@@ -444,9 +444,22 @@ def __init__(
444444 New in version 1.19.0.
445445
446446 :param boolean allow_broker:
447- Brokers provide Single-Sign-On, device identification,
448- and application identification verification.
449- This flag defaults to None, which means MSAL will not utilize broker.
447+ A broker is a component installed on your device.
448+ Broker implicitly gives your device an identity. By using a broker,
449+ your device becomes a factor that can satisfy MFA (Multi-factor authentication).
450+ This factor would become mandatory
451+ if a tenant's admin enables a corresponding Conditional Access (CA) policy.
452+ The broker's presence allows Microsoft identity platform
453+ to have higher confidence that the tokens are being issued to your device,
454+ and that is more secure.
455+
456+ An additional benefit of broker is,
457+ it runs as a long-lived process with your device's OS,
458+ and maintains its own cache,
459+ so that your broker-enabled apps (even a CLI)
460+ could automatically SSO from a previously established signed-in session.
461+
462+ This parameter defaults to None, which means MSAL will not utilize a broker.
450463 If this parameter is set to True,
451464 MSAL will use the broker whenever possible,
452465 and automatically fall back to non-broker behavior.
0 commit comments