Clarification on Using Bot Framework SSO to Retrieve User Access Token from Entra ID in Web App

Question

We are building a web application using the Microsoft Bot Framework, integrated with Azure Bot Service. We have successfully configured Single Sign-On (SSO) in the Bot Service and now trying to leverage this SSO to obtain the user's access token from Microsoft Entra ID (Azure AD) within our Bot Framework-based web application.

Our goal is to use the token to securely access downstream APIs (like Microsoft Graph) on behalf of the signed-in Teams user.

We’ve followed the official Microsoft documentation for configuring SSO and access token retrieval: 🔗 https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/authentication/bot-sso-overview

We would appreciate any clarification or guidance on:

• How to retrieve the access token in the bot's code (Web App backend)
• Whether any additional steps are needed beyond what the guide outlines for token extraction and use.

We have tried with implemention based on this sample, but unable to retieve Access Token.
https://github.com/OfficeDev/Microsoft-Teams-Samples/tree/main/samples/bot-conversation-sso-quickstart/js

Answer 1

Hi Sudip Saha, 

Thank you for posting your question in the Microsoft Q&A forum. 

Based on my research and understanding, once the user successfully signs in via Single Sign-On (SSO) in your Bot Framework-based web application, an access token should be returned. You can use this token to call downstream APIs like Microsoft Graph securely on behalf of the signed-in Teams user. 

Microsoft provides a sample code snippet that shows how to retrieve the access token in your bot’s backend code. You can find it here: Update App Manifest to Enable SSO - Teams | Microsoft Learn 

Additionally, to use Microsoft Graph API, your app must request the appropriate permissions based on the scopes you assign. You can refer to this documentation for more details: Microsoft Graph Permissions for App - Teams | Microsoft Learn 

Make sure your Azure AD app registration includes the necessary delegated permissions and that consent has been granted either by the user or an admin, depending on your setup. 

I hope this helps clarify everything! Please review the information I provided and let me know if you have any further questions.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.