TeamsTab.ReadWriteSelfForTeam: deleting a tab fails with 400 "appId cannot be null or whitespace"

Your DELETE request and delegated scope match Microsoft’s documented channel-tab API: TeamsTab.ReadWriteSelfForTeam is the least-privileged delegated permission, the call has no body, and success returns 204. That scope only lets a Teams app manage its own tabs, so the 400 indicates Graph cannot resolve the calling app’s identity to the tab’s teamsApp relationship; an appId does not belong in the DELETE request.

Decode the access token and confirm aud is Microsoft Graph, scp includes TeamsTab.ReadWriteSelfForTeam, and azp/appid is the Entra application used by the package. Then GET the tab with $expand=teamsApp and compare teamsApp.externalId with the Teams manifest id; the catalog teamsApp.id can differ for organizational or sideloaded apps. Re-upload the current package and recreate the tab if those identities differ. As a diagnostic, test with TeamsTab.ReadWriteForTeam. If that succeeds, capture request IDs and timestamps and open a Microsoft Graph support case, because Microsoft documents no client-side appId parameter here.