Share via

Blocker in Implementing SSO for Teams Bot – Clarification Needed on Federated Credentials Setup

Anonymous
2025-12-02T16:33:42.8766667+00:00

Hi Team,

We are implementing Single Sign-On (SSO) for our Microsoft Teams bot and are following the official Microsoft documentation:

Bot Authentication Setup: https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-authentication

❗ Problem

The standard bot SSO flow requires creating an App Registration and using either:

Certificate authentication, or

Client secrets

Both options are restricted in our organization due to security policies.

Therefore, our only possible approach is to use Federated Credentials.

❓ Blocker – Missing clarity on subject identifier

The documentation states that Federated Credential configuration requires:

Issuer

https://login.microsoftonline.com/{customer-tenant-ID}/v2.0

Subject Identifier

/eid1/c/pub/t/{base64 encoded customer tenant ID}/a/{base64 encoded first-party app client ID}/{unique-identifier-for-projected-identity}

We can determine all parts except the last parameter: {unique-identifier-for-projected-identity}

The documentation does not explain what this value is, how it is generated, or where it comes from. This missing detail is blocking our progress.

❓ Additional Context – Using a Managed Identity

Our bot uses a User Assigned Managed Identity (UAMI) instead of a traditional App Registration.

Azure now exposes “Federated Credentials” directly in the Managed Identity blade, which raises two questions:

Can Federated Credentials be used directly with a Managed Identity (bypassing the need for App Registration)?

Does this approach support the Bot Framework SSO token exchange flow, or is an App Registration still required behind the scenes?

📌 Request

We would appreciate guidance on:

How to correctly construct the subject identifier

Whether UAMI + federated credentials is a supported pattern for Teams Bot SSO

Any internal limitations or unsupported scenarios we should be aware of

This clarification is essential for us to finalize our authentication design and proceed with implementation.

Thanks, AnandHi Team,

We are implementing Single Sign-On (SSO) for our Microsoft Teams bot and are following the official Microsoft documentation:

Bot SSO Overview: https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-authentication-sso

Bot Authentication Setup: https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-authentication

Federated Credentials for Bots: https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-authentication-federated-credentials

❗ Problem

The standard bot SSO flow requires creating an App Registration and using either:

Certificate authentication, or

Client secrets

Both options are restricted in our organization due to security policies.

Therefore, our only possible approach is to use Federated Credentials.

❓ Blocker – Missing clarity on subject identifier

The documentation states that Federated Credential configuration requires:

Issuer

https://login.microsoftonline.com/{customer-tenant-ID}/v2.0

Subject Identifier

/eid1/c/pub/t/{

We can determine all parts except the last parameter:
{unique-identifier-for-projected-identity}

The documentation does not explain what this value is, how it is generated, or where it comes from. This missing detail is blocking our progress.

❓ Additional Context – Using a Managed Identity

Our bot uses a User Assigned Managed Identity (UAMI) instead of a traditional App Registration.

Azure now exposes “Federated Credentials” directly in the Managed Identity blade, which raises two questions:

Can Federated Credentials be used directly with a Managed Identity (bypassing the need for App Registration)?

Does this approach support the Bot Framework SSO token exchange flow, or is an App Registration still required behind the scenes?

📌 Request

We would appreciate guidance on:

How to correctly construct the subject identifier

Whether UAMI + federated credentials is a supported pattern for Teams Bot SSO

Any internal limitations or unsupported scenarios we should be aware of

This clarification is essential for us to finalize our authentication design and proceed with implementation.

Thanks,
Anand

Azure AI Bot Service
Azure AI Bot Service

An Azure service that provides an integrated environment for bot development.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Adam Zachary 2,265 Reputation points
    2025-12-02T17:34:19.3566667+00:00

    Hi Anand,

    I ran into the same questions when I first tried to move a bot to federated credentials. A couple of clarifications that are easy to miss in the docs.

    1. What is {unique-identifier-for-projected-identity}?

    That value is not something magical coming from Microsoft, it is a string that you choose and then reuse in two places:

    In the Entra federated credential subject, as the last segment:

    /eid1/c/pub/t/{base64 customer tenant ID}/a/{base64 first-party app client ID}/{unique-identifier-for-projected-identity}

    In the Azure Bot OAuth Connection Setting, in the field called Unique Identifier.

    Per the federated-credential docs, “Unique-identifier-for-projected-identity” must be the same value that is configured as the Unique Identifier on the bot’s OAuth connection.

    So you can pick any stable string, for example:

    Unique Identifier on the bot connection: teams-bot-sso-01

    Subject identifier: /eid1/c/pub/t/{base64 tenant}/a/{base64 first-party app}/{teams-bot-sso-01}

    No extra encoding on that last segment, it just has to match exactly.

    Can I do “UAMI + federated credentials only” without an app registration?

    For Teams bot SSO, the supported pattern today is:

    You can run the bot itself under a User Assigned Managed Identity (that is now a supported bot type).

    OAuth / SSO is still provisioned on an Azure Bot resource and a corresponding Entra app registration. That app registration is where you configure the federated credential, and it is what the OAuth connection uses for token exchange.

    In other words:

    The UAMI gives the bot a credential to talk to Bot Service and other Azure resources.

    The app registration with a federated credential is still required for the Bot Framework SSO and token-exchange flow. The newer docs even call out the FederatedClientId setting that points to the managed identity’s client ID, but the FIC itself lives on the app registration.

    The “Federated credentials” blade that you see directly on the managed identity is for general workload identity federation scenarios; it is not (yet) wired into the Bot OAuth connection flow, and there is no guidance that says UAMI+FIC alone is supported for Teams bot SSO.

    So, practically:

    Yes, you can avoid client secrets and certificates by using federated credentials,

    but you still need an Entra app registration + Azure Bot + UAMI, with the FIC defined on the app registration and the unique-identifier-for-projected-identity matching the bot connection’s Unique Identifier.

    That is the only pattern I have seen documented and working for Teams bot SSO with federated credentials today.Hi Anand,

    I ran into the same questions when I first tried to move a bot to federated credentials. A couple of clarifications that are easy to miss in the docs.

    What is {unique-identifier-for-projected-identity}?

    That value is not something magical coming from Microsoft, it is a string that you choose and then reuse in two places:

    In the Entra federated credential subject, as the last segment:

    /eid1/c/pub/t/{base64 customer tenant ID}/a/{base64 first-party app client ID}/{unique-identifier-for-projected-identity}

    In the Azure Bot OAuth Connection Setting, in the field called Unique Identifier.

    Per the federated-credential docs, “Unique-identifier-for-projected-identity” must be the same value that is configured as the Unique Identifier on the bot’s OAuth connection.

    So you can pick any stable string, for example:

    Unique Identifier on the bot connection: teams-bot-sso-01

    Subject identifier: /eid1/c/pub/t/{base64 tenant}/a/{base64 first-party app}/{teams-bot-sso-01}

    No extra encoding on that last segment, it just has to match exactly.

    Can I do “UAMI + federated credentials only” without an app registration?

    For Teams bot SSO, the supported pattern today is:

    You can run the bot itself under a User Assigned Managed Identity (that is now a supported bot type).

    OAuth / SSO is still provisioned on an Azure Bot resource and a corresponding Entra app registration. That app registration is where you configure the federated credential, and it is what the OAuth connection uses for token exchange.

    In other words:

    The UAMI gives the bot a credential to talk to Bot Service and other Azure resources.

    The app registration with a federated credential is still required for the Bot Framework SSO and token-exchange flow. The newer docs even call out the FederatedClientId setting that points to the managed identity’s client ID, but the FIC itself lives on the app registration.

    The “Federated credentials” blade that you see directly on the managed identity is for general workload identity federation scenarios; it is not (yet) wired into the Bot OAuth connection flow, and there is no guidance that says UAMI+FIC alone is supported for Teams bot SSO.

    So, practically:

    Yes, you can avoid client secrets and certificates by using federated credentials,

    but you still need an Entra app registration + Azure Bot + UAMI, with the FIC defined on the app registration and the unique-identifier-for-projected-identity matching the bot connection’s Unique Identifier.

    That is the only pattern I have seen documented and working for Teams bot SSO with federated credentials today.

    Was this answer helpful?

    0 comments

  2. AI answer

    2025-12-02T16:33:54.6633333+00:00

    To construct the Subject Identifier for Federated Credentials in your Teams bot, the last parameter {unique-identifier-for-projected-identity} typically represents a unique identifier for the identity that is being projected. This identifier is often specific to the application and can be generated based on your application's requirements or conventions. Unfortunately, the documentation does not provide explicit guidance on how to generate this identifier, so it may require some experimentation or consultation with your identity management team to determine the best approach.

    Regarding your questions about using Federated Credentials directly with a User Assigned Managed Identity (UAMI):

    1. Can Federated Credentials be used directly with a Managed Identity? Yes, Federated Credentials can be configured directly in the Managed Identity blade, allowing you to bypass the traditional App Registration process.
    2. Does this approach support the Bot Framework SSO token exchange flow? Yes, using UAMI with Federated Credentials is a supported pattern for Teams Bot SSO, and it should work for the token exchange flow without requiring an App Registration behind the scenes.

    Make sure to review any internal policies or limitations that might affect the implementation of this approach within your organization.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.