[mattleibow]

Adds a Microsoft Entra alternative to the .NET 10 Blazor Hybrid Identity sample, supporting either External ID customer tenants or workforce tenants without duplicating the sample. The existing local-account sample is unchanged.

Approach

• Preserve the four-project native MAUI, Blazor server, hosted WebAssembly, and shared Razor structure, with public Home, protected Counter/Weather, and a server-protected weather API. No BFF or separate API service is added.
• Keep authentication setup visible in the startup files. Select External ID or workforce with one web configuration-section selection and one native MsalConfig record registration. DI constructor-injects the record into the singleton MsalClient, which exposes it through Configuration; the authentication service receives the client rather than a separate configuration object. External ID remains the default; only one profile is active per run.
• Use Microsoft.Identity.Web for server-owned OpenID Connect code-flow sign-in and cookies. Preserve InteractiveAuto rendering and serialized browser authentication state without putting tokens in WebAssembly.
• Use MSAL for native browser sign-in, token caching, and silent acquisition, including the reference tutorial's Mac Catalyst ASWebAuthenticationSession adapter. Register both profiles' native callback schemes and isolate browser cookies/native caches between configurations.
• Accept authenticated browser cookies or validated API access tokens with the Weather.Read delegated scope. Do not treat ID tokens as API access tokens.
• Omit local Identity accounts, databases, registration/password forms, and opaque-token management from the new variant. Include practical tenant/app-registration instructions and a sample-scoped Snippets web-only build command.

Validation

• .NET 10.0.401 web/shared/WASM Debug and Release builds passed.
• Android builds passed with both configuration selections. iOS simulator and unsigned Mac Catalyst builds passed; Mac Catalyst still requires signing/provisioning for its keychain entitlement before running.
• 42 local authorization checks passed for each web tenant profile, including profile-specific settings, cookie isolation, cookie/bearer separation, JWT scope/audience/issuer/signature/lifetime validation, return URLs, and antiforgery-protected sign-out. Both native records and their singleton MSAL/authentication services were resolved through real constructor DI, including configuration ownership and blank/missing API-scope validation; generated callback schemes were checked locally.
• Tenant/app values remain placeholders as requested. Live Entra sign-in and Windows builds were not performed; no existing apps, simulators, or tenant settings were changed.