From b41c9ef2553e7da614e1eafcc5c8a91e67a5a33d Mon Sep 17 00:00:00 2001 From: James May Date: Tue, 6 Jan 2026 14:19:27 +1100 Subject: [PATCH 1/5] Update security requirements for token authentication Updated security requirements to reflect the transition from EAT to Microsoft Entra ID token authentication for Actionable Messages. --- docs/actionable-messages/security-requirements.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/actionable-messages/security-requirements.md b/docs/actionable-messages/security-requirements.md index f6b5b72c..424db670 100644 --- a/docs/actionable-messages/security-requirements.md +++ b/docs/actionable-messages/security-requirements.md @@ -110,6 +110,9 @@ Sample code generating signed card: ## Verifying that requests come from Microsoft +> [!IMPORTANT] +> Actionable Messages (AM) are moving from EAT (External Access Token) to Microsoft Entra ID token authentication. Partners using EAT tokens must update their integration to support AAD tokens for requests from the AM service. For more information, see [Enabling AAD token of Actionable Messages](enable-entra-token-for-actionable-messages.md). + All action requests from Microsoft have a bearer token in the HTTP `Authorization` header. This token is a [JSON Web Token](https://jwt.io/) (JWT) token signed by Microsoft, and it includes important claims that we strongly recommend should be verified by the service handling the associated request. | Claim name | Value | From e3530c4438f4563d2ba52a307921a60005b9be29 Mon Sep 17 00:00:00 2001 From: Ricky Kirkham Date: Wed, 7 Jan 2026 15:45:54 -0800 Subject: [PATCH 2/5] Update add-in invocation for unified manifest --- docs/actionable-messages/invoke-add-in.md | 91 ++++++++++++++++++++++- 1 file changed, 90 insertions(+), 1 deletion(-) diff --git a/docs/actionable-messages/invoke-add-in.md b/docs/actionable-messages/invoke-add-in.md index c4bb84e7..329f4059 100644 --- a/docs/actionable-messages/invoke-add-in.md +++ b/docs/actionable-messages/invoke-add-in.md @@ -31,7 +31,94 @@ The following example shows the prompt users see if the add-in is not installed. Actionable messages invoke add-ins by specifying an [Action.InvokeAddInCommand action](adaptive-card.md#actioninvokeaddincommand) in the message. This action specifies the add-in to invoke, along with the identifier of the add-in button that opens the appropriate task pane. -The required information is found in the [add-in's manifest](/office/dev/add-ins/outlook/manifests). First, you'll need the add-in's identifier, which is specified in the [Id element](/office/dev/add-ins/reference/manifest/id). +The required information is found in the [add-in's manifest](/office/dev/add-ins/develop/add-in-manifests). Open the tab for the type of manifest that the add-in uses. + +# [Unified manifest for Microsoft 365](#tab/jsonmanifest) + +First, you'll need the add-in's identifier, which is specified in the [`"id"`](/microsoft-365/extensibility/schema/root#id) property. + +```json +{ + "$schema": "https://developer.microsoft.com/json-schemas/teams/v1.24/MicrosoftTeams.schema.json", + "id": "527104a1-f1a5-475a-9199-7a968161c870", + "version": "1.0.0", + "manifestVersion": "1.24", + + -- other properties omitted -- +} +``` + +For this add-in, the add-in identifier is `527104a1-f1a5-475a-9199-7a968161c870`. + +Next, you'll need the [`"control.id"`](/microsoft-365/extensibility/schema/extension-common-custom-group-controls-item#id) value of the control object that defines the add-in button that opens the appropriate task pane. Keep in mind that the control object MUST: + +- Be defined inside a ribbon object that includes `mailRead` in its [`"ribbons.contexts"`](/microsoft-365/extensibility/schema/extension-ribbons-array#contexts) array. +- Have its `"type"` property set to `button`. +- Contain an `"actionId"` set to the same value as a the [`"actions.id"`](/microsoft-365/extensibility/schema/extension-runtimes-actions-item#id) of an action object defined in the [`"extensions.runtimes"`](/microsoft-365/extensibility/schema/extension-runtimes-array) array. + +The following shows the JSON for a extenions object that includes a control that opens a task pane. + +```json +{ + -- other properties omitted -- + + "extensions": [ + -- other properties omitted -- + + { + "runtimes": [ + { + -- other properties omitted -- + + "actions": [ + { + -- other properties omitted -- + + "id": "ShowTaskpane" + } + ] + } + ], + "ribbons": [ + -- other properties omitted -- + + { + "contexts": ["mailRead"], + "tabs" [ + -- other properties omitted -- + + "groups": [ + -- other properties omitted -- + + { + "controls" [ + { + "id": "msgReadOpenPaneButton", + "type": "button", + "label": "Show Task Pane", + "icons": [ -- icons markup omitted -- ], + "supertip": { + "title": "Show Contoso Task Pane", + "description": "Opens the Contoso task pane." + }, + "actionId": "ShowTaskPane" + } + ] + } + ] + ] + } + ] + } + ] +} +``` + +For this add-in button, the ID is `msgReadOpenPaneButton`. + +# [Add-in only manifest](#tab/xmlmanifest) + +First, you'll need the add-in's identifier, which is specified in the [Id element](/office/dev/add-ins/reference/manifest/id). ```xml @@ -82,6 +169,8 @@ Next, you'll need the `id` attribute of the [Control element](/office/dev/add-in For this add-in button, the ID is `showInitContext`. +--- + With these two pieces of information, we can create a basic `Action.InvokeAddInCommand` action as follows: ```json From 8a53f7ad1e3158fa90dc80f5ee8e39c63c61bc15 Mon Sep 17 00:00:00 2001 From: Ricky Kirkham Date: Wed, 7 Jan 2026 16:03:51 -0800 Subject: [PATCH 3/5] fix JSON formatting --- docs/actionable-messages/invoke-add-in.md | 44 ++++++++++------------- 1 file changed, 19 insertions(+), 25 deletions(-) diff --git a/docs/actionable-messages/invoke-add-in.md b/docs/actionable-messages/invoke-add-in.md index 329f4059..bd1fb104 100644 --- a/docs/actionable-messages/invoke-add-in.md +++ b/docs/actionable-messages/invoke-add-in.md @@ -63,8 +63,6 @@ The following shows the JSON for a extenions object that includes a control that -- other properties omitted -- "extensions": [ - -- other properties omitted -- - { "runtimes": [ { @@ -80,32 +78,28 @@ The following shows the JSON for a extenions object that includes a control that } ], "ribbons": [ - -- other properties omitted -- - { "contexts": ["mailRead"], "tabs" [ - -- other properties omitted -- - - "groups": [ - -- other properties omitted -- - - { - "controls" [ - { - "id": "msgReadOpenPaneButton", - "type": "button", - "label": "Show Task Pane", - "icons": [ -- icons markup omitted -- ], - "supertip": { - "title": "Show Contoso Task Pane", - "description": "Opens the Contoso task pane." - }, - "actionId": "ShowTaskPane" - } - ] - } - ] + { + "groups": [ + { + "controls" [ + { + "id": "msgReadOpenPaneButton", + "type": "button", + "label": "Show Task Pane", + "icons": [ -- icons markup omitted -- ], + "supertip": { + "title": "Show Contoso Task Pane", + "description": "Opens the Contoso task pane." + }, + "actionId": "ShowTaskPane" + } + ] + } + ] + } ] } ] From c41f23de3dbb8439b3927826e7d03858de4f0132 Mon Sep 17 00:00:00 2001 From: Ricky Kirkham Date: Wed, 7 Jan 2026 16:06:27 -0800 Subject: [PATCH 4/5] fix group JSON --- docs/actionable-messages/invoke-add-in.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/actionable-messages/invoke-add-in.md b/docs/actionable-messages/invoke-add-in.md index bd1fb104..132a947a 100644 --- a/docs/actionable-messages/invoke-add-in.md +++ b/docs/actionable-messages/invoke-add-in.md @@ -84,6 +84,8 @@ The following shows the JSON for a extenions object that includes a control that { "groups": [ { + -- other properties omitted -- + "controls" [ { "id": "msgReadOpenPaneButton", From 82cf5bdab13b085556b0fda8d5c70416fe3c1f6c Mon Sep 17 00:00:00 2001 From: Jason Johnston Date: Thu, 8 Jan 2026 08:48:29 -0500 Subject: [PATCH 5/5] Apply suggestion from @samantharamon Co-authored-by: Sam Ramon <15154970+samantharamon@users.noreply.github.com> --- docs/actionable-messages/invoke-add-in.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/actionable-messages/invoke-add-in.md b/docs/actionable-messages/invoke-add-in.md index 132a947a..dd1208b8 100644 --- a/docs/actionable-messages/invoke-add-in.md +++ b/docs/actionable-messages/invoke-add-in.md @@ -56,7 +56,7 @@ Next, you'll need the [`"control.id"`](/microsoft-365/extensibility/schema/exten - Have its `"type"` property set to `button`. - Contain an `"actionId"` set to the same value as a the [`"actions.id"`](/microsoft-365/extensibility/schema/extension-runtimes-actions-item#id) of an action object defined in the [`"extensions.runtimes"`](/microsoft-365/extensibility/schema/extension-runtimes-array) array. -The following shows the JSON for a extenions object that includes a control that opens a task pane. +The following shows the JSON for an extensions object that includes a control that opens a task pane. ```json {