In this month's call, Loki Meyburg, Program Manager for Microsoft Teams discusses single sign-on (SS0) in Microsoft Teams, including: -What is single sign-on (SSO) -Authentication in 2019 -Single sign-on for Teams tabs today! -Getting starting with SSO Watch the recording here - https://youtu.be/91Sb5lz3STI

1. Single Sign-On for Teams Tabs
Loki Meyburg, Platform PM
February 18, 2020
Microsoft Teams
Developer community call

2. Call agenda

3. Loki Meyburg
@lokimeyburg

4. • Azure AD Single Sign-On support for Teams “tabs”
• Sign-in your users with the same account they’re using in Teams
• Users never have to sign-in again
• Improved developer experience for building authentication

5. Single Sign-On

6. • We already support cookie-based authentication
• We support “faux-SSO” with silent authentication (still cookie-based)
• If an auth cookie has expired, we allow you to briefly surface an authentication
pop-up to fetch a new valid cookie
• Sample code available in our documentation
• Doesn't work cross-device 😢
• Authentication is one of our biggest developer complaints
Authentication in 2019

7. Authentication in 2019

8. Skip signing-in to apps in TeamsEnd user
Simpler development when it comes to
authenticationDeveloper
Protect user privacy and security through
conditional access policiesIT Admin
Common needs

9. Teams ♥ Azure AD
 Teams Tabs authentication can be built
using Azure AD single-sign on
 Faster load times
 Easier development
 Works on desktop + mobile
 Conditional access policies apply

10. Consent once, and then be
automatically signed in on any
device any time you visit that
tab.
⭐

12. • Register in AAD Portal
• New app type should be "Accounts in any organizational directory and personal
Microsoft accounts"
• Get your App ID
• Expose an API
• api://fully-qualified-domain-name.com/$AppID$
• Add a scope
• access_as_user
• Authorize the Teams applications
• Under "Authorized client's applications" allow the Teams app to request a token
• Client ID: 1fec8e78-bce4-4aaf-ab1b-5451cc387264
SSO – 1) AAD App Registration

13. • WebApplicationInfo- Add this property
to your manifest
• Id- The client ID of the application. This is
an application ID that you obtain as part
of registering the application with Azure
AD.
• Resource- The domain and subdomain of
your application. This is the same URI
(including theapi://protocol) that you
used when registering the app in AAD. The
domain part of this URI should match the
domain, including any subdomains, used
in the URLs in thesection of your Teams
application manifest.
SSO – 2) Teams Manifest
"webApplicationInfo": {
"id": "<application_GUID here>",
"resource": "<web_API resource here>"
}

14. • Here's what the authentication API
looks like:
var authTokenRequest = {
successCallback: function(result) { console.log("Success: " + result); },
failureCallback: function(error) { console.log("Failure: " + error); },
};
microsoftTeams.authentication.getAuthToken(authTokenRequest);
SSO – 3) Get an auth token using the SDK

16. https://aka.ms/teams-sso
https://aka.ms/teams-sso-sample

17. Register an app with AAD

25. Update your Teams code

28. Constraints

29. 1. Only works with Azure Active Directory (ie: we don’t support Google auth, etc)
2. Your AAD app URI needs to match the domain name of your Teams tab (to verify you
own the domain)
3. We do not support hosting from azurewebsites.net (yet)
4. We can only provide you “authentication” permissions
1. To get “authorization” for additional permissions, you must exchange the token using Azure
Active Directory’s on-behalf-of flow.
5. Mobile is not supported (yet)
Constraints

30. More about today’s topics:
https://aka.ms/teams-sso
https://aka.ms/teams-sso-sample
https://myapplications.microsoft.com/

31. Microsoft 365
https://aka.ms/adaptivecardscommunitycall
https://aka.ms/microsoftgraphcall
https://aka.ms/IDDevCommunityCalendar
https://aka.ms/microsoftteamscommunitycall
https://aka.ms/officeaddinscommunitycall
https://aka.ms/PowerAppsMonthlyCall
https://aka.ms/spdev-call
https://aka.ms/spdev-sig-call
https://aka.ms/spdev-spfx-call
https://aka.ms/M365DevCalls

32. https://aka.ms/M365DevYouTube
(subscribe today)
@Microsoft365Dev
https://aka.ms/microsoftteamscommunitycall