How do I explain Azure AD SSO and its tokens?

Short explanation:

Single sign-on lets an application rely on an identity provider so users can reuse an established login. OIDC supplies login identity on top of OAuth, while access and refresh tokens support API access and session continuation. The client and API validate different token purposes rather than trusting any token returned by the login service.

Key points:

• SSO lets a user reuse an identity-provider login across connected apps.

• OIDC adds login identity to OAuth; an ID token is for the client, an access token is for the target API.

• Authorization code flow exchanges a short-lived code for tokens; PKCE protects the code exchange.

• Validate issuer, audience, signature, expiry and allowed tenant; protect refresh tokens and use state/nonce as required by the flow.

• In a typical code flow: redirect to the provider, receive a code, exchange it with the required checks, then establish the application's authenticated state.

Interview point:

• Explain the flow your project actually used, including the intended tenant and API audience, without assuming every Azure AD integration uses identical settings.