How are users authenticating to the edison365 app?

Authentication and authorization is handled by SharePoint / Office365.

edison365 does not control the standard used in the authentication process.

If you would like to understand more about how authentication and authorization work, please refer to the following documents from Microsoft:

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/authorization-and-authentication-of-sharepoint-add-ins

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/creating-sharepoint-add-ins-that-use-low-trust-authorization