Microsoft 365 Community Adaptive Cards, 24 Sep 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Power Up Power Virtual Agents with Microsoft Graph - Demo

Description

Tomasz Poszytek shares a community demo on how to Power-Up Power Virtual Agents with Microsoft Graph.

A

So there's a few words about myself, uh I'm with applications mvp and working with those power platform tools for over three years, so I quite got sung into and well just long story short. If you want to know more about me or learn something about my work, what I'm doing where I'm contributing simply uh follow my my alias on ak dot, ms slash project I can there, you find all the hyperlinks or social media contacts that you need to stay in touch with me.

A

So that's it about this slide, so we're gonna switch now into something uh different, so from powerapps and all these cool stuff around powerapps uis, which I really loved to something more near the automation in many other processes that I love. I know that most of you who are on the call is aware that we have this powerful agent's edition where we can build and know code chat, bots that can interact with our internal employees with our customers, so they can be public facing.

A

I know this costs quite a lot because, like one thousand dollars when per sessions or the other way around. Nevertheless, this is a cool tool, because you can actually create great chat bots that can really help your business work more smooth and can just put a lot of workload from your customer services. Your contact centers uh onto the chat bots, so that customers can use them to ask questions now. What I want to show you is that when we want to use these chat bots internally, we can actually or even not internally.

A

But if you, if you want to use the chatbot with an oauth 2.0 provider, then we can actually get the user context and when speaking about microsoft, this provider is obviously azure id. So like in my case when I start a conversation with the bot, and I asked.

A

Can you show sorry me my data, for example, and then because this triggers a topic where bot is actually requesting me to provide my error token. Therefore, it is asking me first to login so because now I'm in a very private session, therefore, I will now go through the regular sign up process or authentication process.

A

A

So now what is going to happen right now is: I will be directed to a web page where there is a token generated, is validation code. Now, once I copied, the bot is actually able to acknowledge that I actually got logged in, and so it was able to generate us for the better token, which I can later use, for example, to graph api in the context or on behalf of the user with which the body is conversating.

A

So now I'm going to ask show my tasks to check.

A

It was an error. Okay, but.

A

Maybe there is going to be something about my data right, possibly uh general researcher has no tasks assigned, so there are no planning tasks, but, for example, when I asked about my data, I was able to get the information that the user's name, who is now conversating, is john researcher and I'm actually that user's manager.

A

Now, how was it actually done, how you can achieve the same situation, because that is really useful when you want to create a bot that is actually being used internally, and I bet that there are going even more awesome things to be announced during ignite, but let's say keep keeping us crossed on what announcements we're gonna hear.

A

Nevertheless, today, when you want to go and authenticate a user, you need to first go under the authentication uh setting in your profitable agents and there you need to feel a lot of fields actually with information that is coming from azure id now on this web page here that is present inside this configuration page, you have a very detailed walkthrough on what information is required in each of these fields in regards to azure id. So there are those those examples just for the azure id. However, I said you can actually use any other oauth provider.

A

It doesn't have to be actually edge ready. So now, once you do have all these information provided here and configured, then you're able to use this authentication now, once you want to put that authentication in your topic, then just go directly to.

A

Designing canvas or authoring canvas, then, within the conversation flow.

A

You'll realize that there is a new action under calling action group of activities. So besides, so besides, all these flows that you can choose from there should be as well an action that is called authenticate. Oh yes, there is, there is one, so it has to be like the one, the last action in the in the set of control in the flow of the conversation.

A

So now, once I put it in it, will automatically generate me the action to authenticate and the branching. What should happen once the user is logged in and what should happen if the login fails? One of the outcomes of the application is is auth token. So that's actually the better token that we can use to call graph api in the context of the user.

A

So now, once I go to flow and that's the example of the flow that asks that tries to gather user users data, then the first thing I'm doing is actually calling graph api in the context of myself. So just calling the end point zero one one one zero slash me and then in advanced I'm using the raw authentication and simply providing this bearer and the token that is being passed from the particle agents. Once I call this flow, so let me show you how it works uh in the virtual agent.

A

So now, if I'd like to- let's say here- uh I'm just clicking too fast, if I'd like now to call in action and then find the one that says: wow there's so many of them like get user info, then because I have configured the flow to actually expect that there is one input variable or input value. That is called token and therefore I need to provide here a value, and this is going to be this variable that stores the bearer token. Now.

A

What is also important in this authentication approach that we have in particular agents is that so this is also a global variable and therefore, even if I go into a topic where I don't explicitly or explicitly put this authentication.

A

But I would like actually all right now, there's some bad things happening into the conversation.

A

A

Right so when I, if I would like to use this action here, sorry this token here, because it is still available, it is, as you can see, a global variable that can be used by any both. Therefore, if I start this conversation.

A

Let me save it so that I will be able to trigger this topic to test it.

B

Hey thomas for those folks who haven't configured the auth on this before you showed the page where to do it, how long does it typically take you to walk through that? This is.

A

Like 10 minutes maximum, because all right, so it doesn't work yet to trigger this topic, maybe some time to get. Let me just show you in a.

B

Moment so, essentially in 10 minutes you can go from having.

A

B

Getting set up and now you've got basically because.

A

Basically, all the information that we need to pass in here is actually in our hrd, and these that are, let's see, general, like those patterns or the templates for strings that can be directly copied from the documentation.

A

So the only thing that you actually need to provide is to go to azure id, which I have opened over here.

A

And then create new application in your azure. uh Well, you know ajid. Actually, then you need to grant this application well open id permission and user read all this is definitely on the application level and ground is admin constant and then, once you grant this those application permissions, you need to simply go into certificates to generate a new certificate that you need to copy over to the configuration page plus. You need to go to overview to copy the application client id so that one and now once all is done then or you're simply home.

A

So this is actually the only the only thing that you are requested to do regarding this configuration, the rest is actually the information can copy directly from the recommendation.

A

So that's really really easy, and now once this is done, that should work.

A

Okay, but it doesn't.

A

But nevertheless, you have to trust me because those okay, because the trigger phrases were not saved.

A

A

So I can remember that this test topic doesn't have any authentication action added directly.

A

It is just using this global variable and therefore, even if I now start figure, it will ask me to authenticate right, because this is how the global variables work, so they are just navigating the user to the place where the variable is going to be initialized.

A

So in this case this all works fine. So right now it's just going to call the graph api via the power automate and should get me back the information about myself and possibly did, but I didn't add any action to actually write the output from the power automate. So it worked, the authentication went smoothly. There is no action needed because the variable is in place, so this is actually how you can use the authentication in particular agents. Then one last thing I wanted to show you is about the situation.

A

When you add your bot into teams. So, therefore, if you have about in teams, then unfortunately it doesn't read users context. That's again, I hope this is going to change after ignite. Let's see what was there coming up with, but if I said.

A

Then again, the first, no that's the wrong. That's the wrong topic and just jump.

A

A

So I'll start with that, previous.

A

Question right so in here also, even though I'm logged into microsoft teams, let ddbe microsoft teams desktop or the web browser version, then I still need to log in because this session that the bot is actually running, it's not authenticated, so the user here is just an unknown persona and the bot is not having an access to my information within teams, although, as you saw, this authentication was faster now, it worked was faster because I wasn't actually requested to copy paste this confirmation code. It was just once I hit to login.

A

It took the credentials or my contacts from the browser so from microsoft teams, so this is a little bit faster and uh easier for the user, and so that's it can you identify.

B

I I have a question: I've never tried this before I'm curious. So if, if you're running in one of these- and you pull back that property, that gives you the bearer token, can you go, they can invoke another flow and throw the bearer token at that flow and do that action on behalf of that user and the other flow.

B

A

Okay, so what once you get the very token and well, it is his expiration date is a the time. Is I think, 15 minutes or something so as long as the better token is an expired, can actually use it across different calls to graph api, or you know, you'll need to be sure that user has an access to those specific, maybe graph api areas or data.

B

Absolutely thank you for showing us that that's so helpful and it's so easy too right just go set it up and then boom you've got your auth your token and you're off and running.

A

Right um daniel, you asked if we can use this as another method of mfa. I doubt so. This is not for authentication of a user to systems.

A

This is rather to well okay, sort of authentication, but you need to be authenticated in the first place to be able to use this security, I mean secure calls to graph api from pva. So it's not meant to be the authentication, endpoint or sort of, but you can. If you have your own oauth 2.0 provider and it's working with the cloud applications, you can obviously use it as the authentication provider for private agents as well all right, okay. So thank you very much.

B

Very good, thank you for being here and showing that to us.