setup blueprint: identifierUris set to api://<appId> instead of api://botid-<appId>, breaking Teams message delivery

[heyitsaamir]

Description

a365 setup blueprint / a365 setup all stamps the blueprint Entra app's identifierUris as api://<appId>. Teams requires the botid- prefix (api://botid-<appId>) for Activity Protocol routing and token exchange. Without it, messages sent to an agent instance are silently never delivered to the configured Notification URL — no error surfaces anywhere.

The offending line is BlueprintSubcommand.cs#L1260:

var identifierUri = $"api://{appId}";

applied at L1264 via PATCH /v1.0/applications/{objectId}.

The CLI's own dry-run output disagrees with what it does. Three places print the prefixed form:

• PublishCommand.cs#L318 — webApplicationInfo.resource -> api://botid-{ClientAppId}, but L353 writes webInfo["resource"] = $"api://{blueprintId}"
• NonDwSetupOrchestrator.cs#L61, L95, L96 — prints api://botid-<appId>, but that method is a stub (LogWarning at L50: "not yet fully implemented")

Possible provenance: #191 specified $IdentifierUri = "api://<blueprint-id>" in its repro script, and that appears to have been implemented literally. The botid- text in NonDwSetupOrchestrator looks like a holdover from the classic Azure Bot / App Registration flow, which did apply the prefix — which is why developers who onboarded via the older path never hit this.

Behavior is identical across --authmode obo|s2s|both, --m365, --aiteammate, and standalone setup blueprint.

Expected behavior

identifierUris is set to api://botid-<appId>, matching the CLI's dry-run output, and messages sent to an agent instance reach the configured Notification URL.

SDK Version

1.1.214

Language/Runtime

.NET 8 (a365 CLI global tool); agent runtime Node.js 20 / TypeScript Teams SDK

OS

macOS 14

How to Reproduce

1. a365 setup all --agent-name <name> --m365
2. Start a Teams SDK app on a public HTTPS endpoint; set that endpoint as the blueprint's Notification URL (Agent Type: API Based) in Developer Portal
3. Publish + activate the generated package via M365 Admin Center
4. Create an agent instance from the Teams Store
5. Send the instance a chat message

The app receives nothing. No error in the app, in Developer Portal, or from the CLI.

Output

$ az ad app show --id <blueprint-id> --query identifierUris -o json
[
  "api://<blueprint-id>"
]

After manually applying the prefix, messages are delivered immediately on the next send:

$ az ad app update --id <blueprint-id> --identifier-uris "api://botid-<blueprint-id>"

Note that once messages do flow, a separate missing-grant problem surfaces as AADSTS65001 naming the instance app rather than the blueprint — which sends you looking at instance consent instead of blueprint inheritance. Filing that separately.

Screenshots

N/A

Code of Conduct

• I agree to follow the Microsoft Open Source Code of Conduct.

[github-actions]

[AUTO-TRIAGE] Team Assistant Triage

This issue has been automatically analyzed and triaged.

AI Decision Reasoning: Type: Classified as 'bug' because the issue describes incorrect behavior in the setup blueprint that prevents Teams message delivery, which is a core functionality.
Priority: Assigned P1 because the bug causes silent failure of message delivery without surfacing errors, critically impacting the application's usability and reliability. [Security issue detected: The issue describes a misconfiguration in the identifierUris that could lead to Teams message delivery failure, potentially impacting authentication and token exchange mechanisms, which are critical for secure communication and routing in the application.]
Copilot: Security issues require human review and should not be auto-fixed
Assignment: Security issue assigned to security lead. The issue describes a misconfiguration in the identifierUris that could lead to Teams message delivery failure, potentially impacting authentication and token exchange mechanisms, which are critical for secure communication and routing in the application.
Labels: Applied labels bug, P1, security based on issue type and priority

Labels and assignee have been applied based on this analysis.

[github-actions]

[AUTO-TRIAGE] Results

Classification: bug
Priority: P1
Confidence: 100.0%

Recommended Assignee: ajmfehr

Analysis:
type rationale: Classified as 'bug' because the issue describes incorrect behavior in the setup blueprint that prevents Teams message delivery, which is a core functionality.

priority rationale: Assigned P1 because the bug causes silent failure of message delivery without surfacing errors, critically impacting the application's usability and reliability. [Security issue detected: The issue describes a misconfiguration in the `identifierUris` that could lead to Teams message delivery failure, potentially impacting authentication and token exchange mechanisms, which are critical for secure communication and routing in the application.]

copilot rationale: Security issues require human review and should not be auto-fixed

assignment rationale: Security issue assigned to security lead. The issue describes a misconfiguration in the `identifierUris` that could lead to Teams message delivery failure, potentially impacting authentication and token exchange mechanisms, which are critical for secure communication and routing in the application.

labels rationale: Applied labels bug, P1, security based on issue type and priority

[SUGGESTION] Suggested Approach

1. Update the `BlueprintSubcommand.cs` file at line 1260 to include the required `botid-` prefix when constructing the `identifierUri`. Change the line to: `var identifierUri = $"api://botid-{appId}";` to ensure the correct format is used for Teams Activity Protocol routing.
2. Review the logic in `PublishCommand.cs` at lines 318 and 353 to ensure consistency between the `webApplicationInfo.resource` value and the `webInfo["resource"]` assignment. Update line 353 to use the prefixed format: `webInfo["resource"] = $"api://botid-{blueprintId}";`.
3. Inspect the `NonDwSetupOrchestrator.cs` file at lines 61, 95, and 96 to verify that the `api://botid-<appId>` format is correctly implemented when the method is fully implemented. Address the `LogWarning` at line 50 by completing the method logic to ensure it aligns with the required identifier URI format.
4. Add a unit test in the `src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services` directory to validate that the `identifierUris` are being set correctly during the `a365 setup blueprint` and `a365 setup all` commands. Mock the `PATCH /v1.0/applications/{objectId}` API call to verify the correct payload is being sent.
5. Update the CLI's dry-run output to reflect the corrected `identifierUris` format. Ensure that all instances where `identifierUris` are printed (e.g., in `PublishCommand.cs` and `NonDwSetupOrchestrator.cs`) use the prefixed format to avoid confusion for users.

---

Generated by TeamAssistant Auto-Triage powered by GitHub Models

[github-actions]

SLA Escalation Alert

This P1 issue has exceeded its SLA threshold.

Metric	Value
Priority	P1
SLA Threshold	48 hours
Time Since Update	50.4 hours
Current Assignees	ajmfehr

Action: This issue is already assigned to a Tech Lead but remains unresolved.

Escalating to Engineering Manager ajmfehr for visibility.

Tech Leads: ajmfehr

---

Generated by AutoTriage SLA Escalation