Publisher verification for Teams app when app is in a different Entra tenant than the Partner Center (PGA) primary tenant

Question

Publisher verification for Teams app when app is in a different Entra tenant than the Partner Center (PGA) primary tenant

Roy Liu 40

I’m preparing a Microsoft Teams Store submission and need Publisher verification for my Microsoft Entra app registration.

Microsoft docs say: the Entra tenant where the app is registered must be associated with the Partner Global Account (PGA), and if it’s not the primary tenant, I should “set up the CPP PGA as a multitenant account and associate the Entra tenant.”

My setup:

Partner Center (PGA) / Business verification is under a “parent” organization:

Partner Center account: parentcorporate.com (already verified in Partner Center)

The primary tenant for this Partner Center account is in the parentcorporate.com org

My Teams app is developed in a different Microsoft Entra tenant:

Tenant: subcompany.onmicrosoft.com

Custom domain verified in that tenant: subcompany.com

The app registration is in subcompany.onmicrosoft.com What I’ve done so far:

In the Partner Center account for parentcorporate.com, I used Account settings → Tenants and successfully associated / can see subcompany.onmicrosoft.com listed as an associated tenant.

What I’m trying to confirm

Is associating the subsidiary tenant (subcompany.onmicrosoft.com) in Partner Center sufficient to satisfy the requirement “tenant where the app is registered must be associated with the PGA” for Publisher verification?
If yes: which identity must perform the “Mark app as publisher verified” step?
- Does it need to be a user who is:
- able to manage the app registration in subcompany.onmicrosoft.com, and
- also has access/permissions in the Partner Center PGA account (parentcorporate.com),
- with MFA enabled?
- In my case, I can sign in with a parentcorporate.com user and I also granted it Global Admin in subcompany.onmicrosoft.com. Is this the right approach?
If no / not sufficient: what is the recommended “best practice” setup for a parent company publishing an app whose Entra app registration lives in a subsidiary tenant?
- Should I move the app registration into the parent tenant instead?
- Or is the expected approach to keep the app in the subsidiary tenant and rely on Partner Center “multi-tenant account / associated tenant” configuration?

Extra details

This is for Teams Store submission (publisher verification is required to avoid “unverified publisher” in the admin consent prompt).

Moved from Microsoft Teams Development

Karan Shewale 2,585 Reputation points Microsoft External Staff

2026-02-27T06:39:00.3866667+00:00

Thanks for bringing this issue to our attention. We will check and update you soon.

1 answer

Your answer

Karan Shewale 2,585 Reputation points Microsoft External Staff

2026-02-27T06:39:00.3866667+00:00

Thanks for bringing this issue to our attention. We will check and update you soon.

Answer 1

Sayali-MSFT 6,396 Microsoft External Staff Moderator

Hello Roy Liu,
Could you please check the below areas:

Partner Center Submission Status – If you recently updated the app, the Verified badge is removed until Microsoft re‑certifies it.
Publisher / Domain Verification – Ensure your domain is still verified in Azure AD and matches the manifest.
Manifest Changes – Updates to bot ID, domains, permissions, or RSC scopes can trigger re‑verification.
Bot Registration Changes – Regenerating secrets, changing endpoints, or updating OAuth settings can break verification.
Permission Changes – Adding/altering Graph scopes or meeting permissions forces a new review Organizers and meeting participants in your organization who attend meetings with users outside of their organization – with or without a Microsoft Entra ID – will see the changes in labels that reflect the trust level of the participant with the organizer (External, Unverified, or no label).

No label: All participants who are part of the organizer’s organization.
External: All participants who are external to the organizer’s organization but have a trusted relationship with the organizer or their organization.
Unverified: All other participants will be seen with this label. This will include Microsoft Entra ID users who belong to organizations that do not have an explicit external access setup with the organizer’s organization, Microsoft Account (personal) users, users who are not using any Microsoft ID while joining meetings, and others.

What you need to do to prepare:

To prepare for this change, share this information with the meeting organizers who regularly invite participants outside of their organizations.

Message ID: MC716008

Also, we are checking with the engineering team and let you know the updates once we have any. team and let you know the updates once we have any.

Roy Liu 40 Reputation points

2026-03-02T11:46:46.6+00:00
many thanks for the answer and we haven't submitted the app yet, and it seems we are able to associate the Tenant in partner centre but now unable to add MPN id as domain mismatch and one question regarding publisher domain verification:

Is subdomain acceptable to finish Adding the MPN Id?

For instance,

my partner centre is verfified using parentcompany.com

my Azure tenant has a custom domain verified using subsidiary.parentcompany.com

Will this satify the #5 rule listed here https://learn.microsoft.com/en-us/entra/identity-platform/mark-app-as-publisher-verified#mark-your-app-as-publisher-verified-1

Ensure that either the publisher domain or a DNS-verified custom domain on the tenant matches the domain of the email address used during the verification process for your CPP account.

Thanks in advance.
Sayali-MSFT 6,396 Reputation points Microsoft External Staff Moderator

2026-03-09T10:04:30.99+00:00

Hello Roy Liu,
Rule #5 requires that the domain used for Partner Center (CPP) verification exactly match either the app’s publisher domain or a DNS-verified custom domain in the Azure tenant. Microsoft performs a strict string-level comparison of domains rather than treating them hierarchically. In the described scenario, the CPP verification email uses @parentcompany.com, while the tenant and publisher domain are set to subsidiary.parentcompany.com. Even though the subsidiary domain technically sits under the parent domain in DNS, Microsoft does not consider these equivalent for publisher verification, so subsidiary.parentcompany.com ≠ parentcompany.com, causing the PublisherDomainMismatch error. This occurs because publisher verification is an identity and trust validation tied to a legal entity rather than DNS structure. As a result, the current setup does not satisfy Rule #5. The supported fixes are either to set the app’s publisher domain to parentcompany.com and verify it using the /.well-known/microsoft-identity-association.json file, or to add and DNS-verify parentcompany.com as a custom domain in the Azure tenant. Using only the subdomain will continue to fail. While the tenant itself can still be associated with Partner Center at the organization level, linking the MPN / Partner ID requires stricter app-level domain validation, which is why the tenant association succeeds but the MPN verification fails.

Reference Document-
https://learn.microsoft.com/en-us/entra/identity-platform/mark-app-as-publisher-verified