4,159 questions
Is it secure to have the App Id and Password in Teams Manifest for a bot
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 8%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESG%3C/text%3E%3C/svg%3E)
saonti ghosh
1
Reputation point
How secure is it to have the App details in Teams Manifest for a bot? Anyone else who have the manifest can upload in their own Teams account. Or they can use the App Id and Password to create the same app in their own Teams account.
Microsoft Teams | Development
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 91%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETM%3C/text%3E%3C/svg%3E)
Trinetra-MSFT 111 Reputation points2020-11-20T13:33:28.723+00:00 Team manifest is secure, it can be generated by App Studio as well you can generate it manually. Putting the App Id that's how teams detect the app configuration. App Id is unique one, manifest don't save password.
-
saonti ghosh 1 Reputation point
2020-11-25T03:25:13.95+00:00 But anyone can reuse the manifest to deploy the app in their Teams account right? can we restrict that?
-
Manish-MSFT 256 Reputation points2020-12-11T12:30:00.647+00:00 @saonti ghosh : You will need to use authentication mechanism such as SSO, even if the teams manifest get's misplaced. You need to refer to MS Teams Javascript SDK that takes care of it.
Sign in to comment
Sign in to answer