Add backward compatibility for legacy Teams auth config - #628
Merged
Conversation
When AzureAd:ClientId is absent but Teams:ClientId is present,
BotConfig.Resolve() now maps the legacy shape to the canonical
AzureAd shape via an in-memory IConfiguration. This ensures all
downstream code (MSAL binding, JWT validation, UMI detection) sees
a consistent AzureAd-shaped section regardless of which config
format the user has set.
Mapping applied:
Teams:TenantId -> AzureAd:TenantId
Teams:ClientId -> AzureAd:ClientId
Teams:ClientSecret -> AzureAd:ClientCredentials:0:ClientSecret
(SourceType = ClientSecret)
Instance -> fixed to https://login.microsoftonline.com/
When both sections are present, AzureAd takes precedence.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Fall back to the legacy 'Teams' config section (TenantId, ClientId, ClientSecret) when the primary 'AzureAd' section has no ClientId - Remap the legacy shape to the Microsoft.Identity.Web ClientCredentials array structure so all downstream code sees a consistent AzureAd-shaped section without any changes - Default Instance to https://login.microsoftonline.com/ for legacy config - SectionName, JWT scheme, and MSAL named-options key all remain 'AzureAd' - Emit a Warning log with the full migration JSON example when the legacy section is used - Add 7 unit tests covering all backward-compat scenarios Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds backward compatibility in Microsoft.Teams.Core so apps still using the legacy Teams auth configuration shape (TenantId/ClientId/ClientSecret) can run on the 2.1+ Microsoft.Identity.Web (AzureAd) model by mapping legacy values into an AzureAd-shaped configuration section at runtime.
Changes:
- Added fallback logic in
BotConfig.Resolve(...)to map legacyTeamsconfiguration into an AzureAd-shaped in-memory configuration section when the primary section lacksClientId. - Added unit tests covering legacy resolution behavior and AzureAd precedence when both sections are present.
- Updated
Microsoft.Teams.Apps.csprojto suppress additional warnings (including a NuGet vulnerability warning).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| core/src/Microsoft.Teams.Core/Hosting/BotConfig.cs | Adds legacy Teams fallback and logging to keep runtime config shape consistent for downstream Microsoft.Identity.Web/MSAL binding. |
| core/test/Microsoft.Teams.Core.UnitTests/Hosting/BotConfigTests.cs | Adds unit coverage for legacy Teams fallback behavior and precedence rules. |
| core/src/Microsoft.Teams.Apps/Microsoft.Teams.Apps.csproj | Updates project warning suppressions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
MehakBindra
reviewed
Jul 29, 2026
- Map Teams:DangerouslyAllowUnauthenticatedRequests during legacy Teams->AzureAd fallback - Add unit coverage for legacy auth bypass behavior - Remove NU1903 from Microsoft.Teams.Apps NoWarn Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
MehakBindra
approved these changes
Jul 30, 2026
- remove ExperimentalTeamsQuotedReplies - keep only ExperimentalTeamsTargeted in NoWarn Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
MehakBindra
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
In 2.0, apps commonly configured bot auth with a
Teamssection (TenantId,ClientId,ClientSecret). In 2.1, the supported model is Microsoft.Identity.Web underAzureAdwithClientCredentials.This change preserves backward compatibility for the legacy
Teamsshape while keeping the 2.1AzureAdpath as the canonical runtime model.What changed
BotConfig.Resolve(...)to use legacyTeamsonly when the primary section has noClientId.AzureAd-shaped configuration section:TenantIdClientIdInstance(defaulted tohttps://login.microsoftonline.com/)ClientCredentials:0:SourceType = ClientSecretClientCredentials:0:ClientSecretSectionNameas the requested section name (defaultAzureAd) so JWT scheme naming and MSAL named options stay consistent for downstream consumers.Teamsis used, including the target Microsoft.Identity.Web JSON structure for migration.Behavior and compatibility
Teamsonly config works.AzureAdonly config works.AzureAdtakes precedence.Instanceto the public cloud endpoint, matching prior behavior whereTeamshad no instance key.Testing
Unit tests
Added coverage in
BotConfigTestsfor:TeamsInstancefor legacy configSectionNameasAzureAdClientCredentialsshape from legacy configAzureAdwhen both sections are presentTenantId/ClientId/InstanceinMsalConfigurationSectionEnd-to-end validation
Validated these scenarios in both
appsettings.jsonandlaunchSettings.json:TeamsAzureAdTeams + AzureAd(withAzureAdprecedence)