The app launcher in your tenant
Signed-in tenant users have an Applications page at /account/apps on your tenant's address. It lists the applications you choose and opens each one with a single click.
The Applications page
In a client's settings, enter its login initiation endpoint (initiate_login_uri, an https address without a fragment) and choose List on people's Applications page. Enabled clients with both appear, except applications that still need an administrator's approval. SAML applications appear when List on people's Applications page is chosen in their settings.
What the application receives
Opening an OpenID Connect application sends the browser to its login initiation endpoint with iss (your tenant's issuer), target_link_uri (the client's home page address, when it has one) and, when you choose Send the person's email address as login_hint, login_hint (OpenID Connect Core section 4). The launcher only asks the application to begin: it never sends a code or token. The application then makes an ordinary authorization request, which your tenant answers from the person's session. An application should refuse any authorization response it did not ask for.
SAML applications
A SAML application opens with an assertion your tenant sends without a request (IdP-initiated), posted to its assertion consumer service with its default RelayState. See SAML in your tenant.
Audit
Each launch is recorded under account.launch with app_launched and the application, and a launch of an application that is no longer listed with launch_unavailable.