[Outlook](NAA) Sample showing how to pass user identity to network resource #924

davidchesnut · 2025-01-21T22:00:03Z

Q	A
Bug fix?	no
New feature?	no
New sample?	yes
Related issues?	NA

What's in this Pull Request?

Shows how to properly handle the identity token and claims in an Outlook task pane add-in (SPA). Replaces the old Exchange token pattern of sending id token to the server API. Instead you use the access token which contains the identity claims for the server to manage a todo database.

AlexJerabek

Went until I got stuck. Please let me know what I'm missing for the Entra admin center.

AlexJerabek · 2025-01-22T19:30:25Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

+   - Set **Supported account types** to **Accounts in this organizational directory only**.
+   - Select **Register**.
+
+1. In the app's registration screen, select the **Expose an API** blade to the left to open the page where you can publish the permission as an API for which client applications can obtain access tokens for. The first thing that we need to do is to declare the unique resource URI that the clients will be using to obtain access tokens for this API. To declare an resource URI(Application ID URI), follow the following steps:


This was under a submenu for me.

AlexJerabek · 2025-01-22T19:37:00Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

+Open the sample project in Visual Studio Code to configure the code. In the steps below, "ClientID" is the same as "Application ID" or "AppId".
+
+1. Open the API/server-helpers/authConfig.js file.
+1. Find the key `Enter_API_Application_Id_Here` and replace the existing value with the application ID (clientId) of Contoso-Web-API-Server app copied from the Microsoft Entra admin center.


When did I go to the Microsoft Entra admin center and register something?

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

AlexJerabek · 2025-01-22T19:39:46Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

+
+All APIs must publish a minimum of one scope, also called Delegated Permission, for the client apps to obtain an access token for a user successfully. To publish a scope, follow these steps:
+
+1. Select **Add a scope** button open the **Add a scope** screen and Enter the values as indicated below:


This list and the next one have different numbering styles. Let's pick one to be consistent.

Also, consider making the "Repeat" step, Step 2. It'll make it more obvious that's an action, instead of informatino text.

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/controllers/todolist.js

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/server-helpers/validation-helper.js

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/routes/index.js

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/SPA/src/fallback/fallbackauthdialog.ts

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/SPA/src/taskpane/taskpane.ts

Co-authored-by: Linda Cannon <lindalu@microsoft.com> Co-authored-by: Alex Jerabek <38896772+AlexJerabek@users.noreply.github.com>

Co-authored-by: Linda Cannon <lindalu@microsoft.com>

AlexJerabek · 2025-01-28T21:31:44Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

+    1. In the **Redirect URI** section, enter the following redirect URIs:
+        1. `http://localhost:3000`
+        1. `http://localhost:3000/redirect`
+        1. `brk-multihub://localhost:3000`


How do you enter multiple redirects into this field?

Okay, so the confusing part to me is that you enter one of these in the setup screen (as shown above), then add two additional URIs through a different interface (as in the screenshot below). The readme makes it seem like you can complete this in one fell swoop.

lindalu-MSFT

Looks good!

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

AlexJerabek · 2025-02-03T22:55:23Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

+    1. In the **Redirect URI** section, enter the following redirect URIs:
+        1. `http://localhost:3000`
+        1. `http://localhost:3000/redirect`
+        1. `brk-multihub://localhost:3000`


Okay, so the confusing part to me is that you enter one of these in the setup screen (as shown above), then add two additional URIs through a different interface (as in the screenshot below). The readme makes it seem like you can complete this in one fell swoop.

AlexJerabek · 2025-02-03T22:58:17Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

+
+Your scopes should appear as shown in the following screenshot.
+
+![list of scopes](./images/scopes-added-client.png)


This screenshot should be under step 4, since the reader has already moved on from this pane in the app registrations.

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

AlexJerabek · 2025-02-06T22:43:37Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

+1. In the task pane, enter a new task in the text box, and select **Add**. You can enter multiple tasks.
+1. Select **Get todo list** to get the task list.


Getting this error after signing in. FWIW, on the first write attempt, I didn't check "Consent on behalf of the organization" and haven't been reprompted to do so.

Co-authored-by: Alex Jerabek <38896772+AlexJerabek@users.noreply.github.com>

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

codexeon · 2025-03-24T04:16:13Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/server-helpers/validation-helper.js

+    const token = authHeader.split(" ")[1];
+    req.token = token;
+    const validationOptions = {
+      audience: authConfig.credentials.clientID, // v2.0 token      


this doesn't seem to be validating issuer. Follow guidelines at https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens#validating-tokens, if this really is a single tenant application you can hardcode the issuer, else you need to include tenant id from the token.

codexeon · 2025-03-24T04:47:45Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/SPA/src/taskpane/msalconfig.ts

+/* global console */
+
+export const clientId = "Enter_Application_Client_Id_Here";
+export const msalConfig = {


recommend to specify type as msalConfig: Configuration = {} for better intellisense.

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/controllers/todolist.js

codexeon · 2025-03-24T05:10:14Z

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/server-helpers/validation-helper.js

+      }
+
+      // Put claims in the request object for downstream use.
+      req.authInfo = payload;


you could also have this middleware add the userid to the request, so you have a single location that gets the user id

Nice! I added this change.

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/SPA/src/taskpane/taskpane.ts

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

davidchesnut added 3 commits January 13, 2025 15:16

initial commit

ae7a42c

code cleanup

8911f0e

Add readme and code comments

a86e228

davidchesnut requested review from AlexJerabek, codexeon and lindalu-MSFT January 21, 2025 22:00

AlexJerabek requested changes Jan 22, 2025

View reviewed changes

lindalu-MSFT requested changes Jan 23, 2025

View reviewed changes

davidchesnut and others added 4 commits January 27, 2025 15:44

Apply suggestions from code review

aee29f8

Co-authored-by: Linda Cannon <lindalu@microsoft.com> Co-authored-by: Alex Jerabek <38896772+AlexJerabek@users.noreply.github.com>

Apply suggestions from code review

6893724

Co-authored-by: Linda Cannon <lindalu@microsoft.com>

Apply suggestions from code review

7c35852

Co-authored-by: Linda Cannon <lindalu@microsoft.com>

Apply suggestions from code review

4d2c33a

Co-authored-by: Linda Cannon <lindalu@microsoft.com>

AlexJerabek reviewed Jan 28, 2025

View reviewed changes

updated readme with images and fixes

f605253

davidchesnut requested review from AlexJerabek and lindalu-MSFT February 3, 2025 18:50

lindalu-MSFT approved these changes Feb 3, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md Show resolved Hide resolved

AlexJerabek reviewed Feb 3, 2025

View reviewed changes

add www start file

9fb2b07

AlexJerabek reviewed Feb 6, 2025

View reviewed changes

This was referenced Feb 26, 2025

NAA returns an "invalid" JWT OfficeDev/office-js#5069

Closed

makeEwsRequestAsync() and legacy token deprecation compatibility OfficeDev/office-js#5431

Closed

davidchesnut mentioned this pull request Mar 11, 2025

Using NAA for authenticating add-ins to our servers OfficeDev/office-js-docs-pr#5045

Closed

davidchesnut and others added 6 commits March 14, 2025 14:14

rework readme to use a single app registration

8b5a916

Update Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md

70b8305

Co-authored-by: Alex Jerabek <38896772+AlexJerabek@users.noreply.github.com>

Updates from feedback

9e29bf9

update packages to latest secure versions

6107101

fix image issue

dc2d631

remove comment

6052a37

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md Outdated Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md Outdated Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/controllers/todolist.js Outdated Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/controllers/todolist.js Outdated Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/controllers/todolist.js Outdated Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/API/controllers/todolist.js Outdated Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/SPA/src/taskpane/taskpane.ts Outdated Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md Show resolved Hide resolved

codexeon reviewed Mar 24, 2025

View reviewed changes

Samples/auth/Outlook-Add-in-SSO-NAA-Identity/README.md Outdated Show resolved Hide resolved

codexeon approved these changes Mar 24, 2025

View reviewed changes

davidchesnut added 5 commits March 26, 2025 09:59

changes made based on review feedback.

510ab7b

convert manifest to json

3193275

update validation

e9946aa

Fetch discovery keys instead of hard coded.

b3f8b71

Update based on review feedback

10f025d

davidchesnut merged commit 66c340d into main Apr 10, 2025
1 check passed

davidchesnut deleted the davech-naa-id branch April 10, 2025 22:01

Skizzy-create mentioned this pull request Dec 17, 2025

[Documentation] NAA is required for sideloaded add-ins with personal Microsoft accounts - unclear in docs #1075

Closed


		All APIs must publish a minimum of one scope, also called Delegated Permission, for the client apps to obtain an access token for a user successfully. To publish a scope, follow these steps:

		1. Select Add a scope button open the Add a scope screen and Enter the values as indicated below:


		Your scopes should appear as shown in the following screenshot.

		![list of scopes](./images/scopes-added-client.png)

		1. In the task pane, enter a new task in the text box, and select Add. You can enter multiple tasks.
		1. Select Get todo list to get the task list.

[Outlook](NAA) Sample showing how to pass user identity to network resource #924

[Outlook](NAA) Sample showing how to pass user identity to network resource #924

Uh oh!

Conversation

davidchesnut commented Jan 21, 2025

What's in this Pull Request?

Uh oh!

AlexJerabek left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lindalu-MSFT left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants