Use certificate or MSI for app authentication

Prepare a certificate and private key.

Go to Azure portal.

Select App registrations.

Select your registered app.

In the left pane, under Manage, select Certificates & secrets.

Under Certificates, select Upload certificate.

The Upload a certificate window appears.

Upload the certificate you prepared.

Enter Description.

Select Add.

Open your bot app project in Visual Studio or Visual Studio Code.

Update your code.

    const credentialsFactory = new ConfigurationServiceClientCredentialFactory({
    MicrosoftAppId: config.botId,
    CertificatePrivateKey: '{your private key}',
    CertificateThumbprint: '{your cert thumbprint}',
    MicrosoftAppType: "MultiTenant",
    });

    const botFrameworkAuthentication = new ConfigurationBotFrameworkAuthentication(
    {},
    credentialsFactory
    );

    const adapter = new CloudAdapter(botFrameworkAuthentication);

    builder.Services.AddSingleton<ServiceClientCredentialsFactory>((e) => new CertificateServiceClientCredentialsFactory("{your certificate}", "{your entra id}"));

Ensure you test your bot to confirm the operation aligns with the updated authentication.

Go to Azure portal.

Select App registrations.

Select your registered app.

In the left pane, under Manage, select Certificates & secrets.

Delete the secrets from Entra.

Go to Azure portal.

Go to Home.

Select + Create a resource.

In the search box, enter Azure Bot.

Select the Enter key.

Select Azure Bot.

Select Create.

Enter the bot name in Bot handle.

Select your Subscription from the dropdown list.

Select your Resource group from the dropdown list.

If you don't have an existing resource group, you can create a new resource group. To create a new Azure bot service and managed identity, follow these steps:

1. Select Create new.
2. Enter the resource name and select OK.
3. Select a ___location from New resource group ___location dropdown list.

Under Microsoft App ID, select Type of App as User-Assigned Managed Identity.

From the Creation type, select Create new Microsoft App ID.

OR

You can manually create a managed identity first, then create the Azure Bot using the Use existing app registration.

Update the new Azure Bot messaging endpoint and channels to match those of the old service.

Go to your apps hosting resource.

Select Settings > Identity > User assigned.

Add the managed identity that you've created.

Open your bot app project in Visual Studio or Visual Studio Code.

Update your code.

    const credentialsFactory = new ConfigurationServiceClientCredentialFactory({
    MicrosoftAppType: 'UserAssignedMsi',
    MicrosoftAppId: '{your MSI’s client ID}',
    MicrosoftAppTenantId: '{your MSI’s tenant ID}',
    });

    const botFrameworkAuthentication = new ConfigurationBotFrameworkAuthentication(
    {},
    credentialsFactory
    );

    const adapter = new CloudAdapter(botFrameworkAuthentication);

    builder.Configuration["MicrosoftAppType"] = "UserAssignedMsi";
    builder.Configuration["MicrosoftAppId"] = "{your MSI’s client ID}";
    builder.Configuration["MicrosoftAppTenantId"] = "{your MSI’s tenant ID}";
    builder.Services.AddSingleton<BotFrameworkAuthentication, ConfigurationBotFrameworkAuthentication>();

Update the BOT_ID in your .env file.

Ensure you test your bot to confirm its operation aligns with the updated authentication.

Go to Azure portal.

Select App registrations.

Select your registered app.

In the left pane, under Manage, select Certificates & secrets.

Delete the secrets from Entra.