Authentication conflict when signing in to Teams with a managed account and then signing in with a separate non-managed account

Version

• Bot dependency versions

  implementation 'com.microsoft.bot:bot-integration-spring:4.14.2'
  implementation 'com.microsoft.bot:bot-dialogs:4.14.2'
  

• Windows 10
• Microsoft Teams Version 1.5.00.12969 (64-bit)

Describe the bug

I’m having issues with Teams authentication using the incorrect account with my bot. That happens when I have an account that is “Managed” and then try to authenticate with the bot with a separate “unmanaged” account. If you have Account A which is managed and Account B which is not managed, when you login to the bot with Account B it uses the credentials of Account A instead. I can see the SSO window pops up quickly and closes down right away so I guess the SSO window sees that I have a single signed in managed account so it just uses it for convenience but it doesn’t check that it was the same account that triggered the authentication in the first place so the wrong account is used.

To Reproduce

Steps to reproduce the behavior:

1. I sign in to Teams with an account A and use “Allow my organisation to manage my device” in order to stay signed in. I can only see this account if I go to Windows Settings > Accounts > Access work or school.
2. Once I’m signed in with account A, I navigate into my app and attempt to sign in with my bot. Given SSO, a window pops open and closes right away. The sign in is successful.
3. I then sign out from Teams (app is closed and re-opened) and sign in with another account (B) but for that account I use “No, sign in to this app only” option so that I don’t stay signed in (i.e. account is unmanaged). I do NOT see this account if I go to Windows Settings > Accounts > Access work or school (I only see Account A).
4. Once I’m signed in with account B, I navigate into my app and attempt to sign in with my bot. Similar to step 2 above, a window pops open and closes right away. The sign in is successful BUT on my bot I can see that it was account A that was signed in and not account B.

Expected behavior

On step 4 above either one of these 2 options:

• When the sign in attempt is triggered, the window pops open and stays open so that I can select which account I’d like to login.
• When the sign in attempt is triggered, the current logged in account (account B) is used for SSO and not any other accounts.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

My bot has been implemented in a similar way as it’s described in the bot samples repo (46.teams-auth). There is no way as far as I know to force that the account that triggered the sign in (in the promptStep()) to be the same as the one that is returned in the loginStep().

[anishprasad01]

Hi @ClaudioConsolmagno,

Thanks for the report. I was able to reproduce this behavior. At this point, I’m going to look into it further and see if this is a Bot Framework SDK issue, a Teams issue, or expected behavior. Then we can figure out next steps.

[ClaudioConsolmagno]

Appreciate the help @anishprasad01 👍