Enter a valid email address, phone number or Skype name

[KarimMousa89]

Copilot Usage Confirmation

• I have tried using GitHub Copilot to resolve this issue.

MSAL Version

2.13.0

Description

I'm getting "Enter a valid email address, phone number or Skype name" error message when try to login using MSAL v2.13.0. However I'm already using a valid email.

if I used another email then back to the original email it works fine.
Also if I dismissed the login view, then open it again and used the same email it works fine.
Also sometimes if I erased the email text field then wrote the same email again it works fine.

Error Details

Enter a valid email address, phone number or Skype name

MSAL Logs

No logs, App crash when try to login after setting "MSALGlobalConfig.loggerConfig.setLogCallback" once in the app launch.

Reproduction Steps

Normal login process

1. create MSALPublicClientApplicationConfig using clientId, redirectUri, authority
2. create MSALPublicClientApplication
3. create MSALWebviewParameters using my view controller, authenticationSession, prefersEphemeralWebBrowserSession = true
4. create MSALInteractiveTokenParameters
5. call applicationContext.acquireToken

Expected Behavior

the email is correct and login should succeed

Regression

1.9.0

Screenshots & Screen Recordings

Additional context

No response

[github-actions]

Hello! Thanks for sharing your detailed issue. To summarize: you're seeing the "Enter a valid email address, phone number or Skype name" error during interactive sign-in using MSAL v2.13.0, even though you're entering a valid email. The problem clears if you retry, erase/retype, or navigate away and back. This suggests an issue with the initial webview login flow or possibly the way login hints are being passed.

Initial Triage Steps

Let's check the following:

1. Login Hint Usage: Are you using the loginHint property in your MSALInteractiveTokenParameters? This guides the authentication UI to pre-fill/select the user, but if the value is incorrectly set or not matching, it could cause prompt confusion. See MSALInteractiveTokenParameters.h.

2. Parent View Controller: If the MSALWebviewParameters.parentViewController is not attached to a window, MSAL will error. However, your flow proceeds to the login UI, so this is likely not the issue.

3. Webview Parameters (prefersEphemeralWebBrowserSession): Using MSALWebviewParameters.prefersEphemeralWebBrowserSession = YES means every sign-in is in a new non-persistent browser session. This can affect auto-filling and session state, but shouldn't impact validation of the email format.

4. Prompt Type: What value are you using for promptType? If it's MSALPromptTypeLogin, MSAL will always show the login screen, but it should still accept valid email input.

5. Authority Configuration: Is your authority value a valid tenant (common, organizations, or specific tenant ID)? Wrong authorities can sometimes lead to odd UI states.

6. Redirect URI and Entitlements: Any misconfigurations can cause issues in interactive auth.

Action Items

Please Provide:

• The exact value of loginHint you use in MSALInteractiveTokenParameters.
• What is the promptType (if set)?
• Your authority string.
• Your redirect URI and confirmation it matches the Azure portal configuration.
• The view controller you use as parentViewController and its presentation state when calling MSAL.
• The Info.plist CFBundleURLTypes and entitlements, if possible (at least the redirect URI entries).

Concrete Example

Here's the canonical Objective-C usage pattern grounded in the API docs:

#import <MSAL/MSAL.h>

// Step 1: Configure MSAL
MSALPublicClientApplicationConfig *config =
    [[MSALPublicClientApplicationConfig alloc] initWithClientId:@"YOUR_CLIENT_ID"];
config.redirectUri = @"YOUR_REDIRECT_URI";
config.authority = [MSALAADAuthority authorityWithURL:[NSURL URLWithString:@"https://login.microsoftonline.com/common"] error:nil];

NSError *error = nil;
MSALPublicClientApplication *application =
    [[MSALPublicClientApplication alloc] initWithConfiguration:config error:&error];

if (error) {
    NSLog(@"Failed to create MSAL application: %@", error);
    return;
}

// Step 2: Configure Webview parameters
MSALWebviewParameters *webViewParameters =
    [[MSALWebviewParameters alloc] initWithAuthPresentationViewController:self];
webViewParameters.preferEphemeralWebBrowserSession = YES;

// Step 3: Interactive token parameters
MSALInteractiveTokenParameters *interactiveParams =
    [[MSALInteractiveTokenParameters alloc] initWithScopes:@[@"user.read"]
                                         webviewParameters:webViewParameters];
interactiveParams.loginHint = @"valid@email.com"; // <-- Ensure this matches expected format
interactiveParams.promptType = MSALPromptTypeLogin; // Optional

// Step 4: Acquire token interactively
[application acquireTokenWithParameters:interactiveParams
                        completionBlock:^(MSALResult * _Nullable result, NSError * _Nullable error) {
    if (error) {
        NSLog(@"Could not acquire token: %@", error);
        return;
    }
    NSLog(@"Access token acquired: %@", result.accessToken);
}];

Key points:

• The loginHint must be a valid email address string, and must match a user in your tenant if you're expecting pre-selection.
• If you don't specify loginHint, MSAL shows the generic login UI.
• If you specify an incorrect/invalid email, the UI will prompt as you describe.

Next Steps

• Please double-check your loginHint value and ensure it's a valid email address for a user in your tenant.
• Try removing loginHint altogether and see if the error still occurs.
• Confirm all configuration values and provide them here — especially anything that changed between MSAL 1.9.0 and 2.13.0.

Once you provide these details, I can help diagnose further.

References

• MSALPublicClientApplication.h - Interactive Authentication
• MSALInteractiveTokenParameters.h - loginHint, promptType
• MSALWebviewParameters.h - ephemeral session
• MSAL API Usage Examples - Objective-C
• Interactive sign-in docs

Let me know the requested info and we'll dig deeper!

---

Need further assistance? Comment with PING-COPILOT: <your question> to trigger a follow-up.

Want to disable automated replies on this issue? Comment with STOP-COPILOT.

This comment was generated by an automated assistant to help with initial triage. A maintainer will follow up as needed.

[github-actions]

Thanks for following up! If you're asking whether you can share sensitive or private details (such as logs, screenshots, email addresses, or user-specific data) for troubleshooting, please note:

• GitHub Issues are public. Anything you post here can be seen by anyone.
• For privacy and security, do not share real email addresses, credentials, or any data you would not want published.
• We can help troubleshoot using sample values, high-level descriptions, or redacted error messages.

If you have logs or data that must be kept confidential:

1. Redact or anonymize before sharing (e.g., use user@example.com instead of your real email).
2. If the issue requires Microsoft support staff to access private information, you may need to open a support ticket via Microsoft support or your organization's support channel, rather than GitHub.

We cannot review private information via GitHub. But please feel free to describe the scenario, use sanitized sample data, or ask about specific MSAL API usage. For example:

• "Here's the Objective-C code where I set loginHint, using a dummy email address..."
• "I'm using this configuration, but getting X error..."

Let me know how you'd like to proceed — happy to help based on what you can share here!

References:

• MSALInteractiveTokenParameters.h
• Microsoft Entra troubleshooting docs

---

Need further assistance? Comment with PING-COPILOT: <your question> to trigger a follow-up.

Want to disable automated replies on this issue? Comment with STOP-COPILOT.

This comment was generated by an automated assistant in response to your follow-up request. A maintainer will follow up as needed.

[KarimMousa89]

Here is the required details

• The exact value of loginHint you use in MSALInteractiveTokenParameters.
  I'm not setting loginHint anywhere.
• What is the promptType (if set)?
  promptType = .promptIfNecessary
• Your authority string.
  https://login.microsoftonline.com/`tenant ID`
• Your redirect URI and confirmation it matches the Azure portal configuration.
  Yes, matches.
• The view controller you use as parentViewController and its presentation state when calling MSAL.
  I'm using a new UIWindow with a new root view controller, and set it as the new key window, cause I display MSAL from SwiftUI view.
• The Info.plist CFBundleURLTypes and entitlements, if possible (at least the redirect URI entries).
  <key>CFBundleURLTypes</key> <array> <dict> <key>CFBundleTypeRole</key> <string>Editor</string> <key>CFBundleURLName</key> <string>com.microsoft.adalcache</string> <key>CFBundleURLSchemes</key> <array> <string>msauth.<Bundle_id></string> </array> </dict> </array>
  Entitlement
  `

aps-environment development com.apple.developer.associated-domains msauth.://auth keychain-access-groups $(AppIdentifierPrefix)com.microsoft.adalcache `

[antonioalwan]

PING-COPILOT: review reply

[github-actions]

Thank you for providing the details! Here's a focused review and guidance using the MSAL public APIs and your specific configuration:

Key Points from Your Setup

• loginHint: You are NOT setting loginHint in MSALInteractiveTokenParameters. That's fine—MSAL will not pre-fill any value.
• promptType: You are using .promptIfNecessary (which corresponds to MSALPromptTypePromptIfNecessary). This is the default, so the UI will only prompt for login if needed.
• parentViewController: You are using a new UIWindow and root view controller because you launch from SwiftUI. As per MSALWebviewParameters.h, the parentViewController must have its view attached to a window and be the key window. Your approach aligns with this.
• Authority, redirect URI, and Info.plist: All appear correctly configured.

Diagnosis and Recommendations

1. Email Validation Error

The MSAL library itself does not validate the email format—it simply displays the authentication UI from Microsoft (which might validate the input). Since you do not use loginHint, the user must manually type the email. The error “Enter a valid email address...” is thus returned by the webview’s Microsoft-hosted login page.

Given your steps:

• On first attempt, error is shown—even if the email is valid.
• On retry, erase/retype, or dismiss/open again, login proceeds.

This pattern hints at a quirky browser session state or input handling issue, possibly triggered by ephemeral sessions or your custom window setup.

2. Possible Causes

• Ephemeral Session: You are using MSALWebviewParameters.prefersEphemeralWebBrowserSession = YES. This instructs MSAL to request an ephemeral (private/incognito) browser session via ASWebAuthenticationSession. This can sometimes cause odd UI states or input bugs if Apple's framework or the Microsoft login page hasn't initialized correctly.
• SwiftUI/Window Management: Creating a new UIWindow as a workaround for SwiftUI is common, but if the view controller isn't fully attached at the point of presentation, initial input focus or state may be affected.

3. What to Try

A. Test Without Ephemeral Browser Session

Try explicitly setting prefersEphemeralWebBrowserSession to NO and see if the issue persists. Here's how:

MSALWebviewParameters *webviewParameters = [[MSALWebviewParameters alloc]
    initWithAuthPresentationViewController:yourViewController];
webviewParameters.prefersEphemeralWebBrowserSession = NO;

MSALInteractiveTokenParameters *interactiveParameters =
    [[MSALInteractiveTokenParameters alloc] initWithScopes:@[@"user.read"]
                                        webviewParameters:webviewParameters];
interactiveParameters.promptType = MSALPromptTypePromptIfNecessary;

[application acquireTokenWithParameters:interactiveParameters
                        completionBlock:^(MSALResult *result, NSError *error)
{
    if (result)
    {
        NSLog(@"Access token: %@", result.accessToken);
    }
    else
    {
        NSLog(@"Error: %@", error);
    }
}];

B. Test With loginHint

If you know the user's email, try setting the loginHint property and see if the error resolves. This pre-fills the username field in the Microsoft login page:

interactiveParameters.loginHint = @"user@example.com";

C. Window Initialization

Double-check that immediately before token acquisition, your SwiftUI workaround's view controller is:

• Key window
• Has its view fully attached (view.window != nil)
• Not being dismissed/faded in/out

4. Logging

You mentioned a crash after calling MSALGlobalConfig.loggerConfig.setLogCallback. This bug is unrelated to the email validation error, but for troubleshooting, consider updating MSAL to the latest version (if possible) to see if the logging crash and interactive sign-in bug are resolved.

Summary Table

What Happens	Possible MSAL Cause	Try This
Email error on first attempt	Input/session edge, ephemeral session	Set ephemeral to NO, try loginHint
Success on retry	Browser session resets	See above
Logging crash	Library bug in 2.13.0	Update MSAL version

References

• MSALInteractiveTokenParameters.h
• MSALWebviewParameters.h
• MSALPublicClientApplication.h
• MSAL API usage examples - .clinerules/03-MSAL-API-usage.md
• Ephemeral session info: Apple documentation

Let me know the results of these tests or if you need more help with a specific Objective-C snippet!

---

Need further assistance? Comment with PING-COPILOT: <your question> to trigger a follow-up.

Want to disable automated replies on this issue? Comment with STOP-COPILOT.

This comment was generated by an automated assistant in response to your follow-up request. A maintainer will follow up as needed.

[antonioalwan]

Hi KarimMousa89, thanks for the additional details.
The email validation message is generated by the Microsoft-hosted sign-in page, not MSAL itself. However, if this issue persists and you want to determine whether it’s related to the browser session, please:

1. Update to MSAL 2.14.1 and confirm whether it still reproduces.
2. Test with  prefersEphemeralWebBrowserSession = false .
3. Confirm the iOS version, device model, and whether the address was typed, pasted, or entered through autofill.
4. For the logging crash, please provide the exception reason and a redacted stack trace. MSAL’s logging callback can only be registered once per process; Debug builds intentionally raise an exception if another component has already registered it.

Please do not include the actual email address or other sensitive information in the issue.

[KarimMousa89]

Hi Antonio Alwan (@antonioalwan), Thanks for your support.

I have updated MSAL to the latest version (2.14.1) and verified the following recommendations, but the issue still persists:

1. setting prefersEphemeralWebBrowserSession = false, the issue still occurs
2. ensure that parentViewController.view.window != nil & window.isKeyWindow = true
3. Setting loginHint bypasses the email entry screen, which prevents the issue from occurring. Unfortunately, this is not a viable solution in my case because I do not know the user's email address before initiating the MSAL login flow.

For testing, I am using an iPhone 13 Pro Max running iOS 26.2, and the issue occurs consistently.

Regarding the crash, I'm trying the following snippet in my app initialization to avoid duplicate registration, however crash persist

import MSAL
@main
struct TestApp: App {
    init() {
        MSALGlobalConfig.loggerConfig.logLevel = .verbose
        MSALGlobalConfig.loggerConfig.setLogCallback { (level, message, containsPII) in
            if let message = message, !containsPII
            {
            print("MSAL log: \(message)")
            }
        }
}

I've attached the crash logs here

Tahakom’s iPhone 13 promax-00008110-00114540210A401E.zip

One important observation is that the crash does not occur during app initialization. It only happens when the user attempts to sign in using MSAL.

Please let me know if there is any additional information or diagnostics I can provide to help investigate this issue.

[antonioalwan]

Hi KarimMousa89 , thank you for providing the crash reports.

The reports confirm that the logging crash is not caused by registering the MSAL callback more than once. Both crashes show a Swift concurrency executor mismatch:

_dispatch_assert_queue_fail
_swift_task_checkIsolatedSwift
closure #1 in testRevampApp.init()
MSIDLogger ... logWithLevel ...

The callback created inside your SwiftUI App.init() inherits main-actor isolation, while MSAL delivers log callbacks asynchronously on its private com.microsoft.msidlogger-* serial queue. When the first MSAL log is emitted during sign-in, Swift detects that the main-actor-isolated closure is running on the logger queue and terminates the app with EXC_BREAKPOINT/SIGTRAP. This explains why registration succeeds at launch and the crash occurs only after sign-in starts.

As a fix, please create the callback from a nonisolated context and explicitly make it Sendable (@sendable):

import MSAL

@main
struct TestApp: App {
    init() {
        Self.configureMSALLogging()
    }

    nonisolated private static func configureMSALLogging() {
        MSALGlobalConfig.loggerConfig.logLevel = .verbose

        let callback: @Sendable (MSALLogLevel, String?, Bool) -> Void = {
            _, message, containsPII in
            guard !containsPII, let message else { return }
#if DEBUG
            print("MSAL log: \(message)")
#endif
        }

        MSALGlobalConfig.loggerConfig.setLogCallback(callback)
    }

    var body: some Scene {
        WindowGroup {
            ContentView()
        }
    }
}

Please try this change and confirm whether it prevents the crash and allows you to collect the MSAL logs. If your real callback updates UI state, keep the outer callback nonisolated and use Task { Charly Firpo (@mainactor) in ... } only for the UI update.

The logging crash appears separate from the original hosted sign-in page email-validation behavior. Once logging works, please attach the redacted logs covering a reproduction of that behavior. Do not include email addresses, tokens, tenant identifiers, or other sensitive information.