Transitioning from Multitenant to Single-Tenant Bot – User Update and Republishing Process

Question

Transitioning from Multitenant to Single-Tenant Bot – User Update and Republishing Process

Liudmyla Ivantsova 40

After deprecation of multitenant bot we are moving to a single-tenant configuration in Microsoft Entra ID.

What steps do we need to take to ensure users in our tenant can continue to use the bot?
Do we need to republish the app in AppSource/Teams App Store, or will Microsoft handle any part of this process?
What is the recommended process for updating users and permissions after this change?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Manas R Mohanty 17,270 Reputation points Moderator

2025-10-23T10:40:31.85+00:00

Hi Liudmyla Ivantsova

Hope you got the needed pointers, please let us know if you have followed up questions.

Thank you.
Liudmyla Ivantsova 40 Reputation points

2025-11-03T15:50:03.13+00:00

Hi @Manas R Mohanty ,

Thank you for your support.

I do have a few follow-up questions to ensure a smooth migration for our users:

1. Deprecation Timeline: Is there an official date or timeline from Microsoft when multitenant bots will stop working?

2. App Registration IDs:

Update the Microsoft Entra App Registration> Go to Microsoft Entra ID → App registrations → Your bot’s app. Under Authentication, change Supported account types to: “Accounts in this organizational directory only (Single tenant)”. Save your changes and note the updated Application (client) ID and Tenant ID.

If I only change the Supported account types setting from multitenant to single-tenant in the app registration, will the Application (client) ID and Tenant ID change? My understanding is that these values remain the same unless a new app registration is created. Can you confirm this?3. Authentication Issues and Best Practices: I came across a Microsoft Q&A (Todo: add link https://learn.microsoft.com/en-us/answers/questions/5569433/error-when-switching-the-teams-bot) where users experienced a 401 error after switching from multitenant to single-tenant, and the advice was to create a new single-tenant app registration from scratch. Is this still the recommended approach, or are there updated best practices for this migration? If creating a new app registration is required, does this mean an official re-submission to AppSource required for this change?

Thank you again for your assistance. I look forward to your insights on these points.
Manas R Mohanty 17,270 Reputation points Moderator

2025-11-03T16:46:35.7566667+00:00
Hi Liudmyla Ivantsova

Microsoft has announced that new multi-tenant bot creation will no longer be supported after July 31, 2025.

Existing multi-tenant bots will continue to function for now, but this is a sunset date for creating new ones. There’s no official statement yet about when existing multi-tenant bots will completely stop working, but the expectation is that support will eventually end, so migration planning should start immediately. [learn.microsoft.com], [learn.microsoft.com]

Changing the Supported account types setting from multitenant to single-tenant in Microsoft Entra ID does not change the Application (client) ID or Tenant ID. These values remain static unless you create a new app registration. The only changes occur in the sign-in audience configuration (manifest property signInAudience) and possibly redirect URIs if needed. [learn.microsoft.com], [docs.azure.cn], [learn.microsoft.com]

401 Errors After Switching: These typically occur because the bot’s configuration and Teams manifest weren’t fully updated after changing the app registration. If you simply flip the setting without updating the bot resource and Teams app manifest, authentication will fail.

Recommended Approach:

Update the app registration to single tenant.

Update your Azure Bot resource to use the same App ID.

Update the Teams app manifest (webApplicationInfo) with the new App ID and resource URI.

Repackage and upload the app to your organization’s Teams Admin Center.

Do You Need a New App Registration? Not always. If you correctly update the existing registration and bot configuration, you can reuse the same App ID. However, some developers prefer creating a new single-tenant app registration to avoid legacy configuration issues.

AppSource Resubmission: If your bot was previously published to the public Teams App Store (AppSource) and you create a new app registration, you must resubmit the app for validation. If it’s only for internal use, you can upload the updated package to your organization’s app catalog without resubmission. [learn.microsoft.com], [github.com], [learn.microsoft.com]

Thank you.
Liudmyla Ivantsova 40 Reputation points

2025-11-04T08:15:23.81+00:00

Hi @Manas R Mohanty

Thank you very much for all your detailed and helpful answers.

I have just one more question for clarification:

I’ve seen the following statement:

“AppSource distribution supports cross-tenant deployment: Even if your bot is single-tenant, publishing your Teams app (with the bot) to the Microsoft Teams Store / AppSource allows external tenants to install and use it. This is the supported method to reach tenants beyond your organization after multi-tenant support ends.”

Could you please clarify if this is accurate? Specifically, does publishing a single-tenant bot to AppSource actually allow users from external tenants to authenticate and use the bot, or are single-tenant bots still restricted to users within their own organization, regardless of AppSource distribution?
Manas R Mohanty 17,270 Reputation points Moderator

2025-11-04T10:45:10.4766667+00:00

Yes, it is correct that once published to Microsoft teams' other external tenant should be able to install and use it.
Liudmyla Ivantsova 40 Reputation points

2026-02-13T09:55:55.5933333+00:00
Hi @Manas Mohanty
Following up on our previous discussion about single-tenant transfer, I have an additional question regarding Teams app architecture:
I want to combine a static tab and a bot in a single Teams app (one manifest). I understand that the bot can only use a single-tenant app registration, but I need both the bot and the tab to be usable cross-tenant (by users in other organizations).

Is it possible to support SSO for the tab across tenants if the manifest uses a single-tenant app registration (required for the bot)?

If not, what is the recommended approach or workaround to allow both the bot and the tab to work for external tenants, ideally with SSO for the tab?

Is it possible to use a fallback login (e.g., a multi-tenant app registration just for the tab’s fallback auth) in this scenario, and how would that work in practice?

Any official guidance or best practices for this combined scenario would be greatly appreciated!
Manas R Mohanty 17,270 Reputation points Moderator

2026-02-13T11:47:56.99+00:00

Hi Liudmyla Ivantsova

Good day. Don't have in depth exposure on this part yet.

I think it won't be feasible.

Cross checked against below docs.

https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-sso?view=azure-bot-service-4.0

Note 1: Post Dec 31, 2025, product group support has stopped on Bot Service. Recommendation is to migrate to Agent-Teams deployment.

Verified with official doc with internal copilot.

Thank you.

Answer accepted by question author

0 additional answers

Manas R Mohanty 17,270 Reputation points Moderator

2025-10-23T10:40:31.85+00:00

Hi Liudmyla Ivantsova

Hope you got the needed pointers, please let us know if you have followed up questions.

Thank you.
Liudmyla Ivantsova 40 Reputation points

2025-11-03T15:50:03.13+00:00

Hi @Manas R Mohanty ,

Thank you for your support.

I do have a few follow-up questions to ensure a smooth migration for our users:

1. Deprecation Timeline: Is there an official date or timeline from Microsoft when multitenant bots will stop working?

2. App Registration IDs:

Update the Microsoft Entra App Registration> Go to Microsoft Entra ID → App registrations → Your bot’s app. Under Authentication, change Supported account types to: “Accounts in this organizational directory only (Single tenant)”. Save your changes and note the updated Application (client) ID and Tenant ID.

If I only change the Supported account types setting from multitenant to single-tenant in the app registration, will the Application (client) ID and Tenant ID change? My understanding is that these values remain the same unless a new app registration is created. Can you confirm this?3. Authentication Issues and Best Practices: I came across a Microsoft Q&A (Todo: add link https://learn.microsoft.com/en-us/answers/questions/5569433/error-when-switching-the-teams-bot) where users experienced a 401 error after switching from multitenant to single-tenant, and the advice was to create a new single-tenant app registration from scratch. Is this still the recommended approach, or are there updated best practices for this migration? If creating a new app registration is required, does this mean an official re-submission to AppSource required for this change?

Thank you again for your assistance. I look forward to your insights on these points.
Liudmyla Ivantsova 40 Reputation points

2025-11-04T08:15:23.81+00:00

Hi @Manas R Mohanty

Thank you very much for all your detailed and helpful answers.

I have just one more question for clarification:

I’ve seen the following statement:

“AppSource distribution supports cross-tenant deployment: Even if your bot is single-tenant, publishing your Teams app (with the bot) to the Microsoft Teams Store / AppSource allows external tenants to install and use it. This is the supported method to reach tenants beyond your organization after multi-tenant support ends.”

Could you please clarify if this is accurate? Specifically, does publishing a single-tenant bot to AppSource actually allow users from external tenants to authenticate and use the bot, or are single-tenant bots still restricted to users within their own organization, regardless of AppSource distribution?
Manas R Mohanty 17,270 Reputation points Moderator

2025-11-04T10:45:10.4766667+00:00

Yes, it is correct that once published to Microsoft teams' other external tenant should be able to install and use it.
Liudmyla Ivantsova 40 Reputation points

2026-02-13T09:55:55.5933333+00:00

Hi @Manas Mohanty
Following up on our previous discussion about single-tenant transfer, I have an additional question regarding Teams app architecture:
I want to combine a static tab and a bot in a single Teams app (one manifest). I understand that the bot can only use a single-tenant app registration, but I need both the bot and the tab to be usable cross-tenant (by users in other organizations).

Is it possible to support SSO for the tab across tenants if the manifest uses a single-tenant app registration (required for the bot)?

If not, what is the recommended approach or workaround to allow both the bot and the tab to work for external tenants, ideally with SSO for the tab?

Is it possible to use a fallback login (e.g., a multi-tenant app registration just for the tab’s fallback auth) in this scenario, and how would that work in practice?

Any official guidance or best practices for this combined scenario would be greatly appreciated!
Manas R Mohanty 17,270 Reputation points Moderator

2026-02-13T11:47:56.99+00:00

Hi Liudmyla Ivantsova

Good day. Don't have in depth exposure on this part yet.

I think it won't be feasible.

Cross checked against below docs.

https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-sso?view=azure-bot-service-4.0

Note 1: Post Dec 31, 2025, product group support has stopped on Bot Service. Recommendation is to migrate to Agent-Teams deployment.

Verified with official doc with internal copilot.

Thank you.

Answer 1

Hello Liudmyla Ivantsova,

When transitioning your bot from multitenant to single-tenant, you’re essentially limiting access so that only users within your organization’s Microsoft Entra (Azure AD) tenant can authenticate and use it. Microsoft will not automatically migrate or republish the app for you, so you’ll need to make a few key updates yourself.

Here’s a step-by-step outline:

Update the Microsoft Entra App Registration

Go to Microsoft Entra ID → App registrations → Your bot’s app.

Under Authentication, change Supported account types to:
“Accounts in this organizational directory only (Single tenant)”.

Save your changes and note the updated Application (client) ID and Tenant ID.

If your bot uses redirect URIs (for example, with Teams or a web app), make sure these are still valid.

Update Your Azure Bot Resource

In the Azure portal, navigate to your Azure Bot resource.

Under Configuration, update the Microsoft App ID to match the single-tenant app registration.

If your messaging endpoint changed (for example, a new App Service or domain), ensure it’s updated here too.

Update and Repackage Your Teams App (if applicable)

If the bot is deployed in Microsoft Teams:

Open the manifest.json file of your Teams app package.

Update the webApplicationInfo section to use your new App ID:

"webApplicationInfo": {
    "id": "<your-single-tenant-app-id>",
    "resource": "api://<your-single-tenant-app-id>"
}

Repackage the .zip file and upload it to your organization’s Teams Admin Center → Manage apps → Upload custom app.

You do not need to republish it to the public Teams App Store (AppSource).

  Internal users can install it from your organization’s app catalog.

Communicate the Change to Users

Because switching to single-tenant will invalidate the previous consent, users must re-consent and reinstall the updated version of the bot.

Notify them to remove the old app and reinstall the updated one.

If using SSO, verify that your scopes and permissions are updated accordingly.

Test the Updated Setup

Use a test account from your organization to confirm that sign-in and bot functionality work correctly.

Test all integrations, especially if the bot interacts with Microsoft Graph, Power Automate, or Copilot Studio.

Reference Documentation

Microsoft provides detailed migration guides you can follow:

Migrate agents that use Bot Framework skills to single-tenant app registrations

Configure single sign-on with Microsoft Entra ID for agents in Teams

You’ll need to manually update your app registration, reconfigure the Azure Bot, and republish your Teams app internally. Once done, your users can continue to use the bot securely within your organization.

Best Regards,
Jerald Felix

Liudmyla Ivantsova 40 Reputation points

2025-10-27T13:49:07.26+00:00

Hello @Jerald Felix,

Thank you for your help! I just want to clarify one detail regarding the instructions:

"Under Authentication, change Supported account types to: 'Accounts in this organizational directory only (Single tenant)'. Save your changes and note the updated Application (client) ID and Tenant ID."

If I only change the Supported account types setting to single tenant, will the Application (client) ID and Tenant ID actually change? From my understanding, changing the account type does not alter the Application (client) ID or Tenant ID—these values remain the same for the app registration. Could you please confirm if that’s correct?

Thank you!