Replace CloudEnvironment with MSAL-aligned Instance property for sovereign cloud support by Copilot · Pull Request #357 · microsoft/teams.net

Copilot · 2026-02-27T15:10:04Z

CloudEnvironment duplicated configuration already offered by MSAL. Replaced with an Instance property following the Microsoft Identity Web configuration schema.

Removed

CloudEnvironment class and its tests
Cloud property from AppOptions, ClientCredentials, TeamsSettings
ResolveCloud() and per-endpoint override properties from TeamsSettings
Cloud resolution logic from both HostApplicationBuilder extensions

Added

Instance property on TeamsSettings, ClientCredentials, and TeamsValidationSettings
Defaults to https://login.microsoftonline.com (public cloud)
Flows from config → credentials → token validation automatically
Tests for ClientCredentials and TeamsValidationSettings Instance behavior

Usage

Override the Entra ID login endpoint for sovereign clouds via appsettings.json:

{
  "Teams": {
    "Instance": "https://login.microsoftonline.us",
    "TenantId": "...",
    "ClientId": "...",
    "ClientSecret": "..."
  }
}

Or programmatically:

var credentials = new ClientCredentials("client-id", "secret", "tenant-id")
{
    Instance = "https://login.microsoftonline.us"
};

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

token.botframework.com
- Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net8.0/Microsoft.Teams.Apps.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net8.0/Microsoft.Teams.Apps.Tests.deps.json /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net8.0/testhost.dll --port 42727 --endpoint 127.0.0.1:042727 --role client --parentprocessid 5673 --telemetryoptedin false (dns block)
- Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/Microsoft.Teams.Apps.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/Microsoft.Teams.Apps.Tests.deps.json /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/testhost.dll --port 32931 --endpoint 127.0.0.1:032931 --role client --parentprocessid 5666 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

- Add Startup section to CLAUDE.md with knowledge file loading, session context, private notes support, and quick-start commands - Add Lessons Learned section to CLAUDE.md for persistent knowledge - Create Claude-KB.md for cross-session learning - Add session-context.md and *-private.md to .gitignore Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Introduce CloudEnvironment class that bundles all cloud-specific service endpoints, with predefined instances for Public, USGov (GCCH), USGovDoD, and China (21Vianet). Thread the cloud environment through ClientCredentials, token clients, validation settings, and DI host builders so that all previously hardcoded endpoints are now configurable per cloud. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Allow users to override specific CloudEnvironment endpoints (e.g. LoginEndpoint, LoginTenant) via appsettings.json, enabling scenarios like China single-tenant bots that require a tenant-specific login URL. - Add CloudEnvironment.WithOverrides() for layering nullable overrides - Add 8 endpoint override properties + ResolveCloud() helper to TeamsSettings - Unify cloud resolution across Apply(), AddTeamsCore(), and AddTeamsTokenAuthentication() - Add WithOverrides unit tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…oach Remove static preset instances (USGov, USGovDoD, China, Public) and FromName() from CloudEnvironment. Make constructor use default parameter values matching existing public cloud defaults. Remove Cloud string property from TeamsSettings. All sovereign cloud configuration now comes from appsettings.json endpoint properties or programmatic CloudEnvironment construction. Addresses review feedback from rido-min: don't hardcode Entra URLs we don't own in the codebase. Co-authored-by: rido-min <14916339+rido-min@users.noreply.github.com>

Copilot · 2026-02-27T15:21:14Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

token.botframework.com
- Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net8.0/Microsoft.Teams.Apps.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net8.0/Microsoft.Teams.Apps.Tests.deps.json /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net8.0/testhost.dll --port 37553 --endpoint 127.0.0.1:037553 --role client --parentprocessid 4898 --telemetryoptedin false (dns block)
- Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/Microsoft.Teams.Apps.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/Microsoft.Teams.Apps.Tests.deps.json /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/testhost.dll --port 40135 --endpoint 127.0.0.1:040135 --role client --parentprocessid 4905 --telemetryoptedin false (dns block)
- Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/Microsoft.Teams.Apps.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/Microsoft.Teams.Apps.Tests.deps.json /home/REDACTED/work/teams.net/teams.net/Tests/Microsoft.Teams.Apps.Tests/bin/Debug/net10.0/testhost.dll --port 41499 --endpoint 127.0.0.1:041499 --role client --parentprocessid 5823 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Remove the CloudEnvironment class and all its usages across the codebase. Revert ClientCredentials, App, AppOptions, TeamsSettings, TeamsValidationSettings, BotTokenClient, UserTokenClient, BotSignInClient, and both HostApplicationBuilder files to their original state with hardcoded public cloud defaults. The SDK should not duplicate the configuration schema offered by MSAL/Microsoft Identity Web. Cloud endpoint configuration should follow the AzureAd configuration pattern described in the Microsoft Identity Web wiki. Co-authored-by: rido-min <14916339+rido-min@users.noreply.github.com>

Follow the Microsoft Identity Web configuration schema by adding an Instance property to TeamsSettings and ClientCredentials. This allows overriding the Entra ID login endpoint for sovereign clouds (e.g., https://login.microsoftonline.us for US Gov) through appsettings.json: "Teams": { "Instance": "https://login.microsoftonline.us", "TenantId": "...", "ClientId": "...", "ClientSecret": "..." } The Instance property flows through to: - ClientCredentials.Resolve() for token acquisition - TeamsValidationSettings for issuer and OpenID metadata URLs Co-authored-by: rido-min <14916339+rido-min@users.noreply.github.com>

Co-authored-by: rido-min <14916339+rido-min@users.noreply.github.com>

rajan-chari · 2026-04-09T13:51:20Z

Recommendation: Close in favor of #352

This PR replaces CloudEnvironment with a single Instance property, arguing that MSAL handles the rest. That premise is incorrect — MSAL only resolves the authority URL (login endpoint). The SDK also needs cloud-specific values for 5 other URL categories that MSAL does not manage:

URL category	Varies per cloud?	Handled by MSAL?	Handled by CloudEnvironment (#352)?
AAD authority (login endpoint)	Yes	Yes	Yes
Bot token scope	Yes	No	Yes (BotScope)
Graph token scope	Yes	No	Needs adding (see #352 comment)
Token service URL	Yes	No	Yes (TokenServiceUrl)
OpenID metadata URL	Yes	No	Yes (OpenIdMetadataUrl)
Token issuer	Yes	No	Yes (TokenIssuer)

Concrete example: Azure US Government uses https://api.botframework.us/.default as the bot scope, not https://api.botframework.com/.default. An Instance-only property does not capture this — the SDK would still hardcode the wrong scope.

Additionally, PR #203 (which would bring MSAL to the Libraries layer) is not being merged since the next version ships from core/ (which already has Microsoft.Identity.Web). Without #203, there is no MSAL in the Libraries layer to delegate to.

The CloudEnvironment approach in #352 is the correct pattern:

Works with or without MSAL
Bundles all cloud-specific endpoints in one frozen/immutable object
Matches the pattern already used in the TS SDK (PR #500) and Python SDK (PR Add Tabs and Functions support to core #354)
Supports per-endpoint overrides via WithOverrides() for edge cases

Recommendation: Close this PR and proceed with #352 + #413 (which extends #352 to next/core).

rajan-chari and others added 4 commits February 26, 2026 10:59

Initial plan

d86d2a7

Copilot AI assigned Copilot and rido-min Feb 27, 2026

Copilot AI mentioned this pull request Feb 27, 2026

Add sovereign cloud support (GCCH, DoD, China) #352

Merged

4 tasks

Copilot started work on behalf of rido-min February 27, 2026 15:10 View session

Copilot AI changed the title ~~[WIP] Add sovereign cloud support for GCCH, DoD, and China~~ Remove hardcoded sovereign cloud presets, use configuration-only approach Feb 27, 2026

Copilot finished work on behalf of rido-min February 27, 2026 15:21

Copilot started work on behalf of rido-min February 27, 2026 15:31 View session

Copilot AI changed the title ~~Remove hardcoded sovereign cloud presets, use configuration-only approach~~ Remove CloudEnvironment class — duplicates MSAL configuration Feb 27, 2026

Copilot finished work on behalf of rido-min February 27, 2026 15:44

Copilot started work on behalf of rido-min February 27, 2026 15:51 View session

Copilot AI and others added 2 commits February 27, 2026 15:58

Address code review: use property for Instance, improve test naming

995d56d

Co-authored-by: rido-min <14916339+rido-min@users.noreply.github.com>

Copilot AI changed the title ~~Remove CloudEnvironment class — duplicates MSAL configuration~~ Replace CloudEnvironment with MSAL-aligned Instance property for sovereign cloud support Feb 27, 2026

Copilot finished work on behalf of rido-min February 27, 2026 16:03

corinagum force-pushed the feature/sovereign-cloud-support branch 4 times, most recently from 834ec60 to 600f5da Compare April 8, 2026 23:30

Base automatically changed from feature/sovereign-cloud-support to main April 15, 2026 16:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace CloudEnvironment with MSAL-aligned Instance property for sovereign cloud support#357

Replace CloudEnvironment with MSAL-aligned Instance property for sovereign cloud support#357
Copilot wants to merge 8 commits intomainfrom
copilot/sub-pr-352

Copilot AI commented Feb 27, 2026 •

edited

Loading

Uh oh!

Copilot AI commented Feb 27, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

rajan-chari commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Removed

Added

Usage

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI commented Feb 27, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

rajan-chari commented Apr 9, 2026

Recommendation: Close in favor of #352

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 27, 2026 •

edited

Loading