I. The Trust Gap

     GenAI tools, such as ChatGPT, Claude, and Google Gemini have an immense potential to improve our quality of life and help out with a lot of global issues. Yet, there is a fairly strong and widely discussed consensus that GenAI can be inaccurate.

     A recent KPMG survey^[1] with over 48,000 people globally shows that even though 66% of them use GenAI regularly, only 46% felt willing to trust AI systems. It’s because many people are relying on GenAI output without evaluating its accuracy, which led to mistakes in their work.

     In my opinion, the problem is often not the technology itself, but the way it’s being used. GenAI, without a doubt, is incredibly powerful, but the quality of its output depends heavily on the quality of the prompt users provide. Learning how to create a clear, specific, and well-structured command or request when working with GenAI is the key to unlock these tools real potential.

II. What is prompt Engineering?

     Prompt Engineering is the essential skill of designing and refining prompts to improve the output of GenAI systems. Because GenAI models respond based on the specific input they receive, a well-structured prompt allows you to:

• Produce more detailed and relevant responses.
• Significantly improve output accuracy.
• Control the format and style of the final result.

III. Prompt Engineering Techniques.

     Now that we understand what Prompt Engineering is, let’s break down some of the widely used techniques to craft prompts^[2].

1. Zero-Shot Prompting:

          This is a technique where you present a task to the AI model without providing any examples or task-specific demonstrations. Its accuracy relies heavily on the strength of the underlying foundation model. The more advanced and capable the foundation model, the more likely the AI is to produce accurate results.

          Zero-shot prompting is often more suitable for straightforward tasks or when a quick response is needed, even though it can still handle more complex tasks with varying reliability.

2. Few-Shot Prompting:

          This technique involves providing a few examples within the prompt to guide the AI’s output. Instead of training the model, you guide it during inference by providing specific contextual examples (input-output pairs).

          If you provide the AI with only one example, then this technique is also called “Single -shot” or “One-Shot Prompting”.

3. Chain-of-Thought (CoT) Prompting:

          This is a technique where you break a task into a sequence of intermediate reasoning steps. This helps the AI model process logic more effectively, leading to more structured and accurate results. You can trigger this by providing examples of step-by-step reasoning or by simply adding instructions like “Break this into steps”.

          However, CoT prompting should be used selectively, mainly for tasks that require multi-step reasoning, where accuracy matters more than speed. In simpler cases, forcing step-by-step reasoning may slow the AI down or introduce unnecessary verbosity.

IV. Conclusion

     GenAI effectiveness depends largely on how it is used. Rather than viewing them as unreliable, It’s more productive to see AI as a tool that requires skill and thoughtful interaction.

     Mastering AI communication is becoming an essential skill in today’s digital world. By crafting clear and structured prompts, users can unlock the full potential of GenAI and use it more confidently and responsibly in their work and daily lives.

     If you're eager to take your Prompt Engineering skill to the next level and apply them to impactful, real-world projects, ISB VIETNAM offers an environment where Passions, Teamwork, Innovations, and continuous learning are part of our everyday work. Visit the official website now to learn more about our company services, and how you can become part of a team that values thoughtful, high-quality software engineering.

References:

[1] KPMG survey: https://kpmg.com/xx/en/our-insights/ai-and-technology/trust-attitudes-and-use-of-ai.html

[2] Inspired by: https://www.udemy.com/course/aws-ai-practitioner-certified/

Identity is one of the most important security layers of modern systems. Modern apps must connect to numerous services, making a centralized and stable login system essential.

In this context, Microsoft 365 login is a logical choice for enterprise systems. Azure provides a standardized identity platform, eliminating the need to build authentication mechanisms from scratch.

Overall

At the high level, ExpressJS only acts as the client. Azure AD is the main entity, acting as the identity provider. The browser only handles redirects, while all sensitive processing, such as exchanging code for tokens, takes place in the backend.

The basic flow would be:

User → ExpressJS → Microsoft login → ExpressJS callback → session creation

Most importantly, the token never appears on the frontend. This is extremely important from a security perspective.

Setting up Azure AD

First, create a new application in Azure Active Directory via the Azure Portal.

Then create a Client Secret. Simply put, this is the "password" for the backend.

Finally, we will have three values; these three are the backbone of the entire login process:

• Client ID – app identifier
• Tenant ID – organization identifier
• Client Secret – backend authentication

MSAL node configuration

Microsoft provides @azure/msal-node so developers don't have to manually code OAuth2. MSAL handles the headaches of code generation, token changes, token caching, and token refresh.

Installation:

npm install express @azure/msal-node express-session dotenv

Basic configuration:

// msalConfig.js

require("dotenv").config();

module.exports = {

    auth: {

        clientId: process.env.CLIENT_ID,

        authority: "https://login.microsoftonline.com/" + process.env.TENANT_ID,

        clientSecret: process.env.CLIENT_SECRET

}};

The Authority URL simply tells MSAL which tenant we are authenticating with.

After defining the config, we will create the other file to initialize the instance to use in the project

// msalClient.js

const { ConfidentialClientApplication } = require("@azure/msal-node");
const msalConfig = require("../config/msalConfig");

const cca = new ConfidentialClientApplication(msalConfig);

module.exports = cca;

Scope: Request only what we need

Scope refers to access permissions. It determines what the app can do on behalf of the user.

Here are some common scopes:

• user.read – read basic profiles
• mail.read – read email
• files.read – read OneDrive files

The first time a user logs in, they will see a consent screen. This is very good, as it helps them know what permissions the app is requesting.

Actual login flow

Here, we use the OAuth2 authorization code flow – almost the default standard for backends.

The token is not exposed to the frontend. There is a refresh token widely accepted by enterprises

Route /login

const cca = require("./services/msalClient"); 

app.get("/login", async (req, res) => {

   const url = await cca.getAuthCodeUrl({

     scopes: ["user.read"],

     redirectUri: "http://localhost:3000/redirect"

    });

   res.redirect(url);

 });

This route only serves to redirect the user to the Microsoft login page.

Note: The redirectUri in the code must match the Redirect URI declared in Azure AD.
If they don't match, the login will fail.

Route /redirect

const cca = require("./services/msalClient"); 

app.get("/redirect", async (req, res) => {

   const tokenResponse = await cca.acquireTokenByCode({

     code: req.query.code,

     scopes: ["user.read"],

     redirectUri: "http://localhost:3000/redirect"

   });

   req.session.user = tokenResponse.account;

   req.session.accessToken = tokenResponse.accessToken;

   res.redirect("/dashboard");

 });

This is the main processing point: the backend exchanges the code for a token and then saves the session.

Sessions and Middleware

After establishing the session, protecting the route with middleware is all we need to do.

 function requireAuth(req, res, next) {

   if (!req.session.user) {

     return res.redirect("/login");

   }

   next();

 }

Conclusion

Microsoft 365 login is becoming the standard for modern enterprise systems. Instead of managing users, passwords, and complex security rules ourselves, we can directly use Azure Active Directory as a trusted identity provider.

In practice, this offers better security, less maintenance, and a login system that can scale across the organization without significant changes.

Whether you need scalable software solutions, expert IT outsourcing, or a long-term development partner, ISB Vietnam is here to deliver. Let’s build something great together—reach out to us today. Or click here to explore more ISB Vietnam's case studies.

[References]

1. https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
2. https://learn.microsoft.com/en-us/entra/identity-platform/tutorial-v2-nodejs-webapp-msal
3. https://www.freepik.com/free-photo/email-messages-network-circuit-board-link-connection-technology_1198384.htm (Image source)