What is the purpose of creating an AAD application?

[yunbozhang-msft]

Hi team,

Since we can't use ClientSecret, so, I want to know what is the use of creating AAD App here? Can I delete it? Because I found that we already have botAadApp.

Thanks!

[blackchoey]

@yunbozhang-msft In general, the app created by aadApp/create is used to acquire permission to call external APIs like Microsoft Graph API. And the app created by botAadApp/create is used to register a bot for your Teams app. The best practice is to use different AAD apps for the different purposes. So you can see the project creates 2 AAD apps. And you can't delete one of them if your bot app needs to call an external API protected by AAD.

[SwenRanj]

@blackchoey How would this work for Teams app that implement tab SSO and bot SSO? We have the same set-up; one app reg for the bot and one for the 'app', but we are unsure what we need to put in the manifest of our app to facilitate this.

In the manifest.json there's webApplicationInfo.resource

1. For the tab SSO, documentation states that it should be something like: api://${{TAB_DOMAIN}}/${{AAD_APP_CLIENT_ID}}.
2. For bot SSO, `api://bot-id/${{BOT_ID}}.

If we implement 1 then SSO in the tab works, but the bot stops working and visa versa.
What would the default way of working or the 'path of least resistance' be here?

[blackchoey]

@SwenRanj You can use api://${{TAB_DOMAIN}}/botid-${{BOT_ID}} per this document

[SwenRanj]

@blackchoey Thanks a lot for your answer, that worked ☺️ .