microsoft/work-iq

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

"$id": "https://raw.githubusercontent.com/microsoft/M365-Copilot-Agent-Evals/refs/heads/main/schema/v1/eval-document.schema.json",

"$id": "https://raw.githubusercontent.com/microsoft/M365-Copilot-Agent-Evals/refs/heads/main/schema/v1/eval-document.schema.json",

[Credential-related source omitted]

[Credential-related source omitted]

## Test in Copilot 1. Open https://m365.cloud.microsoft/chat (agent may take up to 15 min to appear).

## Test in Copilot 1. Open https://m365.cloud.microsoft/chat (agent may take up to 15 min to appear).

1. Open https://m365.cloud.microsoft/chat (agent may take up to 15 min to appear).

1. Open https://m365.cloud.microsoft/chat (agent may take up to 15 min to appear).

- **App registration:** the Entra app this skill created (`<ClientId>`) — do not create a new one. - **Supported account types:** Single tenant. - **Issuer URL:** `https://login.microsoftonline.com/<TenantId>/v2.0`

- **App registration:** the Entra app this skill created (`<ClientId>`) — do not create a new one. - **Supported account types:** Single tenant. - **Issuer URL:** `https://login.microsoftonline.com/<TenantId>/v2.0`

- **Supported account types:** Single tenant. - **Issuer URL:** `https://login.microsoftonline.com/<TenantId>/v2.0` - **Allowed token audiences:** `<ClientId>` — the **bare client-id** form (NOT `api://…`), else `401`.

- **Supported account types:** Single tenant. - **Issuer URL:** `https://login.microsoftonline.com/<TenantId>/v2.0` - **Allowed token audiences:** `<ClientId>` — the **bare client-id** form (NOT `api://…`), else `401`.

- **Issuer URL:** `https://login.microsoftonline.com/<TenantId>/v2.0` - **Allowed token audiences:** `<ClientId>` — the **bare client-id** form (NOT `api://…`), else `401`. - **Client application requirement:** *Allow requests from specific

- **Issuer URL:** `https://login.microsoftonline.com/<TenantId>/v2.0` - **Allowed token audiences:** `<ClientId>` — the **bare client-id** form (NOT `api://…`), else `401`. - **Client application requirement:** *Allow requests from specific

📄 **Full field-by-field guide** (both blade tables + both gotchas): **[`references/easy-auth.md`](references/easy-auth.md)** — cite it by name in the summary. Also include: - [Authentication and authorization in Azure App Service](https://l

📄 **Full field-by-field guide** (both blade tables + both gotchas): **[`references/easy-auth.md`](references/easy-auth.md)** — cite it by name in the summary. Also include: - [Authentication and authorization in Azure App Service](https://l

- [Authentication and authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization)

- [Authentication and authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization)

- [Configure MCP server authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/configure-authentication-mcp)

- [Configure MCP server authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/configure-authentication-mcp)

- **Two tunnels?** This skill reuses the tunnel from `env/.env.local`. If you ever see a second tunnel, stop it and keep the named one the ui-widget script created. - **Dev tunnel URL changed → auth suddenly broken.** The OAuth registration

- **Two tunnels?** This skill reuses the tunnel from `env/.env.local`. If you ever see a second tunnel, stop it and keep the named one the ui-widget script created. - **Dev tunnel URL changed → auth suddenly broken.** The OAuth registration

- **Dev tunnel URL changed → auth suddenly broken.** The OAuth registration is created with `baseUrl: ${{MCP_SERVER_URL}}`, ATK derives the Application ID URI from that tunnel domain, and it's written into the Entra app's `identifierUris`. 

- **Dev tunnel URL changed → auth suddenly broken.** The OAuth registration is created with `baseUrl: ${{MCP_SERVER_URL}}`, ATK derives the Application ID URI from that tunnel domain, and it's written into the Entra app's `identifierUris`. 

Executable file

Executable file

if (!tenantId) throw new Error("TENANT_ID not configured");   expectedTenantId = tenantId;   jwks = createRemoteJWKSet(new URL(`https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`));

if (!tenantId) throw new Error("TENANT_ID not configured");   expectedTenantId = tenantId;   jwks = createRemoteJWKSet(new URL(`https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`));

jwks = createRemoteJWKSet(new URL(`https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`));

jwks = createRemoteJWKSet(new URL(`https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`));

issuers = [`https://login.microsoftonline.com/${tenantId}/v2.0`];

issuers = [`https://login.microsoftonline.com/${tenantId}/v2.0`];

| **Application (client) ID** | `<api-app-client-id>` | Identifies the protected API | | **Client secret setting name** | *(leave unset for pure bearer validation)* | A secret is only needed if App Service itself performs a login/redirect f

| **Application (client) ID** | `<api-app-client-id>` | Identifies the protected API | | **Client secret setting name** | *(leave unset for pure bearer validation)* | A secret is only needed if App Service itself performs a login/redirect f

| **Client secret setting name** | *(leave unset for pure bearer validation)* | A secret is only needed if App Service itself performs a login/redirect flow; for API token validation it isn't required | | **Issuer URL** | `https://login.mic

| **Client secret setting name** | *(leave unset for pure bearer validation)* | A secret is only needed if App Service itself performs a login/redirect flow; for API token validation it isn't required | | **Issuer URL** | `https://login.mic

| **Issuer URL** | `https://login.microsoftonline.com/<tenant-id>/v2.0` | Must match the token's issuer (drop `/v2.0` only for v1 tokens) |

| **Issuer URL** | `https://login.microsoftonline.com/<tenant-id>/v2.0` | Must match the token's issuer (drop `/v2.0` only for v1 tokens) |

- [Authentication and authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization)

- [Authentication and authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization)

- [Configure MCP server authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/configure-authentication-mcp)

- [Configure MCP server authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/configure-authentication-mcp)

app exposed and the user consented to. Its presence is what makes the token *usable by*   (and later exchangeable *for*) your app. - **Issuer (`iss`) must match the user's tenant** (`https://login.microsoftonline.com/<tid>/v2.0`

app exposed and the user consented to. Its presence is what makes the token *usable by*   (and later exchangeable *for*) your app. - **Issuer (`iss`) must match the user's tenant** (`https://login.microsoftonline.com/<tid>/v2.0`

(and later exchangeable *for*) your app. - **Issuer (`iss`) must match the user's tenant** (`https://login.microsoftonline.com/<tid>/v2.0`   or the v1 `sts.windows.net` form). This stops tokens from other tenants.

(and later exchangeable *for*) your app. - **Issuer (`iss`) must match the user's tenant** (`https://login.microsoftonline.com/<tid>/v2.0`   or the v1 `sts.windows.net` form). This stops tokens from other tenants.

- **Issuer (`iss`) must match the user's tenant** (`https://login.microsoftonline.com/<tid>/v2.0`

- **Issuer (`iss`) must match the user's tenant** (`https://login.microsoftonline.com/<tid>/v2.0`

{   "aud": "11111111-1111-1111-1111-111111111111", // YOUR app (client-id GUID form — not api://)   "iss": "https://login.microsoftonline.com/22222222-2222-2222-2222-222222222222/v2.0", // tenant issuer

{   "aud": "11111111-1111-1111-1111-111111111111", // YOUR app (client-id GUID form — not api://)   "iss": "https://login.microsoftonline.com/22222222-2222-2222-2222-222222222222/v2.0", // tenant issuer

"aud": "11111111-1111-1111-1111-111111111111", // YOUR app (client-id GUID form — not api://)   "iss": "https://login.microsoftonline.com/22222222-2222-2222-2222-222222222222/v2.0", // tenant issuer   "iat": 1782762638, "nbf": 1782762638, "

"aud": "11111111-1111-1111-1111-111111111111", // YOUR app (client-id GUID form — not api://)   "iss": "https://login.microsoftonline.com/22222222-2222-2222-2222-222222222222/v2.0", // tenant issuer   "iat": 1782762638, "nbf": 1782762638, "

"iss": "https://login.microsoftonline.com/22222222-2222-2222-2222-222222222222/v2.0", // tenant issuer

"iss": "https://login.microsoftonline.com/22222222-2222-2222-2222-222222222222/v2.0", // tenant issuer

token you already validated to Entra's `/oauth2/v2.0/token` endpoint with    `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` and `requested_token_use=on_behalf_of`,    scoped to `https://graph.microsoft.com/.default` (or specific s

token you already validated to Entra's `/oauth2/v2.0/token` endpoint with    `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` and `requested_token_use=on_behalf_of`,    scoped to `https://graph.microsoft.com/.default` (or specific s

`grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` and `requested_token_use=on_behalf_of`,    scoped to `https://graph.microsoft.com/.default` (or specific scopes). 4. **Call Graph** with the returned downstream token; cache it per us

`grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` and `requested_token_use=on_behalf_of`,    scoped to `https://graph.microsoft.com/.default` (or specific scopes). 4. **Call Graph** with the returned downstream token; cache it per us

scoped to `https://graph.microsoft.com/.default` (or specific scopes).

scoped to `https://graph.microsoft.com/.default` (or specific scopes).

[Credential-related source omitted]

[Credential-related source omitted]

assertion: incomingBearerToken,                          // the token Copilot sent you   requested_token_use: "on_behalf_of",   scope: "https://graph.microsoft.com/.default",

assertion: incomingBearerToken,                          // the token Copilot sent you   requested_token_use: "on_behalf_of",   scope: "https://graph.microsoft.com/.default",

requested_token_use: "on_behalf_of",   scope: "https://graph.microsoft.com/.default", });

requested_token_use: "on_behalf_of",   scope: "https://graph.microsoft.com/.default", });

scope: "https://graph.microsoft.com/.default", }); const r = await fetch(

scope: "https://graph.microsoft.com/.default", }); const r = await fetch(

}); const r = await fetch(   `https://login.microsoftonline.com/${process.env.TENANT_ID}/oauth2/v2.0/token`,

}); const r = await fetch(   `https://login.microsoftonline.com/${process.env.TENANT_ID}/oauth2/v2.0/token`,

const r = await fetch(

const r = await fetch(

`https://login.microsoftonline.com/${process.env.TENANT_ID}/oauth2/v2.0/token`,

`https://login.microsoftonline.com/${process.env.TENANT_ID}/oauth2/v2.0/token`,

[Credential-related source omitted]

[Credential-related source omitted]

> **⚠<U+FE0F> Tunnel ↔ OAuth coupling.** The OAuth registration is created with `baseUrl: ${{MCP_SERVER_URL}}` (Phase 4), ATK derives the Application ID URI from that tunnel domain, and Phase 5 writes it into the Entra app's `identifierUris`. So t

> **⚠<U+FE0F> Tunnel ↔ OAuth coupling.** The OAuth registration is created with `baseUrl: ${{MCP_SERVER_URL}}` (Phase 4), ATK derives the Application ID URI from that tunnel domain, and Phase 5 writes it into the Entra app's `identifierUris`. So t

> > - **Field-by-field blade config:** [`easy-auth.md`](easy-auth.md) — the exact **App Service → Authentication → Microsoft Entra** settings, including the two gotchas: the audience must be the **bare client-id** form (else `401`), and *Al

> > - **Field-by-field blade config:** [`easy-auth.md`](easy-auth.md) — the exact **App Service → Authentication → Microsoft Entra** settings, including the two gotchas: the audience must be the **bare client-id** form (else `401`), and *Al

> - **Field-by-field blade config:** [`easy-auth.md`](easy-auth.md) — the exact **App Service → Authentication → Microsoft Entra** settings, including the two gotchas: the audience must be the **bare client-id** form (else `401`), and *Allo

> - **Field-by-field blade config:** [`easy-auth.md`](easy-auth.md) — the exact **App Service → Authentication → Microsoft Entra** settings, including the two gotchas: the audience must be the **bare client-id** form (else `401`), and *Allo

> - Overview: [Authentication and authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization)

> - Overview: [Authentication and authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization)

> - MCP-specific (matches this scenario): [Configure MCP server authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/configure-authentication-mcp) — App Service Authentication validates the MCP client's token fo

> - MCP-specific (matches this scenario): [Configure MCP server authorization in Azure App Service](https://learn.microsoft.com/azure/app-service/configure-authentication-mcp) — App Service Authentication validates the MCP client's token fo

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

$TunnelHost = ($line -replace '.*https://', '' -replace '/.*', '').Trim() if (-not $TunnelHost) { Fail "Could not parse the tunnel host from 'devtunnel show'." } $BaseUrl = "https://$TunnelHost"

$TunnelHost = ($line -replace '.*https://', '' -replace '/.*', '').Trim() if (-not $TunnelHost) { Fail "Could not parse the tunnel host from 'devtunnel show'." } $BaseUrl = "https://$TunnelHost"

$BaseUrl = "https://$TunnelHost"

$BaseUrl = "https://$TunnelHost"

Executable file

Executable file

Executable file

Executable file

if ($liveHost -and $liveHost -ne $TunnelHost) {             Write-Host "Tunnel drift detected — env points at '$TunnelHost' but tunnel '$TunnelName' is live at '$liveHost'." -ForegroundColor Yellow             $BaseUrl = "https://$liveHost"

if ($liveHost -and $liveHost -ne $TunnelHost) {             Write-Host "Tunnel drift detected — env points at '$TunnelHost' but tunnel '$TunnelName' is live at '$liveHost'." -ForegroundColor Yellow             $BaseUrl = "https://$liveHost"

Write-Host "Tunnel drift detected — env points at '$TunnelHost' but tunnel '$TunnelName' is live at '$liveHost'." -ForegroundColor Yellow             $BaseUrl = "https://$liveHost"; $TunnelHost = $liveHost             Set-EnvValue -Key "MCP

Write-Host "Tunnel drift detected — env points at '$TunnelHost' but tunnel '$TunnelName' is live at '$liveHost'." -ForegroundColor Yellow             $BaseUrl = "https://$liveHost"; $TunnelHost = $liveHost             Set-EnvValue -Key "MCP

$BaseUrl = "https://$liveHost"; $TunnelHost = $liveHost

$BaseUrl = "https://$liveHost"; $TunnelHost = $liveHost

Executable file

Executable file

Executable file

Executable file

$TenantId = az rest --method GET --uri "https://graph.microsoft.com/v1.0/organization" --only-show-errors 2>$null | ConvertFrom-Json | ForEach-Object { $_.value[0].id }

$TenantId = az rest --method GET --uri "https://graph.microsoft.com/v1.0/organization" --only-show-errors 2>$null | ConvertFrom-Json | ForEach-Object { $_.value[0].id }

az ad app update --id $ClientId --web-redirect-uris "https://teams.microsoft.com/api/platform/v1.0/oAuthConsentRedirect"

az ad app update --id $ClientId --web-redirect-uris "https://teams.microsoft.com/api/platform/v1.0/oAuthConsentRedirect"

Executable file

Executable file

param(     [string]$NewUrl,           # optional: force this base URL (e.g. https://myapp-tunnel-xyz.usw2.devtunnels.ms)

param(     [string]$NewUrl,           # optional: force this base URL (e.g. https://myapp-tunnel-xyz.usw2.devtunnels.ms)

[string]$NewUrl,           # optional: force this base URL (e.g. https://myapp-tunnel-xyz.usw2.devtunnels.ms)

[string]$NewUrl,           # optional: force this base URL (e.g. https://myapp-tunnel-xyz.usw2.devtunnels.ms)

} elseif ($TunnelName) {     $show = devtunnel show $TunnelName 2>&1     if ($LASTEXITCODE -ne 0) { Fail "'devtunnel show $TunnelName' failed. Pass -NewUrl <https://...> explicitly." }

} elseif ($TunnelName) {     $show = devtunnel show $TunnelName 2>&1     if ($LASTEXITCODE -ne 0) { Fail "'devtunnel show $TunnelName' failed. Pass -NewUrl <https://...> explicitly." }

$show = devtunnel show $TunnelName 2>&1     if ($LASTEXITCODE -ne 0) { Fail "'devtunnel show $TunnelName' failed. Pass -NewUrl <https://...> explicitly." }     $line = $show | Where-Object { $_ -match "Connect via browser" -or $_ -match "ht

$show = devtunnel show $TunnelName 2>&1     if ($LASTEXITCODE -ne 0) { Fail "'devtunnel show $TunnelName' failed. Pass -NewUrl <https://...> explicitly." }     $line = $show | Where-Object { $_ -match "Connect via browser" -or $_ -match "ht

if ($LASTEXITCODE -ne 0) { Fail "'devtunnel show $TunnelName' failed. Pass -NewUrl <https://...> explicitly." }

if ($LASTEXITCODE -ne 0) { Fail "'devtunnel show $TunnelName' failed. Pass -NewUrl <https://...> explicitly." }

$line = $show | Where-Object { $_ -match "Connect via browser" -or $_ -match "https://" } | Select-Object -First 1     $TunnelHost = ($line -replace '.*https://', '' -replace '/.*', '').Trim()     if (-not $TunnelHost) { Fail "Could not par

$line = $show | Where-Object { $_ -match "Connect via browser" -or $_ -match "https://" } | Select-Object -First 1     $TunnelHost = ($line -replace '.*https://', '' -replace '/.*', '').Trim()     if (-not $TunnelHost) { Fail "Could not par

$TunnelHost = ($line -replace '.*https://', '' -replace '/.*', '').Trim()     if (-not $TunnelHost) { Fail "Could not parse the tunnel host from 'devtunnel show'. Pass -NewUrl <https://...> explicitly." }     $BaseUrl = "https://$TunnelHost

$TunnelHost = ($line -replace '.*https://', '' -replace '/.*', '').Trim()     if (-not $TunnelHost) { Fail "Could not parse the tunnel host from 'devtunnel show'. Pass -NewUrl <https://...> explicitly." }     $BaseUrl = "https://$TunnelHost

if (-not $TunnelHost) { Fail "Could not parse the tunnel host from 'devtunnel show'. Pass -NewUrl <https://...> explicitly." }

if (-not $TunnelHost) { Fail "Could not parse the tunnel host from 'devtunnel show'. Pass -NewUrl <https://...> explicitly." }

$BaseUrl = "https://$TunnelHost"

$BaseUrl = "https://$TunnelHost"

Executable file

Executable file

$file = [System.IO.Path]::GetTempFileName()     $json | Set-Content -Path $file -Encoding UTF8     $out = az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$ObjectId" --headers "Content-Type=application/json" --bod

$file = [System.IO.Path]::GetTempFileName()     $json | Set-Content -Path $file -Encoding UTF8     $out = az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$ObjectId" --headers "Content-Type=application/json" --bod

$json | Set-Content -Path $file -Encoding UTF8     $out = az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$ObjectId" --headers "Content-Type=application/json" --body "@$file" 2>&1     Remove-Item $file -ErrorActi

$json | Set-Content -Path $file -Encoding UTF8     $out = az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$ObjectId" --headers "Content-Type=application/json" --body "@$file" 2>&1     Remove-Item $file -ErrorActi

$out = az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$ObjectId" --headers "Content-Type=application/json" --body "@$file" 2>&1

$out = az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$ObjectId" --headers "Content-Type=application/json" --body "@$file" 2>&1

Executable file

Executable file

$body = '{"jsonrpc":"2.0","method":"initialize","id":1,"params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' try {     Invoke-WebRequest -Uri "http://localhost:$Port/mcp" -Method POST -Co

$body = '{"jsonrpc":"2.0","method":"initialize","id":1,"params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' try {     Invoke-WebRequest -Uri "http://localhost:$Port/mcp" -Method POST -Co

try {     Invoke-WebRequest -Uri "http://localhost:$Port/mcp" -Method POST -ContentType "application/json" -Body $body | Out-Null     Write-Host "WARNING: Got 200 — auth not enforced. Check the Phase 7 guard insertion." -ForegroundColor Yel

try {     Invoke-WebRequest -Uri "http://localhost:$Port/mcp" -Method POST -ContentType "application/json" -Body $body | Out-Null     Write-Host "WARNING: Got 200 — auth not enforced. Check the Phase 7 guard insertion." -ForegroundColor Yel

Invoke-WebRequest -Uri "http://localhost:$Port/mcp" -Method POST -ContentType "application/json" -Body $body | Out-Null

Invoke-WebRequest -Uri "http://localhost:$Port/mcp" -Method POST -ContentType "application/json" -Body $body | Out-Null

$code = $_.Exception.Response.StatusCode.value__     if ($code -eq 401) { Write-Host "VERIFIED: 401 Unauthorized — SSO guard working OK" -ForegroundColor Green }     elseif (-not $code) { Write-Host "Could not reach http://localhost:$Port/m

$code = $_.Exception.Response.StatusCode.value__     if ($code -eq 401) { Write-Host "VERIFIED: 401 Unauthorized — SSO guard working OK" -ForegroundColor Green }     elseif (-not $code) { Write-Host "Could not reach http://localhost:$Port/m

if ($code -eq 401) { Write-Host "VERIFIED: 401 Unauthorized — SSO guard working OK" -ForegroundColor Green }     elseif (-not $code) { Write-Host "Could not reach http://localhost:$Port/mcp — is the server running?" -ForegroundColor Yellow 

if ($code -eq 401) { Write-Host "VERIFIED: 401 Unauthorized — SSO guard working OK" -ForegroundColor Green }     elseif (-not $code) { Write-Host "Could not reach http://localhost:$Port/mcp — is the server running?" -ForegroundColor Yellow 

elseif (-not $code) { Write-Host "Could not reach http://localhost:$Port/mcp — is the server running?" -ForegroundColor Yellow }

elseif (-not $code) { Write-Host "Could not reach http://localhost:$Port/mcp — is the server running?" -ForegroundColor Yellow }

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

> **Applies to: code-based Teams bots/agents only** (templates: `bot`, `teams-agent*`, `basic-custom-engine-agent`, `weather-agent`, `coffee-agent`, `bot-sso`, `msgext-*`, `tab*`). > > Does **not** apply to declarative agents, API plugins, 

> **Applies to: code-based Teams bots/agents only** (templates: `bot`, `teams-agent*`, `basic-custom-engine-agent`, `weather-agent`, `coffee-agent`, `bot-sso`, `msgext-*`, `tab*`). > > Does **not** apply to declarative agents, API plugins, 

> Does **not** apply to declarative agents, API plugins, Copilot connectors, or `declarative-agent-*` / `copilot-connector` templates — those have no source code to scaffold against. For those, follow the in-template instructions and the [M

> Does **not** apply to declarative agents, API plugins, Copilot connectors, or `declarative-agent-*` / `copilot-connector` templates — those have no source code to scaffold against. For those, follow the in-template instructions and the [M

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

fetch OpenID config from https://login.botframework.com/v1/.well-known/openidconfiguration

fetch OpenID config from https://login.botframework.com/v1/.well-known/openidconfiguration

fetch OpenID config from https://login.botframework.com/v1/.well-known/openidconfiguration

validate JWT from Authorization header verify audience = your bot's CLIENT_ID verify issuer = https://api.botframework.com

validate JWT from Authorization header verify audience = your bot's CLIENT_ID verify issuer = https://api.botframework.com

validate JWT from Authorization header verify audience = your bot's CLIENT_ID verify issuer = https://api.botframework.com

verify issuer = https://api.botframework.com

verify issuer = https://api.botframework.com

verify issuer = https://api.botframework.com

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

1. **Slack App Directory → Teams App Store (Partner Center).** Slack apps are listed in the Slack App Directory for public distribution. Teams apps are published to the Microsoft Teams App Store via Partner Center. The review and submission

1. **Slack App Directory → Teams App Store (Partner Center).** Slack apps are listed in the Slack App Directory for public distribution. Teams apps are published to the Microsoft Teams App Store via Partner Center. The review and submission

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

3. **Slack `InstallationStore` → conversation reference storage.** Slack's `InstallationStore` persists tokens per workspace for API calls. Teams doesn't need per-workspace tokens, but you still need to store conversation references for pro

3. **Slack `InstallationStore` → conversation reference storage.** Slack's `InstallationStore` persists tokens per workspace for API calls. Teams doesn't need per-workspace tokens, but you still need to store conversation references for pro

4. **Slack org-level install → Teams Admin Center tenant-wide deployment.** Slack Enterprise Grid supports org-level app installation. In Teams, tenant-wide deployment is done via the Teams Admin Center by an IT admin: Manage Apps → Upload/

4. **Slack org-level install → Teams Admin Center tenant-wide deployment.** Slack Enterprise Grid supports org-level app installation. In Teams, tenant-wide deployment is done via the Teams Admin Center by an IT admin: Manage Apps → Upload/

5. **Development install → Teams sideloading.** Slack development apps are installed via the app's manage page or OAuth URL. Teams development apps are sideloaded: upload the app package (ZIP with manifest + icons) directly into Teams. Side

5. **Development install → Teams sideloading.** Slack development apps are installed via the app's manage page or OAuth URL. Teams development apps are sideloaded: upload the app package (ZIP with manifest + icons) directly into Teams. Side

6. **Agents Toolkit simplifies packaging, provisioning, and deployment.** Agents Toolkit (VS Code extension or CLI `atk`) automates: Azure resource provisioning, app package generation, sideloading, and publishing. It replaces the manual Az

6. **Agents Toolkit simplifies packaging, provisioning, and deployment.** Agents Toolkit (VS Code extension or CLI `atk`) automates: Azure resource provisioning, app package generation, sideloading, and publishing. It replaces the manual Az

7. **Multi-tenant Slack app → Azure AD multi-tenant app registration.** Slack multi-workspace apps use the App Directory + OAuth per workspace. Teams multi-tenant bots use a single Azure AD app registration with `signInAudience: "AzureADMul

7. **Multi-tenant Slack app → Azure AD multi-tenant app registration.** Slack multi-workspace apps use the App Directory + OAuth per workspace. Teams multi-tenant bots use a single Azure AD app registration with `signInAudience: "AzureADMul

8. **Slack app manifest (`manifest.json`) → Teams app manifest (`manifest.json` in app package).** Both platforms use JSON manifests but with completely different schemas. Slack's manifest includes OAuth scopes, event subscriptions, slash c

8. **Slack app manifest (`manifest.json`) → Teams app manifest (`manifest.json` in app package).** Both platforms use JSON manifests but with completely different schemas. Slack's manifest includes OAuth scopes, event subscriptions, slash c

9. **Slack app icons (512x512 + workspace-specific) → Teams icons (color 192x192 + outline 32x32).** Teams requires exactly two icon files in the app package: a full-color icon (192x192 PNG) and an outline/monochrome icon (32x32 PNG with tr

9. **Slack app icons (512x512 + workspace-specific) → Teams icons (color 192x192 + outline 32x32).** Teams requires exactly two icon files in the app package: a full-color icon (192x192 PNG) and an outline/monochrome icon (32x32 PNG with tr

10. **Slack app review (hours-days) vs Teams store review (1-2 weeks).** Slack's App Directory review is relatively fast. Teams App Store review via Partner Center is more rigorous and can take 1-2 weeks. Plan for revision cycles — common r

10. **Slack app review (hours-days) vs Teams store review (1-2 weeks).** Slack's App Directory review is relatively fast. Teams App Store review via Partner Center is more rigorous and can take 1-2 weeks. Plan for revision cycles — common r

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/appsource/publish

- https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/appsource/publish

- https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/apps-upload

- https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/apps-upload

- https://learn.microsoft.com/en-us/microsoftteams/manage-apps

- https://learn.microsoft.com/en-us/microsoftteams/manage-apps

- https://learn.microsoft.com/en-us/microsoftteams/platform/toolkit/teams-toolkit-fundamentals

- https://learn.microsoft.com/en-us/microsoftteams/platform/toolkit/teams-toolkit-fundamentals

- https://learn.microsoft.com/en-us/microsoftteams/platform/resources/schema/manifest-schema

- https://learn.microsoft.com/en-us/microsoftteams/platform/resources/schema/manifest-schema

- https://learn.microsoft.com/en-us/azure/bot-service/bot-service-quickstart-registration

- https://learn.microsoft.com/en-us/azure/bot-service/bot-service-quickstart-registration

- https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/appsource/prepare/teams-store-validation-guidelines

- https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/appsource/prepare/teams-store-validation-guidelines

- https://github.com/microsoft/teams.ts

- https://github.com/microsoft/teams.ts

- https://api.slack.com/distribution — Slack app distribution

- https://api.slack.com/distribution — Slack app distribution

1. **Slack `conversations.create` → Graph `POST /teams/{team-id}/channels`.** Slack creates channels in a flat workspace namespace. Teams channels always belong to a specific team — you must know the `team-id` first. The request body includ

1. **Slack `conversations.create` → Graph `POST /teams/{team-id}/channels`.** Slack creates channels in a flat workspace namespace. Teams channels always belong to a specific team — you must know the `team-id` first. The request body includ

2. **Slack `conversations.archive` → no true archive in Teams.** Teams has no channel archive API. Workarounds: (a) delete the channel (destructive, 30-day soft delete), (b) rename the channel with a `[ARCHIVED]` prefix, (c) remove all memb

2. **Slack `conversations.archive` → no true archive in Teams.** Teams has no channel archive API. Workarounds: (a) delete the channel (destructive, 30-day soft delete), (b) rename the channel with a `[ARCHIVED]` prefix, (c) remove all memb

3. **Slack `conversations.invite` → Graph `POST /teams/{team-id}/channels/{channel-id}/members`.** The request body must include the user's Azure AD Object ID (`@odata.type: '#microsoft.graph.aadUserConversationMember'`) and a `roles` array

3. **Slack `conversations.invite` → Graph `POST /teams/{team-id}/channels/{channel-id}/members`.** The request body must include the user's Azure AD Object ID (`@odata.type: '#microsoft.graph.aadUserConversationMember'`) and a `roles` array

4. **Slack `conversations.kick` → Graph `DELETE /teams/{team-id}/channels/{channel-id}/members/{membership-id}`.** You must first resolve the `membership-id` by listing channel members (`GET /teams/{team-id}/channels/{channel-id}/members`) 

4. **Slack `conversations.kick` → Graph `DELETE /teams/{team-id}/channels/{channel-id}/members/{membership-id}`.** You must first resolve the `membership-id` by listing channel members (`GET /teams/{team-id}/channels/{channel-id}/members`) 

5. **Slack `conversations.setTopic` → Graph `PATCH /teams/{team-id}/channels/{channel-id}` with `description`.** Slack channels have a separate `topic` field. Teams channels use the `description` field as the closest equivalent. The channel

5. **Slack `conversations.setTopic` → Graph `PATCH /teams/{team-id}/channels/{channel-id}` with `description`.** Slack channels have a separate `topic` field. Teams channels use the `description` field as the closest equivalent. The channel

6. **All channel operations require a `team-id`.** Slack has a flat channel namespace (every channel has a globally-unique `C-ID`). Teams channels are nested under teams. Most operations need both `team-id` and `channel-id`. Resolve team ID

6. **All channel operations require a `team-id`.** Slack has a flat channel namespace (every channel has a globally-unique `C-ID`). Teams channels are nested under teams. Most operations need both `team-id` and `channel-id`. Resolve team ID

7. **Channel name restrictions differ from Slack.** Teams channel names cannot contain: `~ # % & * { } / \ : < > ? + | ' "`. Maximum length is 50 characters (Slack allows 80). Channel names must be unique within a team. Validate and sanitiz

7. **Channel name restrictions differ from Slack.** Teams channel names cannot contain: `~ # % & * { } / \ : < > ? + | ' "`. Maximum length is 50 characters (Slack allows 80). Channel names must be unique within a team. Validate and sanitiz

8. **Graph API requires application or delegated permissions.** Channel operations need `Channel.Create`, `ChannelMember.ReadWrite.All`, `Channel.Delete.All` (application permissions) or equivalent delegated permissions. These require Azure

8. **Graph API requires application or delegated permissions.** Channel operations need `Channel.Create`, `ChannelMember.ReadWrite.All`, `Channel.Delete.All` (application permissions) or equivalent delegated permissions. These require Azure

9. **Slack `conversations.list` → Graph `GET /teams/{team-id}/channels`.** List all channels in a team. For listing channels across teams, iterate over `GET /me/joinedTeams` first, then list channels per team. There is no single API to list

9. **Slack `conversations.list` → Graph `GET /teams/{team-id}/channels`.** List all channels in a team. For listing channels across teams, iterate over `GET /me/joinedTeams` first, then list channels per team. There is no single API to list

10. **Private channels have separate membership management.** Slack private channels (`is_private: true`) map to Teams private channels (`membershipType: 'private'`). Private channel members are managed via the channel members API, not the 

10. **Private channels have separate membership management.** Slack private channels (`is_private: true`) map to Teams private channels (`membershipType: 'private'`). Private channel members are managed via the channel members API, not the 

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

await graph.api(`/teams/${teamId}/channels/${channel.id}/members`).post({       "@odata.type": "#microsoft.graph.aadUserConversationMember",       "user@odata.bind": `https://graph.microsoft.com/v1.0/users('${aadId}')`,

await graph.api(`/teams/${teamId}/channels/${channel.id}/members`).post({       "@odata.type": "#microsoft.graph.aadUserConversationMember",       "user@odata.bind": `https://graph.microsoft.com/v1.0/users('${aadId}')`,

"@odata.type": "#microsoft.graph.aadUserConversationMember",       "user@odata.bind": `https://graph.microsoft.com/v1.0/users('${aadId}')`,       roles: [], // empty = member, ['owner'] = owner

"@odata.type": "#microsoft.graph.aadUserConversationMember",       "user@odata.bind": `https://graph.microsoft.com/v1.0/users('${aadId}')`,       roles: [], // empty = member, ['owner'] = owner

"user@odata.bind": `https://graph.microsoft.com/v1.0/users('${aadId}')`,

"user@odata.bind": `https://graph.microsoft.com/v1.0/users('${aadId}')`,

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- https://learn.microsoft.com/en-us/graph/api/channel-post

- https://learn.microsoft.com/en-us/graph/api/channel-post

- https://learn.microsoft.com/en-us/graph/api/channel-post-members

- https://learn.microsoft.com/en-us/graph/api/channel-post-members

- https://learn.microsoft.com/en-us/graph/api/channel-delete-members

- https://learn.microsoft.com/en-us/graph/api/channel-delete-members

- https://learn.microsoft.com/en-us/graph/api/channel-patch

- https://learn.microsoft.com/en-us/graph/api/channel-patch

- https://learn.microsoft.com/en-us/graph/api/team-archive

- https://learn.microsoft.com/en-us/graph/api/team-archive

- https://learn.microsoft.com/en-us/graph/api/channel-list

- https://learn.microsoft.com/en-us/graph/api/channel-list

- https://learn.microsoft.com/en-us/microsoftteams/limits-specifications-teams

- https://learn.microsoft.com/en-us/microsoftteams/limits-specifications-teams

- https://github.com/microsoft/teams.ts

- https://github.com/microsoft/teams.ts

- https://api.slack.com/methods/conversations.create — Slack conversations API

- https://api.slack.com/methods/conversations.create — Slack conversations API

1. Teams bots do **not** have a native slash command system equivalent to Slack's `app.command('/name')`. Slack slash commands must be reimplemented using one of three Teams patterns: text pattern matching, messaging extensions, or manifest

1. Teams bots do **not** have a native slash command system equivalent to Slack's `app.command('/name')`. Slack slash commands must be reimplemented using one of three Teams patterns: text pattern matching, messaging extensions, or manifest

2. The most direct migration path is **text pattern matching** with `app.message(regex)` in the Teams SDK. Map `app.command('/help')` to `app.message(/^\/?help$/i)`. The leading `/?` makes the slash optional so users can type either "help" 

2. The most direct migration path is **text pattern matching** with `app.message(regex)` in the Teams SDK. Map `app.command('/help')` to `app.message(/^\/?help$/i)`. The leading `/?` makes the slash optional so users can type either "help" 

3. Remove all `ack()` calls when migrating to Teams. Teams handlers do not require acknowledgement -- simply process the request and respond. The `ack` concept does not exist in the Teams SDK. [github.com/microsoft/teams.ts](https://github.

3. Remove all `ack()` calls when migrating to Teams. Teams handlers do not require acknowledgement -- simply process the request and respond. The `ack` concept does not exist in the Teams SDK. [github.com/microsoft/teams.ts](https://github.

4. Replace Slack's `respond()` (response_url) and `say()` with the Teams context methods `send()` (new message) and `reply()` (threaded reply). There is no Teams equivalent of Slack's ephemeral response -- all bot messages are visible to pa

4. Replace Slack's `respond()` (response_url) and `say()` with the Teams context methods `send()` (new message) and `reply()` (threaded reply). There is no Teams equivalent of Slack's ephemeral response -- all bot messages are visible to pa

5. Slack's `trigger_id` for opening modals has no direct Teams equivalent. Instead, send an Adaptive Card with form inputs inline, or use a Task Module (dialog) opened via `dialog.open` handler. Task modules do not require a trigger_id -- t

5. Slack's `trigger_id` for opening modals has no direct Teams equivalent. Instead, send an Adaptive Card with form inputs inline, or use a Task Module (dialog) opened via `dialog.open` handler. Task modules do not require a trigger_id -- t

6. For command **discoverability**, add entries to the `commands` array in the manifest's `bots` section. These appear as suggestions when users type in the bot's compose box. They are UI hints only -- the bot still receives the text as a r

6. For command **discoverability**, add entries to the `commands` array in the manifest's `bots` section. These appear as suggestions when users type in the bot's compose box. They are UI hints only -- the bot still receives the text as a r

7. For a richer command UX, use **messaging extensions** (`composeExtensions` in manifest). Search-based extensions let users query and insert results; action-based extensions open a task module form. These replace complex slash commands th

7. For a richer command UX, use **messaging extensions** (`composeExtensions` in manifest). Search-based extensions let users query and insert results; action-based extensions open a task module form. These replace complex slash commands th

8. Slack's `command.text` (the argument string) maps to parsing `activity.text` in Teams. Strip the bot @mention prefix first (set `activity.mentions.stripText: true` in App options), then parse the remaining text for arguments. [github.com

8. Slack's `command.text` (the argument string) maps to parsing `activity.text` in Teams. Strip the bot @mention prefix first (set `activity.mentions.stripText: true` in App options), then parse the remaining text for arguments. [github.com

9. Slack's `command.user_id` maps to `activity.from.aadObjectId` (Azure AD Object ID) in Teams. Slack's `command.channel_id` maps to `activity.conversation.id`. These IDs have completely different formats and are not interchangeable. [learn

9. Slack's `command.user_id` maps to `activity.from.aadObjectId` (Azure AD Object ID) in Teams. Slack's `command.channel_id` maps to `activity.conversation.id`. These IDs have completely different formats and are not interchangeable. [learn

10. In Teams channels, bots only receive messages when @mentioned (unless configured otherwise via RSC permissions). Slash commands in Slack work without mention. Account for this UX difference by instructing users to @mention the bot or by

10. In Teams channels, bots only receive messages when @mentioned (unless configured otherwise via RSC permissions). Slash commands in Slack work without mention. Account for this UX difference by instructing users to @mention the bot or by

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/what-are-bots

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/what-are-bots

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/create-a-bot-commands-menu

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/create-a-bot-commands-menu

- https://learn.microsoft.com/en-us/microsoftteams/platform/messaging-extensions/what-are-messaging-extensions

- https://learn.microsoft.com/en-us/microsoftteams/platform/messaging-extensions/what-are-messaging-extensions

- https://learn.microsoft.com/en-us/microsoftteams/platform/task-modules-and-cards/what-are-task-modules

- https://learn.microsoft.com/en-us/microsoftteams/platform/task-modules-and-cards/what-are-task-modules

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/channel-and-group-conversations

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/channel-and-group-conversations

- https://github.com/microsoft/teams.ts

- https://github.com/microsoft/teams.ts

- https://slack.dev/bolt-js/concepts/commands

- https://slack.dev/bolt-js/concepts/commands

- https://api.slack.com/interactivity/slash-commands

- https://api.slack.com/interactivity/slash-commands

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- Bolt.js `ExpressReceiver`: https://slack.dev/bolt-js/concepts/custom-routes

- Bolt.js `ExpressReceiver`: https://slack.dev/bolt-js/concepts/custom-routes

- Bolt.js `ExpressReceiver`: https://slack.dev/bolt-js/concepts/custom-routes

- Bot Framework `CloudAdapter`: https://learn.microsoft.com/en-us/javascript/api/botbuilder/cloudadapter

- Bot Framework `CloudAdapter`: https://learn.microsoft.com/en-us/javascript/api/botbuilder/cloudadapter

- Bot Framework `CloudAdapter`: https://learn.microsoft.com/en-us/javascript/api/botbuilder/cloudadapter

- Express 5: https://expressjs.com/en/5x/api.html

- Express 5: https://expressjs.com/en/5x/api.html

- Express 5: https://expressjs.com/en/5x/api.html

1. Slack's `app.event('event_name')` maps to Teams' `app.on('route_name')` pattern. The event names and payload shapes are completely different between the two platforms. Always consult the mapping table below for the correct Teams route. [

1. Slack's `app.event('event_name')` maps to Teams' `app.on('route_name')` pattern. The event names and payload shapes are completely different between the two platforms. Always consult the mapping table below for the correct Teams route. [

2. Slack's `app.message(pattern)` maps directly to Teams' `app.message(pattern)` for pattern-matched messages. For a catch-all, Slack uses `app.message(async ...)` while Teams uses `app.on('message', async ...)`. [github.com/microsoft/teams

2. Slack's `app.message(pattern)` maps directly to Teams' `app.message(pattern)` for pattern-matched messages. For a catch-all, Slack uses `app.message(async ...)` while Teams uses `app.on('message', async ...)`. [github.com/microsoft/teams

3. Slack's `app.event('app_mention')` has no dedicated Teams route. In Teams channels, bots receive messages only when @mentioned, so the standard `app.on('message')` handler already implies a mention context. Check `activity.entities` for 

3. Slack's `app.event('app_mention')` has no dedicated Teams route. In Teams channels, bots receive messages only when @mentioned, so the standard `app.on('message')` handler already implies a mention context. Check `activity.entities` for 

4. Slack's `app.event('member_joined_channel')` and `app.event('member_left_channel')` map to Teams' `app.on('conversationUpdate')` with inspection of `activity.membersAdded` or `activity.membersRemoved` arrays. [learn.microsoft.com -- conv

4. Slack's `app.event('member_joined_channel')` and `app.event('member_left_channel')` map to Teams' `app.on('conversationUpdate')` with inspection of `activity.membersAdded` or `activity.membersRemoved` arrays. [learn.microsoft.com -- conv

5. Slack's `say()` maps to Teams' `send()` for posting a new message. Slack's threaded replies via `say({ thread_ts })` map to Teams' `reply()` method which uses `replyToId` internally for threaded conversation. [github.com/microsoft/teams.

5. Slack's `say()` maps to Teams' `send()` for posting a new message. Slack's threaded replies via `say({ thread_ts })` map to Teams' `reply()` method which uses `replyToId` internally for threaded conversation. [github.com/microsoft/teams.

6. Slack's `app.event('reaction_added')` and `app.event('reaction_removed')` map to Teams' `app.on('messageReaction')` route. Teams delivers both added and removed reactions in a single route -- inspect `activity.reactionsAdded` and `activi

6. Slack's `app.event('reaction_added')` and `app.event('reaction_removed')` map to Teams' `app.on('messageReaction')` route. Teams delivers both added and removed reactions in a single route -- inspect `activity.reactionsAdded` and `activi

7. Slack's ephemeral messages (`respond({ response_type: 'ephemeral' })`) have **no Teams equivalent**. Redesign ephemeral responses as: (a) messages in personal (1:1) chat, (b) Adaptive Cards with user-specific `Action.Execute` refresh, or

7. Slack's ephemeral messages (`respond({ response_type: 'ephemeral' })`) have **no Teams equivalent**. Redesign ephemeral responses as: (a) messages in personal (1:1) chat, (b) Adaptive Cards with user-specific `Action.Execute` refresh, or

8. In Teams channels, bots require @mention to receive messages (default behavior). This is fundamentally different from Slack where bots receive all channel messages. To receive all messages without mention, the app must request Resource-S

8. In Teams channels, bots require @mention to receive messages (default behavior). This is fundamentally different from Slack where bots receive all channel messages. To receive all messages without mention, the app must request Resource-S

9. Slack's `app.event('app_home_opened')` (App Home tab) maps to Teams' static tab or `tab.open` invoke route for personal tabs. There is no direct equivalent -- Teams tabs are web pages rendered in an iframe, not bot-driven views. [learn.m

9. Slack's `app.event('app_home_opened')` (App Home tab) maps to Teams' static tab or `tab.open` invoke route for personal tabs. There is no direct equivalent -- Teams tabs are web pages rendered in an iframe, not bot-driven views. [learn.m

10. Teams provides install/uninstall events via `app.on('install.add')` and `app.on('install.remove')` which have no direct Slack equivalent. Use these to send welcome messages and store conversation references for proactive messaging. [git

10. Teams provides install/uninstall events via `app.on('install.add')` and `app.on('install.remove')` which have no direct Slack equivalent. Use these to send welcome messages and store conversation references for proactive messaging. [git

11. **Teams has only 6 reaction types** (`like`, `heart`, `laugh`, `surprised`, `sad`, `angry`) — Slack supports unlimited custom emoji reactions. Bots that use reactions as workflow triggers (e.g., `:white_check_mark:` to mark approved, `:

11. **Teams has only 6 reaction types** (`like`, `heart`, `laugh`, `surprised`, `sad`, `angry`) — Slack supports unlimited custom emoji reactions. Bots that use reactions as workflow triggers (e.g., `:white_check_mark:` to mark approved, `:

12. **Threading model differs significantly.** Slack uses `thread_ts` to identify a parent message and `reply_broadcast` to also post a thread reply to the channel. Teams uses `replyToId` in the activity and the `reply()` method. There is *

12. **Threading model differs significantly.** Slack uses `thread_ts` to identify a parent message and `reply_broadcast` to also post a thread reply to the channel. Teams uses `replyToId` in the activity and the `reply()` method. There is *

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/subscribe-to-conversation-events

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/subscribe-to-conversation-events

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/channel-and-group-conversations

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/channel-and-group-conversations

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/conversation-basics

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/conversation-basics

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/send-proactive-messages

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/conversations/send-proactive-messages

- https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent

- https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent

- https://learn.microsoft.com/en-us/microsoftteams/platform/tabs/what-are-tabs

- https://learn.microsoft.com/en-us/microsoftteams/platform/tabs/what-are-tabs

- https://github.com/microsoft/teams.ts

- https://github.com/microsoft/teams.ts

- https://slack.dev/bolt-js/concepts/events

- https://slack.dev/bolt-js/concepts/events

- https://slack.dev/bolt-js/concepts/message-listening

- https://slack.dev/bolt-js/concepts/message-listening

1. **Slack `files.upload` → Teams FileConsentCard + Graph API upload.** Slack bots upload files directly via `files.upload`. Teams bots cannot directly attach files to messages. Instead: (a) send a FileConsentCard asking the user for upload

1. **Slack `files.upload` → Teams FileConsentCard + Graph API upload.** Slack bots upload files directly via `files.upload`. Teams bots cannot directly attach files to messages. Instead: (a) send a FileConsentCard asking the user for upload

2. **The `supportsFiles: true` manifest flag is required.** Without `"supportsFiles": true` in the bot's manifest entry, Teams will not show file consent cards or allow the bot to handle file-related activities. This flag only works in pers

2. **The `supportsFiles: true` manifest flag is required.** Without `"supportsFiles": true` in the bot's manifest entry, Teams will not show file consent cards or allow the bot to handle file-related activities. This flag only works in pers

3. **Slack `files.sharedPublicURL` → Graph API `createLink` sharing link.** Slack creates a public URL for a file. In Teams/OneDrive, use the Graph API `POST /drives/{drive-id}/items/{item-id}/createLink` to create a sharing link with the d

3. **Slack `files.sharedPublicURL` → Graph API `createLink` sharing link.** Slack creates a public URL for a file. In Teams/OneDrive, use the Graph API `POST /drives/{drive-id}/items/{item-id}/createLink` to create a sharing link with the d

4. **Slack file events (`file_shared`, `file_created`) → `activity.attachments` in message handler.** When a user sends a file to a Teams bot, the file appears as an attachment on the incoming message activity. Check `activity.attachments` 

4. **Slack file events (`file_shared`, `file_created`) → `activity.attachments` in message handler.** When a user sends a file to a Teams bot, the file appears as an attachment on the incoming message activity. Check `activity.attachments` 

5. **Download user-uploaded files via the `downloadUrl` in the attachment.** Each file attachment includes a `content.downloadUrl` with a pre-authenticated URL. Use `fetch()` or `axios` to download the file content. The URL is short-lived —

5. **Download user-uploaded files via the `downloadUrl` in the attachment.** Each file attachment includes a `content.downloadUrl` with a pre-authenticated URL. Use `fetch()` or `axios` to download the file content. The URL is short-lived —

6. **File upload in channels requires SharePoint, not OneDrive.** In personal chat, files go to the user's OneDrive. In channels, files go to the team's SharePoint document library. The Graph API path changes: `POST /drives/{drive-id}/root:

6. **File upload in channels requires SharePoint, not OneDrive.** In personal chat, files go to the user's OneDrive. In channels, files go to the team's SharePoint document library. The Graph API path changes: `POST /drives/{drive-id}/root:

7. **Large files (>4 MB) require Graph resumable upload sessions.** Small files can use simple PUT to Graph API. Files larger than 4 MB must use a resumable upload session: `POST /drives/{drive-id}/items/{parent-id}:/filename:/createUploadS

7. **Large files (>4 MB) require Graph resumable upload sessions.** Small files can use simple PUT to Graph API. Files larger than 4 MB must use a resumable upload session: `POST /drives/{drive-id}/items/{parent-id}:/filename:/createUploadS

8. **FileConsentCard flow is a 3-step protocol.** Step 1: Bot sends a FileConsentCard with filename and size. Step 2: User accepts or declines. Step 3: On accept, Teams sends a `fileConsent/invoke` activity with an `uploadInfo` containing t

8. **FileConsentCard flow is a 3-step protocol.** Step 1: Bot sends a FileConsentCard with filename and size. Step 2: User accepts or declines. Step 3: On accept, Teams sends a `fileConsent/invoke` activity with an `uploadInfo` containing t

9. **Slack `files.list` / `files.info` → Graph API drive item queries.** Slack has dedicated file listing APIs. In Teams, files are stored in OneDrive/SharePoint. Use Graph API: `GET /drives/{drive-id}/root/children` to list files, `GET /dr

9. **Slack `files.list` / `files.info` → Graph API drive item queries.** Slack has dedicated file listing APIs. In Teams, files are stored in OneDrive/SharePoint. Use Graph API: `GET /drives/{drive-id}/root/children` to list files, `GET /dr

10. **File handling only works in personal (1:1) chat scope.** The `supportsFiles` manifest flag and FileConsentCard only work in personal bot conversations. For channel file operations, use Graph API directly without the consent card flow.

10. **File handling only works in personal (1:1) chat scope.** The `supportsFiles` manifest flag and FileConsentCard only work in personal bot conversations. For channel file operations, use Graph API directly without the consent card flow.

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

if (uploadInfo && fileContent) {       // Upload to OneDrive via the pre-signed URL       await fetch(uploadInfo.uploadUrl, {

if (uploadInfo && fileContent) {       // Upload to OneDrive via the pre-signed URL       await fetch(uploadInfo.uploadUrl, {

// Upload to OneDrive via the pre-signed URL       await fetch(uploadInfo.uploadUrl, {         method: "PUT",

// Upload to OneDrive via the pre-signed URL       await fetch(uploadInfo.uploadUrl, {         method: "PUT",

await fetch(uploadInfo.uploadUrl, {

await fetch(uploadInfo.uploadUrl, {

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

// Download file content using the private URL + bot token   const response = await fetch(file.url_private!, {

// Download file content using the private URL + bot token   const response = await fetch(file.url_private!, {

const response = await fetch(file.url_private!, {

const response = await fetch(file.url_private!, {

[Credential-related source omitted]

[Credential-related source omitted]

if (downloadUrl) {         // Download using the pre-authenticated URL (no token needed)         const response = await fetch(downloadUrl);

if (downloadUrl) {         // Download using the pre-authenticated URL (no token needed)         const response = await fetch(downloadUrl);

// Download using the pre-authenticated URL (no token needed)         const response = await fetch(downloadUrl);         const content = await response.text();

// Download using the pre-authenticated URL (no token needed)         const response = await fetch(downloadUrl);         const content = await response.text();

const response = await fetch(downloadUrl);

const response = await fetch(downloadUrl);

const chunk = content.subarray(offset, offset + chunkSize);         const end = Math.min(offset + chunkSize, content.length);         await fetch(session.uploadUrl, {

const chunk = content.subarray(offset, offset + chunkSize);         const end = Math.min(offset + chunkSize, content.length);         await fetch(session.uploadUrl, {

const end = Math.min(offset + chunkSize, content.length);         await fetch(session.uploadUrl, {           method: "PUT",

const end = Math.min(offset + chunkSize, content.length);         await fetch(session.uploadUrl, {           method: "PUT",

await fetch(session.uploadUrl, {

await fetch(session.uploadUrl, {

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/bots-filesv4

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/bots-filesv4

- https://learn.microsoft.com/en-us/graph/api/driveitem-put-content

- https://learn.microsoft.com/en-us/graph/api/driveitem-put-content

- https://learn.microsoft.com/en-us/graph/api/driveitem-createuploadsession

- https://learn.microsoft.com/en-us/graph/api/driveitem-createuploadsession

- https://learn.microsoft.com/en-us/graph/api/driveitem-createlink

- https://learn.microsoft.com/en-us/graph/api/driveitem-createlink

- https://learn.microsoft.com/en-us/microsoftteams/platform/resources/schema/manifest-schema#bots

- https://learn.microsoft.com/en-us/microsoftteams/platform/resources/schema/manifest-schema#bots

- https://github.com/microsoft/teams.ts

- https://github.com/microsoft/teams.ts

- https://api.slack.com/methods/files.uploadV2 — Slack files.upload

- https://api.slack.com/methods/files.uploadV2 — Slack files.upload

- https://api.slack.com/methods/files.sharedPublicURL — Slack file sharing

- https://api.slack.com/methods/files.sharedPublicURL — Slack file sharing

1. Slack uses proprietary ID formats: user IDs start with `U` (e.g., `U01ABCDEF`), channel IDs start with `C` (e.g., `C02GHIJKL`), team/workspace IDs start with `T` (e.g., `T03MNOPQR`), and bot IDs start with `B`. These IDs have no relation

1. Slack uses proprietary ID formats: user IDs start with `U` (e.g., `U01ABCDEF`), channel IDs start with `C` (e.g., `C02GHIJKL`), team/workspace IDs start with `T` (e.g., `T03MNOPQR`), and bot IDs start with `B`. These IDs have no relation

2. Teams identifies users by Azure AD Object ID (a GUID like `00000000-0000-0000-0000-000000000000`), available at `activity.from.aadObjectId`. Conversation IDs are opaque strings like `19:abc123@thread.v2` for channels or `a]concat@...` fo

2. Teams identifies users by Azure AD Object ID (a GUID like `00000000-0000-0000-0000-000000000000`), available at `activity.from.aadObjectId`. Conversation IDs are opaque strings like `19:abc123@thread.v2` for channels or `a]concat@...` fo

3. Slack's request verification via `signingSecret` (HMAC-SHA256 of request body) is replaced by **Bot Framework JWT token validation** in Teams. The Teams SDK handles JWT validation automatically -- no manual signing secret check is needed

3. Slack's request verification via `signingSecret` (HMAC-SHA256 of request body) is replaced by **Bot Framework JWT token validation** in Teams. The Teams SDK handles JWT validation automatically -- no manual signing secret check is needed

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

5. Slack OAuth scopes (e.g., `chat:write`, `users:read`, `commands`) map to **Azure AD permissions** for the Microsoft Graph API (e.g., `User.Read`, `ChannelMessage.Send`). Slack scopes are configured in the Slack app dashboard; Azure AD pe

5. Slack OAuth scopes (e.g., `chat:write`, `users:read`, `commands`) map to **Azure AD permissions** for the Microsoft Graph API (e.g., `User.Read`, `ChannelMessage.Send`). Slack scopes are configured in the Slack app dashboard; Azure AD pe

6. Slack user tokens (obtained via OAuth `users:read` or user token grant) map to **Teams SSO / OAuth card flow**. In Teams, configure an OAuth connection in the Azure Bot resource, then use `isSignedIn` / `signin()` / `userGraph` in handle

6. Slack user tokens (obtained via OAuth `users:read` or user token grant) map to **Teams SSO / OAuth card flow**. In Teams, configure an OAuth connection in the Azure Bot resource, then use `isSignedIn` / `signin()` / `userGraph` in handle

7. To resolve user identity across platforms during migration, use a **shared attribute** like email address. Query Slack's `users.info` API for the user's email, then look up the same email in Azure AD via Microsoft Graph `users?$filter=ma

7. To resolve user identity across platforms during migration, use a **shared attribute** like email address. Query Slack's `users.info` API for the user's email, then look up the same email in Azure AD via Microsoft Graph `users?$filter=ma

8. Any data stored with Slack IDs as keys (user preferences, conversation history, permissions) must be **re-keyed** to Teams/AAD IDs. Plan a data migration step that uses the email-based mapping table to translate stored Slack user IDs to 

8. Any data stored with Slack IDs as keys (user preferences, conversation history, permissions) must be **re-keyed** to Teams/AAD IDs. Plan a data migration step that uses the email-based mapping table to translate stored Slack user IDs to 

9. Slack workspace-level operations (e.g., listing all users via `users.list`, posting to any channel) require bot scopes. In Teams, equivalent operations use Microsoft Graph with **application permissions** (consented by a tenant admin). U

9. Slack workspace-level operations (e.g., listing all users via `users.list`, posting to any channel) require bot scopes. In Teams, equivalent operations use Microsoft Graph with **application permissions** (consented by a tenant admin). U

10. Teams supports **managed identity** as an alternative to client secret for production deployments on Azure. Set `managedIdentityClientId: 'system'` in App options to use Azure Managed Identity instead of storing secrets in environment v

10. Teams supports **managed identity** as an alternative to client secret for production deployments on Azure. Set `managedIdentityClientId: 'system'` in App options to use Azure Managed Identity instead of storing secrets in environment v

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

.oAuthInstallPath("/slack/install")     .oAuthRedirectUriPath("/slack/oauth_redirect")     .oAuthCompletionUrl("https://example.com/success")

.oAuthInstallPath("/slack/install")     .oAuthRedirectUriPath("/slack/oauth_redirect")     .oAuthCompletionUrl("https://example.com/success")

.oAuthRedirectUriPath("/slack/oauth_redirect")     .oAuthCompletionUrl("https://example.com/success")     .oAuthCancellationUrl("https://example.com/cancel")

.oAuthRedirectUriPath("/slack/oauth_redirect")     .oAuthCompletionUrl("https://example.com/success")     .oAuthCancellationUrl("https://example.com/cancel")

.oAuthCompletionUrl("https://example.com/success")

.oAuthCompletionUrl("https://example.com/success")

.oAuthCancellationUrl("https://example.com/cancel")

.oAuthCancellationUrl("https://example.com/cancel")

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- https://learn.microsoft.com/en-us/azure/bot-service/rest-api/bot-framework-rest-connector-authentication

- https://learn.microsoft.com/en-us/azure/bot-service/rest-api/bot-framework-rest-connector-authentication

- https://learn.microsoft.com/en-us/azure/bot-service/bot-service-quickstart-registration

- https://learn.microsoft.com/en-us/azure/bot-service/bot-service-quickstart-registration

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/authentication/bot-sso-overview

- https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/authentication/bot-sso-overview

- https://learn.microsoft.com/en-us/graph/permissions-reference

- https://learn.microsoft.com/en-us/graph/permissions-reference

- https://learn.microsoft.com/en-us/graph/api/user-list

- https://learn.microsoft.com/en-us/graph/api/user-list

- https://learn.microsoft.com/en-us/graph/auth/auth-concepts

- https://learn.microsoft.com/en-us/graph/auth/auth-concepts

- https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

- https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

- https://api.slack.com/types

- https://api.slack.com/types

- https://api.slack.com/methods/users.info

- https://api.slack.com/methods/users.info

- https://github.com/microsoft/teams.ts

- https://github.com/microsoft/teams.ts

[Credential-related source omitted]

[Credential-related source omitted]

1. Map AWS compute services to Azure equivalents using this decision matrix: Lambda + API Gateway maps to Azure Functions (Consumption or Premium), ECS/Fargate maps to Azure Container Apps, EC2 maps to Azure App Service (or Azure VMs for li

1. Map AWS compute services to Azure equivalents using this decision matrix: Lambda + API Gateway maps to Azure Functions (Consumption or Premium), ECS/Fargate maps to Azure Container Apps, EC2 maps to Azure App Service (or Azure VMs for li

2. Teams bots require an HTTPS endpoint at `/api/messages` that accepts POST requests from the Bot Framework. Azure App Service and Container Apps provide this natively; Azure Functions requires an HTTP-triggered function bound to that rout

2. Teams bots require an HTTPS endpoint at `/api/messages` that accepts POST requests from the Bot Framework. Azure App Service and Container Apps provide this natively; Azure Functions requires an HTTP-triggered function bound to that rout

3. Teams expects bot responses within 3 seconds for synchronous invoke activities (card actions, dialogs, message extensions). Azure Functions Consumption plan cold starts (5-10 seconds for Node.js) will violate this. Use the Premium plan (

3. Teams expects bot responses within 3 seconds for synchronous invoke activities (card actions, dialogs, message extensions). Azure Functions Consumption plan cold starts (5-10 seconds for Node.js) will violate this. Use the Premium plan (

4. Enable "Always On" for Azure App Service deployments to prevent the app from unloading after idle periods. Without it, the first request after idle triggers a cold start that can cause Teams timeouts. Set this in Configuration > General 

4. Enable "Always On" for Azure App Service deployments to prevent the app from unloading after idle periods. Without it, the first request after idle triggers a cold start that can cause Teams timeouts. Set this in Configuration > General 

5. Use Node.js 20 LTS or later as the runtime stack. Set this explicitly in App Service (Configuration > General Settings > Stack: Node, Version: 20-lts) or in the Azure Functions `host.json` and app settings. The Teams AI Library v2 requir

5. Use Node.js 20 LTS or later as the runtime stack. Set this explicitly in App Service (Configuration > General Settings > Stack: Node, Version: 20-lts) or in the Azure Functions `host.json` and app settings. The Teams AI Library v2 requir

6. Migrate environment variables from AWS Lambda environment / SSM to Azure App Settings. App Settings are injected as `process.env` variables at runtime, equivalent to Lambda environment variables. Use deployment slots for staging/producti

6. Migrate environment variables from AWS Lambda environment / SSM to Azure App Settings. App Settings are injected as `process.env` variables at runtime, equivalent to Lambda environment variables. Use deployment slots for staging/producti

7. Configure health check endpoints for all Azure compute targets. App Service supports built-in health checks (Configuration > Health check path: `/api/health`). Container Apps use liveness and readiness probes. This replaces Lambda/ECS he

7. Configure health check endpoints for all Azure compute targets. App Service supports built-in health checks (Configuration > Health check path: `/api/health`). Container Apps use liveness and readiness probes. This replaces Lambda/ECS he

8. For streaming and WebSocket scenarios (e.g., AI streaming responses via `stream.emit()`), use App Service or Container Apps with WebSocket support enabled. Azure Functions Consumption plan does not support WebSockets. Enable WebSockets i

8. For streaming and WebSocket scenarios (e.g., AI streaming responses via `stream.emit()`), use App Service or Container Apps with WebSocket support enabled. Azure Functions Consumption plan does not support WebSockets. Enable WebSockets i

9. Use deployment slots in App Service for zero-downtime deployments, replacing blue/green patterns built with Lambda aliases/versions or ECS rolling updates. Swap staging to production after validation. [learn.microsoft.com -- Deployment s

9. Use deployment slots in App Service for zero-downtime deployments, replacing blue/green patterns built with Lambda aliases/versions or ECS rolling updates. Swap staging to production after validation. [learn.microsoft.com -- Deployment s

10. For complex multi-container deployments (previously ECS task definitions with sidecars), use Azure Container Apps with multiple containers per revision, or Azure Kubernetes Service for full orchestration control. Container Apps supports

10. For complex multi-container deployments (previously ECS task definitions with sidecars), use Azure Container Apps with multiple containers per revision, or Azure Kubernetes Service for full orchestration control. Container Apps supports

11. **Azure Functions Premium "Always Ready" instances eliminate cold starts.** Set `WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT` to cap horizontal scaling, and configure `alwaysReady` in the Premium plan to keep N instances warm. This is the

11. **Azure Functions Premium "Always Ready" instances eliminate cold starts.** Set `WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT` to cap horizontal scaling, and configure `alwaysReady` in the Premium plan to keep N instances warm. This is the

12. **Container Apps with Dapr sidecars replaces ECS multi-container patterns.** ECS task definitions with multiple containers (app + sidecar) map to Container Apps revisions with Dapr enabled. Dapr provides service-to-service invocation, s

12. **Container Apps with Dapr sidecars replaces ECS multi-container patterns.** ECS task definitions with multiple containers (app + sidecar) map to Container Apps revisions with Dapr enabled. Dapr provides service-to-service invocation, s

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

// Invoke another Container App by its Dapr app ID // Replaces: http://service-name.local:3000/api/data (ECS service discovery)

// Invoke another Container App by its Dapr app ID // Replaces: http://service-name.local:3000/api/data (ECS service discovery)

// Replaces: http://service-name.local:3000/api/data (ECS service discovery)

// Replaces: http://service-name.local:3000/api/data (ECS service discovery)

- **Forgetting Always On**: App Service without Always On unloads the app after ~20 minutes idle. The next incoming Teams message triggers a full restart, causing timeout errors. Always enable Always On for bot workloads. - **Port mismatch*

- **Forgetting Always On**: App Service without Always On unloads the app after ~20 minutes idle. The next incoming Teams message triggers a full restart, causing timeout errors. Always enable Always On for bot workloads. - **Port mismatch*

- **Port mismatch**: Azure App Service expects the app to listen on `process.env.PORT` (defaults to `8080`), not the Teams default of `3978`. Set `PORT` in App Settings or update `app.start(process.env.PORT || 8080)` for App Service deploym

- **Port mismatch**: Azure App Service expects the app to listen on `process.env.PORT` (defaults to `8080`), not the Teams default of `3978`. Set `PORT` in App Settings or update `app.start(process.env.PORT || 8080)` for App Service deploym

- **Missing /api/messages route**: The Azure Bot registration messaging endpoint must point to `https://your-app.azurewebsites.net/api/messages`. If the Teams app listens on a different path, update the Bot registration accordingly.

- **Missing /api/messages route**: The Azure Bot registration messaging endpoint must point to `https://your-app.azurewebsites.net/api/messages`. If the Teams app listens on a different path, update the Bot registration accordingly.

- [Azure App Service overview](https://learn.microsoft.com/en-us/azure/app-service/overview)

- [Azure App Service overview](https://learn.microsoft.com/en-us/azure/app-service/overview)

- [Azure Functions Node.js developer guide](https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference-node)

- [Azure Functions Node.js developer guide](https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference-node)

- [Azure Container Apps overview](https://learn.microsoft.com/en-us/azure/container-apps/overview)

- [Azure Container Apps overview](https://learn.microsoft.com/en-us/azure/container-apps/overview)

- [Azure Functions Premium plan](https://learn.microsoft.com/en-us/azure/azure-functions/functions-premium-plan)

- [Azure Functions Premium plan](https://learn.microsoft.com/en-us/azure/azure-functions/functions-premium-plan)

- [Deploy a bot to Azure](https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-deploy-az-cli)

- [Deploy a bot to Azure](https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-deploy-az-cli)

- [Azure App Service deployment slots](https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots)

- [Azure App Service deployment slots](https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots)

- [Configure Node.js apps for App Service](https://learn.microsoft.com/en-us/azure/app-service/configure-language-nodejs)

- [Configure Node.js apps for App Service](https://learn.microsoft.com/en-us/azure/app-service/configure-language-nodejs)

- [AWS to Azure services comparison](https://learn.microsoft.com/en-us/azure/architecture/aws-professional/services)

- [AWS to Azure services comparison](https://learn.microsoft.com/en-us/azure/architecture/aws-professional/services)

1. Map CloudWatch Logs to Application Insights and Log Analytics. Application Insights provides structured telemetry (requests, dependencies, exceptions, traces) while Log Analytics is the query engine (KQL) for exploring that data. Both re

1. Map CloudWatch Logs to Application Insights and Log Analytics. Application Insights provides structured telemetry (requests, dependencies, exceptions, traces) while Log Analytics is the query engine (KQL) for exploring that data. Both re

2. Instrument Node.js Teams bots with the `applicationinsights` npm package. Call `setup()` and `start()` before any other imports to enable automatic dependency tracking, request correlation, and exception capture. This replaces AWS X-Ray 

2. Instrument Node.js Teams bots with the `applicationinsights` npm package. Call `setup()` and `start()` before any other imports to enable automatic dependency tracking, request correlation, and exception capture. This replaces AWS X-Ray 

3. Map CloudWatch Metrics to Azure Monitor Metrics. Custom metrics sent via `trackMetric()` in Application Insights appear in Azure Monitor Metrics Explorer, replacing CloudWatch custom metrics and `putMetricData` calls. [learn.microsoft.co

3. Map CloudWatch Metrics to Azure Monitor Metrics. Custom metrics sent via `trackMetric()` in Application Insights appear in Azure Monitor Metrics Explorer, replacing CloudWatch custom metrics and `putMetricData` calls. [learn.microsoft.co

4. Map CloudWatch Alarms to Azure Monitor Alerts. Create alert rules on Application Insights metrics (response time, failure rate, exception count) or log-based alerts using KQL queries. This replaces CloudWatch Alarm + SNS notification pat

4. Map CloudWatch Alarms to Azure Monitor Alerts. Create alert rules on Application Insights metrics (response time, failure rate, exception count) or log-based alerts using KQL queries. This replaces CloudWatch Alarm + SNS notification pat

5. Map AWS X-Ray distributed tracing to Application Insights distributed tracing. Application Insights automatically correlates requests across services using operation IDs. The `applicationinsights` SDK propagates trace context headers (`t

5. Map AWS X-Ray distributed tracing to Application Insights distributed tracing. Application Insights automatically correlates requests across services using operation IDs. The `applicationinsights` SDK propagates trace context headers (`t

6. Integrate with the Teams SDK `ConsoleLogger` by creating a custom logger implementation that forwards to Application Insights. Use `trackTrace()` for log messages, `trackException()` for errors, and `trackEvent()` for business events (bo

6. Integrate with the Teams SDK `ConsoleLogger` by creating a custom logger implementation that forwards to Application Insights. Use `trackTrace()` for log messages, `trackException()` for errors, and `trackEvent()` for business events (bo

7. Set the Application Insights connection string via the `APPLICATIONINSIGHTS_CONNECTION_STRING` environment variable in App Settings. Do not hardcode connection strings. App Service and Functions have built-in Application Insights integra

7. Set the Application Insights connection string via the `APPLICATIONINSIGHTS_CONNECTION_STRING` environment variable in App Settings. Do not hardcode connection strings. App Service and Functions have built-in Application Insights integra

8. Use KQL queries in Log Analytics to diagnose bot issues, replacing CloudWatch Logs Insights queries. Query `requests`, `dependencies`, `exceptions`, and `traces` tables. Pin frequently used queries to Azure dashboards for team visibility

8. Use KQL queries in Log Analytics to diagnose bot issues, replacing CloudWatch Logs Insights queries. Query `requests`, `dependencies`, `exceptions`, and `traces` tables. Pin frequently used queries to Azure dashboards for team visibility

9. Configure sampling to control telemetry volume and cost. Application Insights supports adaptive sampling (automatic) and fixed-rate sampling. For production bots with high message volume, set a sampling percentage to avoid excessive cost

9. Configure sampling to control telemetry volume and cost. Application Insights supports adaptive sampling (automatic) and fixed-rate sampling. For production bots with high message volume, set a sampling percentage to avoid excessive cost

10. Build Azure dashboards for bot health monitoring, replacing CloudWatch Dashboards. Include panels for request rate, response time (P50/P95/P99), failure rate, active conversations, and AI model latency. Use Application Insights workbook

10. Build Azure dashboards for bot health monitoring, replacing CloudWatch Dashboards. Include panels for request rate, response time (P50/P95/P99), failure rate, active conversations, and AI model latency. Use Application Insights workbook

[Credential-related source omitted]

[Credential-related source omitted]

- [Application Insights overview](https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview)

- [Application Insights overview](https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview)

- [Application Insights for Node.js](https://learn.microsoft.com/en-us/azure/azure-monitor/app/nodejs)

- [Application Insights for Node.js](https://learn.microsoft.com/en-us/azure/azure-monitor/app/nodejs)

- [Application Insights API reference](https://learn.microsoft.com/en-us/azure/azure-monitor/app/api-custom-events-metrics)

- [Application Insights API reference](https://learn.microsoft.com/en-us/azure/azure-monitor/app/api-custom-events-metrics)

- [KQL quick reference](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/kql-quick-reference)

- [KQL quick reference](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/kql-quick-reference)

- [Azure Monitor Alerts](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview)

- [Azure Monitor Alerts](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview)

- [Application Insights sampling](https://learn.microsoft.com/en-us/azure/azure-monitor/app/sampling-classic-api)

- [Application Insights sampling](https://learn.microsoft.com/en-us/azure/azure-monitor/app/sampling-classic-api)

- [Distributed tracing in Application Insights](https://learn.microsoft.com/en-us/azure/azure-monitor/app/distributed-trace-data)

- [Distributed tracing in Application Insights](https://learn.microsoft.com/en-us/azure/azure-monitor/app/distributed-trace-data)

- [AWS to Azure services comparison -- Management and monitoring](https://learn.microsoft.com/en-us/azure/architecture/aws-professional/services#management-and-monitoring)

- [AWS to Azure services comparison -- Management and monitoring](https://learn.microsoft.com/en-us/azure/architecture/aws-professional/services#management-and-monitoring)

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

2. Map AWS SSM Parameter Store to Azure App Configuration for non-secret configuration values (feature flags, endpoint URLs, tuning parameters). App Configuration supports key-value pairs, labels for environments, and feature management. Us

2. Map AWS SSM Parameter Store to Azure App Configuration for non-secret configuration values (feature flags, endpoint URLs, tuning parameters). App Configuration supports key-value pairs, labels for environments, and feature management. Us

3. Use managed identity (system-assigned or user-assigned) to access Key Vault from Azure compute, eliminating the need for Key Vault credentials in code. This replaces IAM role-based access patterns used with AWS Secrets Manager. Configure

3. Use managed identity (system-assigned or user-assigned) to access Key Vault from Azure compute, eliminating the need for Key Vault credentials in code. This replaces IAM role-based access patterns used with AWS Secrets Manager. Configure

4. For App Service deployments, use Key Vault references in App Settings instead of direct secret values. The syntax `@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/MySecret/)` resolves secrets at runtime without appl

4. For App Service deployments, use Key Vault references in App Settings instead of direct secret values. The syntax `@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/MySecret/)` resolves secrets at runtime without appl

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

6. Never commit secrets to source control. Add `.env` to `.gitignore`. Use `.env.example` or `.env.template` with placeholder values to document required variables. This applies equally to AWS and Azure workflows. [OWASP -- Secrets in sourc

6. Never commit secrets to source control. Add `.env` to `.gitignore`. Use `.env.example` or `.env.template` with placeholder values to document required variables. This applies equally to AWS and Azure workflows. [OWASP -- Secrets in sourc

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

9. Apply least-privilege access policies to Key Vault. Grant only "Get" and "List" secret permissions to the bot's managed identity. Do not grant "Set", "Delete", or management permissions to runtime identities. Use separate access policies

9. Apply least-privilege access policies to Key Vault. Grant only "Get" and "List" secret permissions to the bot's managed identity. Do not grant "Set", "Delete", or management permissions to runtime identities. Use separate access policies

10. For local development, use `DefaultAzureCredential` from `@azure/identity` which chains multiple credential sources: environment variables, managed identity, Azure CLI login, and VS Code credentials. This provides a unified auth pattern

10. For local development, use `DefaultAzureCredential` from `@azure/identity` which chains multiple credential sources: environment variables, managed identity, Azure CLI login, and VS Code credentials. This provides a unified auth pattern

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

CLIENT_ID="@Microsoft.KeyVault(SecretUri=https://my-bot-vault.vault.azure.net/secrets/BotClientId/)" \

CLIENT_ID="@Microsoft.KeyVault(SecretUri=https://my-bot-vault.vault.azure.net/secrets/BotClientId/)" \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

TENANT_ID="@Microsoft.KeyVault(SecretUri=https://my-bot-vault.vault.azure.net/secrets/BotTenantId/)" \

TENANT_ID="@Microsoft.KeyVault(SecretUri=https://my-bot-vault.vault.azure.net/secrets/BotTenantId/)" \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]