How can I disable Microsoft account authentication?

[hacker01111000]

Hi Everyone,

Love what you've done with chat-copilot web app. I am going to use this internally for testing and would like to turn off the Microsoft Azure Directory authentication as using Microsoft accounts is overkill and unnecessary.

I see that the webapp/.env.example file has some configuration options that are used to define 2 users that can login without a Microsoft account. It looks like the unit tests leverage these to bypass the Microsoft login.

REACT_APP_TEST_USER_ACCOUNT1=
REACT_APP_TEST_USER_PASSWORD1=
REACT_APP_TEST_USER_ACCOUNT2=
REACT_APP_TEST_USER_PASSWORD2=

How can I enable these hardcoded accounts to be the only authorized users who can sign in while also disabling the Microsoft authentication altogether?

Thanks for your help in advance.

[crickman]

You can certainly restrict access by IP address via the Azure Portal. Since you are already hosted on Azure, I'm unclear on why you wouldn't just auth to your own AAD principal.

I'll double check w/ team w.r.t. thoughts on backdoor you've identified.

[crickman]

Checking with the team, those test user accounts are expected to be Microsoft accounts.

We do have a feature update just about to land that is a significant evolution in our security model...including a "noauth" option. I'll have the feature owner follow-up as it becomes ready to merge next week.

[hacker01111000]

Sounds good. Looking forward to it.

[gitri-ms]

Hi @hacker01111000, I just submitted this PR last week: #126

This change enables users to run Chat Copilot locally with no authentication, so you are no longer required to set up an app registration and sign in with a Microsoft account. Instead, the user is treated as a pseudonymous "Default User" and multi-user features are disabled.

We still require Azure Active Directory authentication by default when deploying Chat Copilot to Azure. (To add to what Chris said before, those test accounts in the .env file are for our testing pipeline.) If you'd like to allow users to sign in with an authentication provider other than Azure/Microsoft, I encourage you to explore that and submit a PR!

[gitri-ms]

I'm going to go ahead and close this issue since I think the latest changes I mentioned above address your question. However, if you have further questions, please feel free to reactivate it or open a new issue. Thank you!