How to enable a multi-tenant one-on-one bot in Microsoft Teams if Azure Bot is single-tenant?

Question

How to enable a multi-tenant one-on-one bot in Microsoft Teams if Azure Bot is single-tenant?

Amir Chegini 15

Hi, we are working on a Microsoft Teams integration where our main goal is to have a one-on-one chat bot feature for users. We followed the standard steps: created an app registration in Azure, set it to multi-tenant, and then created an Azure Bot, which is single-tenant only. After that, we went to dev.teams.microsoft.com, added the bot feature, and linked it to our app registration.

Everything seemed fine, but at the app validation step we get an error saying the Azure app must be multi-tenant. We’re worried we might be taking the wrong approach, but our core requirement is simply to have one-on-one chats. Could you please advise if we’re missing something or if there’s a different approach we should use? Any help would be greatly appreciated.

Sayali-MSFT 6,396 Reputation points Microsoft External Staff Moderator

2025-12-04T05:18:49.4+00:00

Hello Amir Chegini, Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.
Roman 0 Reputation points

2026-02-24T17:37:11.5366667+00:00

How is it going?

2 answers

Your answer

Sayali-MSFT 6,396 Reputation points Microsoft External Staff Moderator

2025-12-04T05:18:49.4+00:00

Hello Amir Chegini, Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.
Roman 0 Reputation points

2026-02-24T17:37:11.5366667+00:00

How is it going?

Answer 1

Teddie-D 19,760 Microsoft External Staff Moderator

Hi @Amir Chegini

Thank you for posting your question in the Microsoft Q&A forum.

You don’t need a multi-tenant setup if your main requirement is just one-on-one chats with users. The recommended approach is:

-Single-tenant App Registration

-Single-tenant Azure Bot

Please ensure both are created under the same tenant, and your Teams app should be uploaded internally via Teams or the Teams Admin Center.

Since new multi-tenant bot creation is deprecated after July 31, 2025, this single-tenant path is the supported option. You can read more at Register a Bot Framework bot with Azure - Bot Service | Microsoft Learn.

For scenarios where you need to support external tenants later, you can follow this path: What is the recommended bot type for multi-tenant bots? | Microsoft Community Hub

I hope this information is helpful.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

wenceslao avalos 20 Reputation points

2025-12-04T12:22:19.7466667+00:00

@Teddie-D Hello! Thanks for the answer, as a follow up to that link you shared, it says that the recommended approach for letting other organizations use the app is to publish it to the teams store. If I want to keep my app private but only share it using the .zip so other organizations can upload it and install it, will it still work in other tenants, and will I receive those events in the messaging endpoint?
Since the bot is single tenant, and is associated to my organization tenant, but it will be distributed to other tenants
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-12-05T10:21:35.2066667+00:00

Hi @wenceslao avalos
If sideloading is enabled, external tenants can upload your Teams app package. However, when the bot is registered as single‑tenant, it will not receive messages from users in other tenants if the app is distributed through a zip file due to authentication restrictions.

To make the bot available to external tenants, the supported method is to publish the Teams app through AppSource or the Teams Store. Publishing this way allows proper cross‑tenant installation and messaging.

If you later add single sign‑on or Microsoft Graph access, you may need to take additional steps:

-Convert the Entra app registration to multi‑tenant, depending on your authentication model.

-Add the required redirect URIs and API permissions.

-Use the AppSource publishing process to handle tenant consent and manage installation.
wenceslao avalos 20 Reputation points

2025-12-05T17:26:12.0366667+00:00

Thanks @Teddie-D

We were able to receive messages and events from external tenants by setting in the app registration app registration the option: Accounts in any organizational directory (Multi Tenant). So with that we were able to install the .zip in another tenant and receive the events from their users. Although the bot in azure is Bot Type: single-tenant
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-12-08T03:10:08.89+00:00

Hi @wenceslao avalos
Thank you for the update. Your explanation provides valuable clarity and will be an important reference for others who encounter the same challenge.
Hieu Nguyen 0 Reputation points

2026-03-13T02:34:39.8733333+00:00

Hi @wenceslao avalos

Because my current project shares similarities with yours in using the .zip in the Teams Admin Center so that other organizations can upload and install it in Teams.

Additionally, I have a business case where, when a user installs the app in Teams for the first time, the Bot proactively sends them a welcome adaptive card.

I would like to ask you, after Microsoft deprecated multi-tenant Bots, based on your experience, is it mandatory to have the Azure Bot (single-tenant) and the Bot Registration App(multi-tenant) in the same tenant for it to receive events and respond?

Can I place the Azure Bot (single-tenant), Bot Function App in tenant A and the Bot Bot Registration App(multi-tenant) in tenant B (M365 tenant, E5 Developer) for the Development environment and debug locally?

Thank you for your attention. cc @Teddie-D If you have any insights on this, could you please assist me as well?
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2026-03-13T04:54:25.1333333+00:00

Hi @Hieu Nguyen

Even after multi-tenant bot registration was deprecated, the Azure Bot resource and its associated Entra app registration must still reside in the same home tenant.

While the Entra app registration can be configured as multi-tenant to support cross-tenant installs, splitting the bot resource and the app registration across different tenants is not supported. This will lead to authentication issues, broken proactive messaging, and AppSource validation issues.

For both development and production, the supported architecture is to keep the Azure Bot, bot hosting service, and Entra app registration in the same tenant, and rely on AppSource or approved sideloading for external tenant installs.
Hieu Nguyen 0 Reputation points

2026-03-15T15:50:03.4033333+00:00

Hi @Teddie-D

In my current situation, in the Development environment, I have one tenant used to host Azure resources and another tenant (M365 tenant) used to create App Registrations (Teams AAD, Bot AAD). I apply this model so I can test multi-tenant behavior for a Teams App by sideloading the package into any tenant's Teams Admin Center.

Now that MS has deprecated multi-tenant bots, for the local environment what model should I use? Previously, local debugging used a tunnel to the bot on localhost. If the bot now uses SingleTenant identity and a User-Assigned MSI, how should I re-architect the model?
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2026-03-16T06:04:00.7633333+00:00

Hi @Hieu Nguyen

With the deprecation of multi‑tenant bot identities, the recommended model is to use a single home tenant that owns both the Azure Bot resource and the Microsoft Entra app registration.
For local development, continue to run the bot on localhost and expose it using a tunnel (Dev Tunnels or ngrok). The bot authenticates to Teams using a single‑tenant Entra app registration from the same tenant as the Azure Bot.
When deployed to Azure, the bot still uses the same Entra app registration for Teams/Bot Framework authentication.
Cross‑tenant behavior is now tested by installing or sideloading the Teams app into other tenants and granting consent.

Answer 2

To enable a multi-tenant one-on-one bot in Microsoft Teams, you need to ensure that your Azure Bot is configured correctly to support multi-tenancy. Here are the steps you should follow:

App Registration: Ensure that your app registration in Azure is set to multi-tenant. This is crucial as it allows users from different tenants to access your bot.
Azure Bot Configuration: When creating the Azure Bot, you need to select the appropriate type. The Multi-Tenant bot type is deprecated, so you should use either Single Tenant or User-Assigned Managed Identity. However, if you want your bot to work across multiple tenants, you should ensure that the app registration allows for this by selecting the option for Accounts in any organizational directory (Multi Tenant).
Validation: If you are encountering validation errors, double-check that the Azure Bot is linked correctly to the multi-tenant app registration. The bot must be able to authenticate users from different tenants.
Testing: After making these changes, test the bot in a developer tenant to ensure that it can handle one-on-one chats across different tenants.

By following these steps, you should be able to enable a multi-tenant one-on-one bot in Microsoft Teams successfully.

References: