Skip to content

[Doc Improvement] [Rename Bot framework/Bot Framework SDK to Agent SDK] #13321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

[Doc Improvement] [Rename Bot framework/Bot Framework SDK to Agent SDK] #13321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0eeb808
Updated
KirtiJha-MSFT Sep 13, 2025
6473bb3
Updated
KirtiJha-MSFT Sep 19, 2025
d88550c
Update bot-sso-code.md
KirtiJha-MSFT Sep 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 18 additions & 4 deletions msteams-platform/bots/how-to/authentication/bot-sso-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,24 @@ You need to configure your app's code to obtain an access token from Microsoft E

This section covers:

1. [Update development environment variables](#update-development-environment-variables)
1. [Add code to handle an access token](#add-code-to-handle-an-access-token)
1. [Add code to receive the token](#add-code-to-receive-the-token)
1. [Handle app user sign out](#handle-app-user-sign-out)
- [Add code to enable SSO in your bot app](#add-code-to-enable-sso-in-your-bot-app)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please confirm if this is needed.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not required.

- [Update development environment variables](#update-development-environment-variables)
- [Add code to handle an access token](#add-code-to-handle-an-access-token)
- [C#](#c)
- [JavaScript](#javascript)
- [C#](#c-1)
- [JavaScript](#javascript-1)
- [Consent dialog for getting access token](#consent-dialog-for-getting-access-token)
- [Add code to receive the token](#add-code-to-receive-the-token)
- [C#](#c-2)
- [JavaScript](#javascript-2)
- [Validate the access token](#validate-the-access-token)
- [Example access token](#example-access-token)
- [Handle app user sign out](#handle-app-user-sign-out)
- [C#](#c-3)
- [JavaScript](#javascript-3)
- [Code sample](#code-sample)
- [Next step](#next-step)

## Update development environment variables

Expand Down
2 changes: 1 addition & 1 deletion msteams-platform/bots/how-to/authentication/bot-sso-graph-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,6 @@ You can configure Graph scopes in Microsoft Entra ID as required for your app. D

You've configured your app with Microsoft Graph permissions.

After you've completed the configuration in Microsoft Entra ID, you must update the code to acquire access token for Microsoft Graph. For more information, see [Bot framework SDK](https://github.com/OfficeDev/Microsoft-Teams-Samples/blob/main/samples/bot-teams-authentication/csharp/SimpleGraphClient.cs).
After you've completed the configuration in Microsoft Entra ID, you must update the code to acquire access token for Microsoft Graph. For more information, see [Bot Framework SDK](https://github.com/OfficeDev/Microsoft-Teams-Samples/blob/main/samples/bot-teams-authentication/csharp/SimpleGraphClient.cs).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update agents sdk here

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can't change the terminology in the hyperlink.


The app user is prompted to consent for Graph permissions on the first time they use it. After the app user gives consent, the Graph permissions are granted. For more information on Graph API permissions, see [permissions and consent](/azure/active-directory/develop/permissions-consent-overview).
2 changes: 1 addition & 1 deletion msteams-platform/bots/how-to/authentication/bot-sso-manifest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ For more information, see [webApplicationInfo](../../../resources/schema/manifes
3. `validDomains`

> [!NOTE]
> To handle authentication and token exchange, add `https://token.botframework.com` to the `validDomains` property for bots using Bot Framework. For OAuth URLs and data residency list, see [OAuth URL support in Azure AI Bot Service](/azure/bot-service/ref-oauth-redirect-urls?view=azure-bot-service-4.0&preserve-view=true).
> To handle authentication and token exchange, add `https://token.botframework.com` to the `validDomains` property for bots using Microsoft 365 Agents SDK (previously known as Bot Framework SDK). For OAuth URLs and data residency list, see [OAuth URL support in Azure AI Bot Service](/azure/bot-service/ref-oauth-redirect-urls?view=azure-bot-service-4.0&preserve-view=true).

6. Save the app manifest file. For more information, see [app manifest](../../../resources/schema/manifest-schema.md).

Expand Down
14 changes: 7 additions & 7 deletions msteams-platform/bots/how-to/authentication/bot-sso-overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,20 +31,20 @@ Now, let's see what happens at the backend during runtime to achieve SSO experie

## SSO in Teams at runtime

Achieve SSO in a bot or message extension app by obtaining access token for the Teams app user who's signed in. This process involves the bot app client and server, Teams client, Bot Framework, and Microsoft Entra ID. During this interaction, the app user must give consent to obtain the access token in a multitenant environment.
Achieve SSO in a bot or message extension app by obtaining access token for the Teams app user who's signed in. This process involves the bot app client and server, Teams client, Microsoft 365 Agents SDK (previously known as Bot Framework SDK), and Microsoft Entra ID. During this interaction, the app user must give consent to obtain the access token in a multitenant environment.

The following image shows how SSO works when a Teams app user attempts to access the bot or message extension app:

:::image type="content" source="../../../assets/images/authentication/teams-sso-bots/sso-runtime-seqd-bots.png" alt-text="SSO for bots and message extension at runtime" lightbox="../../../assets/images/authentication/teams-sso-bots/sso-runtime-seqd-bots.png":::

| # | Interaction | What's going on |
| --- | --- | --- |
| 1 | Teams client → Bot service | The message that app user sends is received by the Teams client, which sends it to the bot. <br> If the app user has previously signed in, a token is saved in the Bot Framework Token Store. The bot calls the Bot Framework Token Service which checks for an existing token for the app user in the Bot Framework Token Store. <br> • If the token exists, the app user is given access. <br> • If no token is available, the bot triggers the auth flow. |
| 2 | Bot service → Bot Framework Token Service | The bot calls the Bot Framework Token Service to obtain a sign in link for the user. |
| 3 | Bot Framework Token Service → Teams client | • **For bot app**: Bot Framework Token Service sends the request for sign-in link to the bot service, which forwards it to the Teams client in an OAuth card. <br> • **For message extension app**: Instead of the OAuth card, the Bot Framework Token Service sends an invoke request. |
| 4 | Teams client → Bot service → Bot Framework Token Service → Microsoft Entra ID | After the Teams client receives the OAuth card for the app user, if SSO is enabled, it sends a token exchange request for the app user back to the bot. The bot calls the Bot Framework Token Service, attempting to exchange the received token from Microsoft Entra ID. |
| 1 | Teams client → Bot service | The message that app user sends is received by the Teams client, which sends it to the bot. <br> If the app user has previously signed in, a token is saved in the Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Store. The bot calls the Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service which checks for an existing token for the app user in the Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Store. <br> • If the token exists, the app user is given access. <br> • If no token is available, the bot triggers the auth flow. |
| 2 | Bot service → Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service | The bot calls the Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service to obtain a sign in link for the user. |
| 3 | Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service → Teams client | • **For bot app**: Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service sends the request for sign-in link to the bot service, which forwards it to the Teams client in an OAuth card. <br> • **For message extension app**: Instead of the OAuth card, the Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service sends an invoke request. |
| 4 | Teams client → Bot service → Microsoft 365 Agents SDK (previously known as Bot Framework SDK)Token Service → Microsoft Entra ID | After the Teams client receives the OAuth card for the app user, if SSO is enabled, it sends a token exchange request for the app user back to the bot. The bot calls the Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service, attempting to exchange the received token from Microsoft Entra ID. |
| 5 | Microsoft Entra ID → Teams client | For the app user who's using the bot service for the first time, the token exchange can occur only after app user gives their consent. Teams client displays a message to the app user for giving consent. <br> In case the consent fails: <br> 1. The authentication falls back to the sign-in prompt and the app user must sign in to use the bot app. The sign-in button pops up in Teams client, and when app user selects it, the Microsoft Entra sign-in page is rendered. <br> 2. The app user signs in and grants access to the bot service. |
| 6 | Bot service → Bot Framework Token Service | The token for the app user is stored in the Bot Framework Token Store. |
| 6 | Bot service → Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Service | The token for the app user is stored in the Microsoft 365 Agents SDK (previously known as Bot Framework SDK) Token Store. |

For a bot or a message extension app, the bot app sends an OAuth Card to Teams client. This card is used to get access token from Microsoft Entra ID using `tokenExchangeResource`. Following app user's consent, Teams client sends the token received from Microsoft Entra ID to the bot app using `tokenExchange`. The bot app can then parse the token to retrieve the app user's information, such as email address.

Expand All @@ -53,7 +53,7 @@ For a bot or a message extension app, the bot app sends an OAuth Card to Teams c

## Enable SSO for a Teams app

The bot and message extension apps use Bot Framework to handle communication with the app users.
The bot and message extension apps use Microsoft 365 Agents SDK (previously known as Bot Framework SDK) to handle communication with the app users.

- **Bot app**: Also referred to as a chatbot or conversational bot, it's a service that runs simple and repetitive tasks for app users. Bots can be part of a larger application or be a standalone service.

Expand Down