Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

setup blueprint: identifierUris set to api://<appId> instead of api://botid-<appId>, breaking Teams message delivery

Abierto
  • ¿Algo no está bien?
#482 3 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 5 días

@ajmfehr ya está trabajando en esto.

Desde el 1/8/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

bug escalated P1 security
Description

a365 setup blueprint / a365 setup all stamps the blueprint Entra app's identifierUris as api://<appId>. Teams requires the botid- prefix (api://botid-<appId>) for Activity Protocol routing and token exchange. Without it, messages sent to an agent instance are silently never delivered to the configured Notification URL — no error surfaces anywhere.

The offending line is BlueprintSubcommand.cs#L1260:

var identifierUri = $"api://{appId}";

applied at L1264 via PATCH /v1.0/applications/{objectId}.

The CLI's own dry-run output disagrees with what it does. Three places print the prefixed form:

Possible provenance: #191 specified $IdentifierUri = "api://<blueprint-id>" in its repro script, and that appears to have been implemented literally. The botid- text in NonDwSetupOrchestrator looks like a holdover from the classic Azure Bot / App Registration flow, which did apply the prefix — which is why developers who onboarded via the older path never hit this.

Behavior is identical across --authmode obo|s2s|both, --m365, --aiteammate, and standalone setup blueprint.

Expected behavior

identifierUris is set to api://botid-<appId>, matching the CLI's dry-run output, and messages sent to an agent instance reach the configured Notification URL.

SDK Version

1.1.214

Language/Runtime

.NET 8 (a365 CLI global tool); agent runtime Node.js 20 / TypeScript Teams SDK

OS

macOS 14

How to Reproduce
  1. a365 setup all --agent-name <name> --m365
  2. Start a Teams SDK app on a public HTTPS endpoint; set that endpoint as the blueprint's Notification URL (Agent Type: API Based) in Developer Portal
  3. Publish + activate the generated package via M365 Admin Center
  4. Create an agent instance from the Teams Store
  5. Send the instance a chat message

The app receives nothing. No error in the app, in Developer Portal, or from the CLI.

Output
$ az ad app show --id <blueprint-id> --query identifierUris -o json
[
  "api://<blueprint-id>"
]

After manually applying the prefix, messages are delivered immediately on the next send:

$ az ad app update --id <blueprint-id> --identifier-uris "api://botid-<blueprint-id>"

Note that once messages do flow, a separate missing-grant problem surfaces as AADSTS65001 naming the instance app rather than the blueprint — which sends you looking at instance consent instead of blueprint inheritance. Filing that separately.

Screenshots

N/A

Code of Conduct
Lenguaje dominante
C#
Estrellas
61
Forks
35
Merge medio
5 d 22 h
PR fusionados (30 d)
4

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de microsoft/Agent365-devTools

Todos los issues de microsoft/Agent365-devTools

Issues similares

Más issues de C#

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.