solution to the example project.