Production deployment of MS Teams Bot and Azure AD App Registration via TeamsFx Toolkit
Hello, community! Could you please help me to solve the puzzle? I'm developing a multi-tenant SaaS teams bot which I'm going to publish to the Teams Store. This bot will support SSO, we need to get access to some of the Graph resources on behalf of the users (calendar specifically). So the default behavior of Teams Toolkit Extension for VS Code is to use two accounts for: Computing. Where all execution logic, BotService, etc will be deployed M365 account. Where the AAD App Registration is created and the teams bot is sideloaded to the specified teams account. And for the M365 account during development, the recommended way is to use Microsoft 365 Developer Program. And as far as I understand for single-tenant applications the right way is to use the account of the administrator of that tenant. We don't find any documentation on the right way to configure the TeamsFx toolkit for the multi-tenant production bot, as far as: developer account will expire in 90 days and it's non-sense to rely on the idea it will be auto-prolonged we don't need to install automatically our bot to this single-tenant as far as its purpose is to be used within any organization, not within ours. And we have multiple ideas on how to solve it: Create an M365 account for our organization and deploy the App Registration via Teams Toolkit. What's the reason we need additional account for only AAD App Registration, isn't it just another resource within Azure Cloud? Deploy everything to the single Azure Account, the same where computing occurs. Does it require us to avoid TeamsFx deployment strategy and build our own? Or there're some options to make it work out of the box? What's the recommended way and tools for multi-tenant SaaS bot with SSO production deployment ? Is there any documentation that I missed?
Multi-tenant AAD - Need Admin Approval on 2nd tenant
Hi, I have implemented SSO (OAuth2) for Multi-tenant AAD Application. The app permissions donot need admin consent - The app is registered on tenant 1 and SSO is working on tenant 1, but tenant 2 show 'Need admin approval' after the user has consented for the permissions. In tenant 2, User settings under Enterprise applications in Azure portal for 'User can consent to apps accessing company data on their behalf' is enabled. why is admin approval required even though the permissions donot require admin consent? Please help. Thanks
Questions About Alternatives to Multi-Tenant Bots After July 31, 2025 Deprecation
Hello, As the ability to create multi-tenant bots in Azure will be discontinued after July 31, 2025, I’d like to ask if there are any viable alternatives available now? If I create a single-tenant bot and publish it to the Teams App Store, will users from other tenants still be able to interact with the bot? Additionally, will the bot be able to access their basic user profile information (only user name and aadObjectId) and conversation data? From my understanding, access tokens obtained using the client ID and client secret are tenant-scoped, meaning they are not valid across other tenants. As a result, the bot cannot access user information such as profile photos or email addresses from users in other tenants — is that correct? I'd really appreciate any clarification or recommended best practices on this. Thank you!
