Have you configured your Enterprise with SAML? Here are instructions specific to Azure AD.
If so, the best way to do this is instead of your JS app authenticating with your Azure AD, you redirect it to your Portal sign in page which is set up with SAML. Your Portal then authenticates with your Azure AD, creates an ArcGIS Token, and then redirects back to your application with the token which allows you to access secured services.
To do this, you would need to set up an application in your portal to get an App ID. The code below would be used to authenticate
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="initial-scale=1, maximum-scale=1,user-scalable=no" />
<title></title>
<link rel="stylesheet" href="https://js.arcgis.com/4.14/esri/themes/light/main.css" />
<script src="https://js.arcgis.com/4.14/"></script>
<style>
html,
body,
#viewDiv {
padding: 0;
margin: 0;
height: 100%;
width: 100%;
}
</style>
<script>
require([
"esri/identity/OAuthInfo",
"esri/identity/IdentityManager",
], function (OAuthInfo, esriId) {
var info = new OAuthInfo({
appId: "APPID",
portalUrl: "https://SERVERNAME/portal",
popup: false
});
esriId.registerOAuthInfos([info]);
esriId.getCredential(info.portalUrl + "/sharing");
esriId.checkSignInStatus(info.portalUrl + "/sharing")
.then(function (evt) {
initMap();
})
.catch(function (err) {
console.log(err);
});
function initMap() {
}
});
</script>
</head>
<body>
<div id="viewDiv"></div>
</body>
</html>
