How can I disable Microsoft account authentication?

[microsoft]

How can I disable Microsoft account authentication?

[crickman]

You can certainly restrict access by IP address via the Azure Portal. Since you are already hosted on Azure, I'm unclear on why you wouldn't just auth to your own AAD principal.

I'll double check w/ team w.r.t. thoughts on backdoor you've identified.

[crickman]

Checking with the team, those test user accounts are expected to be Microsoft accounts.

We do have a feature update just about to land that is a significant evolution in our security model...including a "noauth" option. I'll have the feature owner follow-up as it becomes ready to merge next week.

[hacker01111000]

Sounds good. Looking forward to it.

[gitri-ms]

Hi @hacker01111000, I just submitted this PR last week: #126

This change enables users to run Chat Copilot locally with no authentication, so you are no longer required to set up an app registration and sign in with a Microsoft account. Instead, the user is treated as a pseudonymous "Default User" and multi-user features are disabled.

We still require Azure Active Directory authentication by default when deploying Chat Copilot to Azure. (To add to what Chris said before, those test accounts in the .env file are for our testing pipeline.) If you'd like to allow users to sign in with an authentication provider other than Azure/Microsoft, I encourage you to explore that and submit a PR!

[gitri-ms]

I'm going to go ahead and close this issue since I think the latest changes I mentioned above address your question. However, if you have further questions, please feel free to reactivate it or open a new issue. Thank you!