Teams error 401 Unauthorized (tenant mismatch): Single-tenant vs multi-tenant mismatch

The bot's code and its Entra app registration disagree about tenancy. An Entra application is created as either single-tenant (tokens must be requested from that tenant's own endpoint) or multi-tenant (tokens come from the shared botframework.com endpoint). The Bot Framework SDKs encode this as the MicrosoftAppType setting - SingleTenant, MultiTenant, or UserAssignedMSI - paired with MicrosoftAppTenantId. When the app type in configuration does not match how the app was actually registered, token requests go to the wrong authority and Entra answers with AADSTS700016: "The application wasn't found in the directory/tenant... You might have misconfigured the identifier value for the application or sent your authentication request to the wrong tenant."

This bites in two directions. A single-tenant registration driven by default multi-tenant SDK settings asks botframework.com for a token, and that shared directory has never heard of the app. A multi-tenant registration configured with a specific tenant ID can acquire tokens yet still fail validation when the Azure Bot resource's own app type disagrees. Since new Azure Bot resources default to single-tenant, older sample code and tutorials written for multi-tenant bots are the classic source of the mismatch - cause 3 in Teams bot not responding.

{
  "error": "unauthorized_client",
  "error_description": "AADSTS700016: Application with identifier '...' was not found in the directory '...'. ...",
  "error_codes": [700016]
}

Decide tenancy once, at creation, and record it beside the app ID and secret as the third corner of the credential triangle. Always set MicrosoftAppType explicitly - relying on SDK defaults is how multi-tenant assumptions sneak into single-tenant bots. When you must migrate tenancy, treat it as a re-registration with its own smoke test, not a config toggle. A startup token check pinned to the configured authority catches the mismatch on deploy rather than in production, exactly as it does for an expired secret.