Exception is thrown when using msal-browser for NAA in Outlook desktop

[dariussantaras]

Core Library

MSAL.js (@azure/msal-browser)

Core Library Version

3.27.0

Wrapper Library

Not Applicable

Wrapper Library Version

None

Public or Confidential Client?

Public

Description

I have set up NAA in an Outlook Add-in as per documentation here. When I create a client (createNestablePublicClientApplication()), it throws an exception during the initialization in the Outlook desktop classic (Current Channel, Version 2411 Build 18227.20138) application.

It is only reproducible in the latest msal-browser (v3.27.0) and the reason for it may be this change. It tries to determine if the runtime is a browser environment by checking if window is defined and then goes on to call window.location.href. Outlook desktop classic client for some wild reason defines window, but not window.location, causing the initialization to blow up.
There's no easy way for me to get any more (js) logs either, because it's not an actual browser.
Also, note that this only happens on event based activation, not the taskpane.

Error Message

TypeError: Cannot read properties of undefined (reading 'href')

MSAL Logs

Due to the runtime environment, I do not have access to the console and cannot get any logs. I provided a detailed description on the error cause.

Network Trace (Preferrably Fiddler)

• Sent
• Pending

MSAL Configuration

{
	auth: {
		clientId: applicationId,
		authority: 'https://login.microsoftonline.com/common',
	}
}

Relevant Code Snippets

const pca = await createNestablePublicClientApplication({
	auth: {
		clientId: applicationId,
		authority: 'https://login.microsoftonline.com/common',
	},
});

Reproduction Steps

1. Set up an Outlook add-in to get an NAA token on event-based activation
2. Run the add-in on Outlook desktop client
3. Add-in runs and throws an exception when initializing

Expected Behavior

The initialization should not throw an exception.

Identity Provider

Entra ID (formerly Azure AD) / MSA

Browsers Affected (Select all that apply)

Other

Regression

@azure/msal-browser 3.26.0