Instructions on how to register an add-in for SSO lead users through storing a password in the cloud

[netoront]

Article URL

https://learn.microsoft.com/en-us/office/dev/add-ins/develop/register-sso-add-in-aad-v2

Issue

The documentation gives instructions for creating a client secret - basically a shared password - without any indication of whether it's necessary or safe. It's not safe (Microsoft's own internal security scans flag it as a violation), and as far as I can tell, it's not necessary.

The docs should at least dissuade readers from doing it.

[AlexJerabek]

Hi @netoront,
Thanks for flagging this issue. @davidchesnut, could you please investigate?

[davidchesnut]

Hi @netoront,

The client secret is the recommended way to prove your app identity (from server-side) when working with Office-based SSO. There are some best practices about handling client secrets in the article: Public client and confidential client applications. I can add a link to this from the docs to be sure developers are aware of proper handling of client secrets.

Thanks!
David