Query on Using Managed Identity with CopilotClient in Agents SDK

[Santhosh0505]

We are building a Parent Agent using the Agents SDK and a Child Agent using Copilot Studio. To connect the two, we're leveraging the CopilotClient within the Agents SDK to communicate with the Copilot Studio Agent.

Based on the documentation and available information, this integration currently requires the use of an App Registration in the CopilotClient settings. However, the client has expressed a strong preference for using Managed Identity instead of an App Registration for authentication.

Could you please confirm if there is a supported way to establish this connection using a Managed Identity? If not, are there any upcoming plans to support this?

Appreciate your guidance on this.

Thank you

[tracyboehrer]

@Santhosh0505 Yes, there is support for User Managed Identity. Keep in mind that with Managed Identity or Federated Credentials, local testing of the Agent is not possible, and must be deployed. Typically, when developing the agent a local configuration is used (via devtunnels), but for production Managed Identity would be used.

appsettings:

  "Connections": {
    "ServiceConnection": {
      "Settings": {
        "AuthType": "UserManagedIdentity",
        "ClientId": "<ClientID>",
        "Scopes": [
          "https://api.botframework.com/.default"
        ]
      }
    }
  }

For a details of support auth: https://aka.ms/AgentsSDK-DotNetMSALAuth

[Santhosh0505]

@tracyboehrer Thank you for your response.

I am using the Managed Identity as provided in the above link, but in this case, I am failing to auto sign in the user who is interacting with the master agent from the Microsoft Teams channel. Could you please help me on how can we achieve Auto Sign In for teams channel without using App Registration

[tracyboehrer]

@Santhosh0505 Hmmmm. Somewhat different question. The issue will be that Teams SSO has particular requirements, though OAuth would work in any case (SSO will work without an explicit sign-in).

I think I know what you want, but let's confirm. I think you want a Teams agent that gets a token, using Teams SSO, appropriate for communicating with MCS via CopilotStudioClient. Yes?

[Santhosh0505]

@tracyboehrer Yes, that is correct

Here, I don't want to use App Registration while achieving this. I am okay to use Managed Identity instead. So wanted to check if this is a possible!

[tracyboehrer]

@Santhosh0505 Managed Identity on it's own isn't enough. It's the App Registration that has the API Permissions to access MCS (or anything other OAuth scenario).

There are options. One is Federated Credentials using Managed Identity. I'll get back to you.

[Santhosh0505]

@tracyboehrer Okay sure

[tracyboehrer]

@Santhosh0505 What does appear to work for me is the following. Much of this will be turned into more official docs. It's a complex setup, mostly in Azure configuration.

Step 1 (Federated Credentials for the Agent)

1. Use existing or create a new Azure Bot + App Registration and setup for Federated Credentials
   1. Create a User Managed Identity and record the ClientId
      • If an App Service is being used, this needs to be added on the Identity pane on that resource
   2. On the App Registration Certificates & secrets pane
      1. Remove the Client Secret (if it exists)
      2. Add a new credential
         1. Select Managed Identity in the Federated credential scenario drop-down.
         2. Select the User Managed Identity created above and give it a name (ex. "agent")
   3. If this is a new Azure Bot, be sure to add Teams in the Channels pane on the Azure Bot resource.
2. Configure agent appsettings for FederatedCredentials

   "Connections": {
       "ServiceConnection": {
        "Settings": {
            "AuthType": "FederatedCredentials",
            "AuthorityEndpoint": "https://login.microsoftonline.com/{{TenantId}}",
            "ClientId": "{{AppId}}",
            "FederatedClientId": "{{MsiClientId}}",
            "Scopes": [
                "https://api.botframework.com/.default"
            ]
        }
     }
   },

3. This is the "agent-to-channel" leg, and the Agent should be able to receive/send messages with ABS/Teams.
   • Note: Managed Identity, including Federated Credentials, cannot be run locally. The agent must be deployed to Azure.

Step 2 (SSO)

1. Provide the required API Permission on the App Registration
   1. I applied the instructions from the Authorization\OBOAuthorization sample. Steps API Permissions tab and Expose an API tab.
   2. For Teams, the required clients need to be added under Authorized client applications. Typically client id's 5e3ce6c0-2b1f-4285-8d4b-75ee78787346 and 1fec8e78-bce4-4aaf-ab1b-5451cc387264.
2. Provide an additional Federated Credential on the App Registration
   1. I applied a portion of these instructions , Step 4 ("In the navigation pane, select Certificates & secrets to add credentials for your application.").
      • I gave it a name of "agent-oauth", but the name doesn't really matter.
      • DO record the value you chose for {unique-identifier-for-projected-identity}
        • I used "agent-oauth" here too. It can be anything as long as unique.
3. Create an "OAuth Connection" on the Azure Bot
   1. Provider: AAD v2 with Federated Credentials
   2. ClientId: Your App Registration ClientId (AppId)
   3. Unique Subject Identifier: The value you used in the previous step
   4. Token Exchange URL: api://botid-{{yourClientId}}
   5. TenantId: your tenantId
   6. Scopes: api://botid-{{yourClientId}}/defaultScopes
   7. Name: Of your choosing. I used "teams_sso".
4. Configure Agent settings. It will look something like this:

   "AgentApplication": {
      "StartTypingTimer": true,
      "RemoveRecipientMention": false,
      "NormalizeMentions": false,
   
      "UserAuthorization": {
        "AutoSignIn": true,
        "Handlers": {
          "mcs": {
            "Settings": {
              "AzureBotOAuthConnectionName": "teams_sso",
              "OBOConnectionName": "ServiceConnection" // OBOScopes are resolved at runtime
            }
          }
       }
     }
   },

See attached:

• I used the Authorization\OBOAuthorization sample to test this, with some mods to enable JWT token validation and appsettings changes. This sample takes any input from the user, and forwards to an MCS Agent using the CopilotStudioClient.
• Do note: This setup defers the OBO exchange until runtime so that proper MCS Scopes can be determined. See GetClient in Program.cs.
• Be sure to configure token validation in appsettings:

  "TokenValidation": {
    "Audiences": [
      "{{ClientId}}"
    ],
    "TenantId": "{{TenantId}}"
  },

• The teams-manifest.json should be altered and used to (re)deploy your app to Teams.
  • Copy teams-manifest.json to manifest.json
  • Update manifest.json with:
    • Replace ${{AAD_APP_CLIENT_ID}} the AppId
    • Replace <<BOT_DOMAIN>> with the App Service domain name
  • Zip manifest.json, color.png, and outline.png
  • The zip is what is upload to Teams

Updates-MCS-and-TeamsSSO.zip

[Santhosh0505]

@tracyboehrer Thank you for sharing these detailed steps.

Could you please confirm if there is a way where the App Registration which you have utilized for API Permissions and configuring Federated Credentials for the App Registration can be avoided.

Is there a way where we could provide the Federated Credentials under Managed Identity and make the whole implementation work without App Registration?

I understand that App Registration is the one which helps in configuring the API permissions for OAuth, but wanted to check if there is any alternative to App Registration which we can utilize

To try this I have created an Azure Bot + User Defined Managed Identity, and post that we are struck on how to configure the SSO on that path

[tracyboehrer]

@Santhosh0505 I don't believe so, at least not and have Teams SSO. Typically, people want to drop secrets and certificates, and Federated Credentials allows for Managed Identity. What is the rationale behind not having an App Registration? At some point, an App Reg is required regardless since that is where API Permissions are.

[Santhosh0505]

@tracyboehrer Actually the ask from the Security team was not to use App Registration, I think as API permissions justifies the need of App Registration. Let me discuss this with the Security team and request for the approval.
I will parallelly test for the above provided steps and check the working of the whole flow. I will reach out in case of any issues. Thank you for your support.