►
From YouTube: Account Linking for Microsoft Teams apps
Description
In this 11-minute developer focused demo, learn how to migrate a non-Azure AD Web App to Microsoft Teams and deliver a Single Sign On (SSO) experience with your hosts Bob German and Aditya Challapally. This sample shows the linking of a user’s AAD id with their GitHub or SaaS app identity in an IdentityMap stored in a database. At login, the Authorization is based on associated (linked) identities found in Map. Also see how associations are added to map. This PnP Community demo is taken from the weekly Microsoft 365 Platform Community call recorded on October 4, 2022.
Demo Presenters
• Bob German (Microsoft) | @Bob1German
• Aditya Challapally (Microsoft)
Supporting materials
• Training - Microsoft Teams App Camp On Demand | aka.ms/AppCamp
• Article - Account linking with Microsoft Teams single sign-on | aka.ms/account-linking-article
• Sample - External OAuth identity linking in Teams Apps. | aka.ms/account-linking-sample
• Event - Teams App Camp LIVE EVENT, October 20, 2022, 8-9am Pacific | aka.ms/TeamsAppCamp
Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community
A
B
So
yeah
I
think
we're
just
going
to
be
kind
of
informal
here
between
the
two
of
us,
so
I've
got
some
stuff
prepared
and
dto
just
jump
in
whenever,
whenever
wherever
you
wish
on
this,
because
it
turns
out,
we
both
were
pursuing
this
very
similar
path
here
and
it's
a
really
important
pattern.
We
wanted
to
share
with
the
community
here.
So
let
me
start
so
that
well,
the
topic
is
account
linking
between
Azure
ID
and
teams
apps.
B
It's
still
usually
possible
to
use
Azure
ad
as
well,
and
that's
what
we're
going
to
kind
of
go
over
today.
So
let
me
show
you
the
example,
and
this
is
borrowed
from
the
app
Camp
Labs,
that
I'll
point
you
to
later
and
so
I
have
here
a
very
simple
application,
with
kind
of
a
very
basic
login
system
built
into
it.
So
I'm
going
to
just
log
in
as
let's
say,
Andrew
2
and
you
can
see
this
is
so
insecure.
B
B
The
problem
is:
if
I
go
into
teams,
I
can't
get
a
single
sign-on
experience,
so
I
have
to
click
a
button
and
the
button
is
there
because
it's
a
pop-up
window-
and
we
all
know
the
browser
rules
with
pop-up
windows
and
stuff,
like
that,
you
have
to
click
a
button
to
get
there,
and
so
now
I
can
do
the
same
login
and
it
works.
You
know,
and
that's
great
and
I
could
declare
victory
at
that
point
and
and
be
done.
B
But
then
our
presentation
would
be
very
short
and
our
users
would
probably
be
kind
of
unhappy.
So
here's
my
top
reasons
for
supporting
Azure
ID,
the
first
one
yeah
good
old
Northwind
right,
can't
can't
it'll
never
die.
Northwind
database
will
never
die
so
first,
it
allows
single
sign-on
across
devices,
so
users
aren't
going
to
get
any
extra
prompts
and
those
prompts
can
be
extra
annoying
on
your
mobile
device.
Where
you're
trying
to
you
know
log
in
again
and
again
single
sign-on.
B
You
could,
you
know,
never
think
about
it
again:
you're
logged
into
teams,
you're
done.
It
also
includes
some
key
security
features
like
multi-factor
auth
and
conditional
access
where
the
policies
are
controlled
by
the
Enterprise.
So
that's
going
to
make
the
Enterprise
a
whole
lot
more
comfortable.
Even
if
your
alternative
auth
scheme
supports
those
things
now,
you've
got
the
user
trying
to
come
up
with
another
MFA
prompt
right
so
against.
Let's
simplify
it
for
users,
no
extra
usernames
and
passwords.
B
B
In
this
case
it
would
be
which
ones
are
my
orders
right,
but
the
thing
about
that
is
that
if
it's
a
separate
login
system,
somebody,
probably
the
team
owner,
is
going
to
have
to
keep
track
of
everybody's
alternative
login
and
add
and
remove
them
as
appropriate
as
people
come
and
go
from
the
team.
So
that's
a
big
overhead
and
something
that
I
think
a
lot
of
people
might
not
really,
you
know,
be
organized
and
remember
to
do
that
up
front
sort
of
and
then
later
somebody
leaves
and
they're
like.
B
Oh,
what
was
what
was
that
person's
login
in
this
other
system,
so
I
can
take
away
their
access
and
maybe
maybe
the
admin
just
goes.
Oh
I'm,
too
busy
and
now
somebody
outside
the
company,
maybe
who
left
under
unfortunate
circumstances,
has
a
login
to
get
into
that
app
and
Company
data
that
they
shouldn't
have
it's
easier,
also
for
M365
admins,
who
ultimately
get
held
responsible
for
this
kind
of
stuff,
and
you
know
it's
important
for
them
to
have
a
way
of
managing
access.
B
A
B
Oh,
that's
a
really
good
one.
Then
I
should
put
that
on
the
slide.
You
know
I
actually
got
that
feedback
from
Partners
as
well
that
one
partner.
Actually
you
know
they
pretty
much
the
reason
that
they
started
their
app
and
now
there's
more
features
and
they're.
Taking
advantage
of
more
teams
features
was
because
of
the
Azure
ad
and
their
users
were
demanding
it
and
that's
helped
their
adoption
quite
a
bit.
B
A
tenant,
an
M365
tenant
is
matches
one
to
one
with
an
Azure
ad
instance,
and
then
all
the
users
and
guest
users
and
the
app
itself
are
all
registered
inside
of
azure
ID.
However,
when
you
have
a
scenario
like
the
one
I
just
showed
you
end
up
with
kind
of
two
islands,
so
teams
graph
all
the
data
behind
graph.
Oh
that's
another
one,
I
forgot.
Another
reason
is
so
that
you
can
call
graph
right
if
you
want
to
get
anything
about
the
user.
B
Maybe
you
want
to,
you
know,
check
their
calendar
to
see
when
they're
available,
or
maybe
you
want
to
just
get
their
profile.
Well,
obviously,
if
you're
in
the
other
Island,
you
can't
do
it
right.
So
that's
the
challenge
and
I'll
call
out
some
of
my
some
folks
that
I've
worked
with
in
the
GPS
team
and
the
partner
team
have
also
run
into
this
issue
the
the
solution
kind
of
generically
and
it's
going
to
be
a
little
different
for
every
application,
honestly,
depending
on
how
it's
written
is
to
link
these
identities.
B
So
let
me
show
you
what
that
looks
like
for
a
user
I'm
just
going
to
pop
in
here
and
stop
my
my
server
and
start
it
again
using
as
if
I
had
just
done,
one
of
the
app
Camp
Labs
instantly
there
and
now.
If
I
come
back
here
and
I
log
out
and
I
refresh
I'm
gonna
get
a
different
screen
and
it's
going
to
say.
Oh,
please,
log
in
using
your
Northwind
employee
login
to
link
it
to
your
team's
login.
B
So
this
is
going
to
accomplish
the
account
linking
so
it
looks
kind
of
the
same
as
before,
I'm
just
going
to
log
in
as
Andrew
and
it
works
like
before.
We
should
probably
take
this
log
out
button
away
because
it
doesn't
do
anything
anymore.
You
can't
you're
just
automatic
as
fast
as
you
would
log
in
log
out.
You
get
logged
back
in
again
and
that's
it
now.
I
could
go
to
my
phone.
I
could
go
to
another
computer
and
I'm
never
going
to
get
that
prompt
again.
Why?
B
Because
it's
actually
stored
here
in
the
back
end
and
if
I
kind
of
drill
into
here
to
the
data
you
can
see.
There's
this
little
identity
map
here
and
it's
taken,
the
Azure
ID
user
ID
and
the
employee
ID
and
Associated
them
there,
so
that
we
can
just
kind
of
automate
that
process
the
next
time
the
user
comes
back.
A
Yeah
actually
and
Bob
just
to
jump
in
here.
This
is
a
plan
approach
and
and
soon
we'll
present
another
approach
as
well.
This
is
an
easier
push
to
understand,
but
could
potentially
have
a
few
issues
certain
issues
if
you
want
to
do
it,
but
it's
really
easy
to
understand
it's
a
great
stepping
point
and
so
we'll
present
again
in
a
soon
another
approach
and
Bob
and
I
are
going
to
present
one.
That
is
a
little
bit
more
advanced,
but
it's
probably
a
little
bit
more
secure
in
other
things
as
well
and.
B
So,
if
you'd
like
to
try
this
out,
you
can
go
to
teamsapp,
AKA,
dot,
Ms,
slash,
apptip
and
go
and
take
what
you'd
want
to
do
is
is
take
this
B
path
instead
of
this.
So
the
a
path
assumes
that
the
app
already
had
Azure
ID
and
the
B
path,
you'll
see
that
you
set
up
the
non-azure
ID
app
and
then
that's
the
transition.
I
just
made
was
to
add
the
identity
mapping.
B
So
it's
a
pattern
you're
going
to
have
to
kind
of
figure
out
how
to
apply
that
in
each
situation
that
you're
in
so
I'll
just
sort
of
wrap
it
up.
With
this
slide,
we've
got
a
Hands-On
lab
with
the
bpath.
We've
got
the
account
linking
now.
This
has
been
a
detail,
just
wrote
an
article
and
a
sample
on
this,
and
this
is
great.
He
goes
into
a
little
bit
more
depth
on
how
this
all
works
and
is
there
anything
else
you
want
to
say
about
this.