OpenClaw Microsoft Teams authentication

A Teams bot authenticates to Microsoft as an Entra ID application, and the simplest credential, a client secret, is also the one that needs rotating and travels over the network. OpenClaw supports federated authentication as the production alternative, with a certificate or an Azure managed identity. Here are the two methods, the AKS setup, the comparison, and the default that keeps old configs working.

Certificate-based authentication

• Federated authentication is selected with the auth type key set to federated, and the certificate method uses a PEM certificate with its private key registered with your Entra ID app registration: generate or obtain the certificate, then upload the public part under Certificates and secrets in the app registration.
• The config keeps the app ID and tenant ID, sets the auth type to federated and points the certificate path at the PEM file, with the webhook port and path as usual; the equivalent environment variables set the auth type and the certificate path.
• A certificate thumbprint key can be set alongside the path but is not read by the auth path; it is accepted for forward compatibility only.
• The comparison the docs draw is simple: a client secret is the simplest setup but needs rotation and is less secure, a certificate sends no shared secret over the network at the cost of certificate management, and a managed identity is passwordless with no secrets to manage but requires Azure infrastructure.

Default: when authType is unset, OpenClaw uses client-secret authentication (appPassword).

Azure managed identity

Managed identity gives passwordless authentication on Azure infrastructure such as AKS, App Service and Azure VMs. The bot's pod or VM has a system-assigned or user-assigned managed identity, a federated identity credential links that identity to the Entra ID app registration, and at runtime OpenClaw uses the Azure identity library to acquire tokens from the IMDS endpoint and passes them to the Teams SDK for bot authentication. The prerequisites are Azure infrastructure with managed identity enabled, the federated identity credential on the app registration, and network access to the IMDS address on port 80 from the pod or VM. The config sets the auth type to federated and the managed-identity flag to true, adds the managed identity client ID for a user-assigned identity, and has matching environment variables for the auth type, the flag and the client ID.

AKS workload identity

• Enable workload identity on the AKS cluster, then create a federated identity credential on the Entra ID app registration with the Azure CLI, naming the cluster's OIDC issuer URL as the issuer, the service account as the subject in the system service-account form with its namespace and name, and the Azure AD token exchange audience.
• Annotate the Kubernetes service account with the app client ID under the workload identity client-id annotation, and label the pod with the workload identity use label so the identity is injected.
• Allow network access to the IMDS address: with a NetworkPolicy in place, add an egress rule for the single-address range on port 80, or the token acquisition silently fails.

OpenClaw on Microsoft Teams is the channel post this authentication belongs to, and OpenClaw Microsoft Teams configuration lists the keys and environment variables it uses.

Why passwordless wins on Azure

A managed identity never has a secret to leak or rotate, which is why the docs point production deployments there, and the federated credential is the one piece of setup that makes Entra ID trust the cluster's own identity. OpenClaw Slack setup shows the very different token model on Slack, and OpenClaw remote access how a gateway becomes reachable when it has to run somewhere Teams can call.

On Diali

Microsoft Teams is not among the channels Diali connects today: WhatsApp, Telegram, Discord, Slack, Mattermost, Matrix, SMS and voice. Hosted OpenClaw on Diali is the assistant and Diali security describes the boundary that applies to each connected channel.

• Unset auth type means a client secret; federated means certificate or identity.
• The thumbprint key is accepted but never read.
• AKS needs the federated credential, the annotation, the label and IMDS egress.