If we develop a native application for B2C and after user logs in he clicks a link which is a web application with B2C same tenant. And if the SSO settings in B2C are set to tenant.
https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-token-session-sso
Can we achieve SSO i.e. a user is not asked to re-enter credentials?
Independent of how the different applications are registered with the Azure AD B2C tenant and what the SSO options are set to, the SSO session is implemented by a browser cookie/s that is maintained by Azure AD B2C in the browser session.
So, if you can share the browser cookies between your native app and your web site on the same device, then you should experience SSO between the two apps.
Authentication libraries, such as AppAuth for Android, AppAuth for iOS, Microsoft Authentication Library (MSAL) for Android and MSAL for iOS, implement the browser integration between your native app and Azure AD B2C for you. They also implement "the best current practice [which] is to perform the OAuth authorization request in an external user agent (typically the browser) rather than an embedded user agent (such as one implemented with web-views)."
It's a bit challenging to follow whether the native platforms do allow the browser cookies to be shared between apps and sites on the same device but I'll attempt to summarize my current understanding.
For Android, AppAuth and MSAL use Chrome Custom Tabs, which does allow the cookie data ("the cookie jar") to be shared so "users don't have to log in to sites [e.g. Azure AD B2C] they are already connected to".
For iOS 11, AppAuth and MSAL use SFAuthenticationSession, which does allow the cookie data to be shared but "users are prompted by a dialog to give explicit consent" to do so.
For iOS 10 and 9, AppAuth and MSAL use SFSafariViewController, which also does allow the cookie data to be shared.
