Ninsheet

Mar 24, 2020  Tech support scams are an industry-wide issue where scammers trick you into paying for unnecessary technical support services. You can help protect yourself from scammers by verifying that the contact is a Microsoft Agent or Microsoft Employee and that the phone number is an official Microsoft global customer service number.

-->

Note

Web-based authentication on mobile clients requires version 1.4.1 or later of the Teams JavaScript SDK.

In order for your app to access user information protected by Azure Active Directory, as well as access data from other services like Facebook and Twitter, your app will have to establish a trusted connection with those providers. If your app needs to use Microsoft Graph APIs in the user scope, you'll also need to authenticate the user to retrieve the appropriate authentication tokens.

In Microsoft Teams there are two different authentication flows for your app to take advantage of. You can perform a traditional web-based authentication flow in a content page embedded in a tab, a configuration page, or a task module. If your app contains a conversational bot you can use the OAuthPrompt flow (and optionally the Azure Bot Framework's token service) to authenticate a user as part of a conversation.

Web-based authentication flow

You'll need to use the web-based authentication flow for tabs, and can choose to use it with conversational bots or messaging extensions. You'll use the Microsoft Teams JavaScript client SDK in a web content page to enable authentication, then embed that content page in a tab, a configuration page, or a task module. If you want to use the web-based authentication flow with a conversational bot, you'll need to use a task module with a bot.

• Authentication flow in tabs describes how tab authentication works in Teams. This shows a typical web based authentication flow used for tabs.
• Azure AD authentication in tabs describes how to connect to Azure Active Directory from within a tab in your app in Teams.
• Silent authentication (Azure AD) describes how to reduce sign-in/consent prompts in your app using Azure Active Directory.
• Web-based authentication in dotnet/C# or JavaScript/Node.js

The OAuthPrompt flow for conversational bots

The Azure Bot Framework’s OAuthPrompt makes authentication easier for apps using conversational bots. You can take advantage of Azure Bot Framework's token service to assist with token caching as well.

For more information on using the OAuthPrompt see:

• Bot authentication flow overview describes how authentication works within a bot in your app in Teams. This shows a non-web based authentication flow used for bots on all versions of Teams (web, desktop app, and mobile apps)
• Bot authentication (v3 SDK) sample in dotnet/C# or JavaScript/Node.js

Configure your identity provider

Regardless of which authentication flow your app is using (you might even be using both), you'll need to configure your identity provider to communicate with your Teams app. The majority of the samples and walkthroughs you'll find here will deal primarily with using Azure Active Directory as your identity provider. The concepts however apply regardless of which identity provider you'll use.

For more information see configuring an identity provider

-->

Symptoms

In Microsoft Outlook 2016 for Mac, you are repeatedly prompted for authentication while you're connected to your Office 365 account.

Cause

This issue occurs because of the presence of duplicate tokens in the keychain.

Office Activation Error Authentication Session Expired

Resolution

To resolve this issue in Outlook 2016 for Mac, install the February 2017 Outlook update (version 15.31.0) from the following Office website:

Workaround

To work around this issue, delete any cached passwords for your account, and also delete any modern authentication tokens from the keychain. To do this, follow these steps.

Note

These steps affect all Office applications that use modern authentication.

The Authentication Session Has Expired Office Mac

Authentication Expired In Mac

1. Quit Outlook and all other Office applications.

2. Start Keychain Access by using one of the following methods:

   • Select the Finder application, click Utilities on the Go menu, and then double-click Keychain Access.
   • In Spotlight Search, type Keychain Access, and then double-click Keychain Access in the search results.

3. In the search field in Keychain Access, enter Exchange.

4. In the search results, select each item to view the Account that's listed at the top, and then press Delete. Repeat this step to delete all items for your Exchange account.

5. In the search field, enter adal.

6. Select all items whose type is MicrosoftOffice15_2_Data:ADAL:<GUID>, and then press Delete.

7. In the search field, enter office.

8. Select the items that are named Microsoft Office Identities Cache 2 and Microsoft Office Identities Settings 2, and then press Delete.

9. Quit Keychain Access.

   Note

   When you start Outlook, you are prompted to authenticate.