Regression after PR #301 — multi‑tenant Bot Framework auth no longer works

[jroy-sophos]

We are migrating an existing Bot Framework bot to the new Agents SDK. The functional migration is complete, but we’ve recently seen an authentication regression.

Previously, removing TENANT_ID allowed our bot to authenticate and send messages using the Bot Framework multi‑tenant auth path. After PR #301, this no longer works. The change appears to be due to a removal of the old 'botframework' authority_path handling that enabled this flow.

We understand multi‑tenant Bot Framework bots are deprecated, but we need to know:
What is the correct way to configure authentication in the Agents SDK to preserve this behavior?
Specifically:

• Should we set TENANT_ID = "botframework.com" to approximate the old multi‑tenant authority?
• Or would this cause incorrect token requests or other unintended issues?

Any guidance on how to configure MsalAuth / connection settings to support the legacy multi‑tenant pattern (even temporarily) would be appreciated.

[anguzo]

I seem to have stumbled on similar issue with Microsoft Dev Account Sandbox and "local" dev workflows.
Previously in botbuilder multi tenant auth defaulted to PasswordServiceClientCredentialFactory without the need for tenant id or auth type specification:
https://github.com/microsoft/botbuilder-python/blob/e07ec54ed9a863b69a7cfae5162629383924709d/libraries/botbuilder-integration-aiohttp/botbuilder/integration/aiohttp/configuration_service_client_credential_factory.py#L72-L77
This worked well with Microsoft 365 Agents Toolkit.
In Microsoft 365 Agents SDK I still haven't figured out how to use the sandbox.
I tried setting CONNECTIONS__SERVICE_CONNECTION__SETTINGS__TENANTID to "common" and CONNECTIONS__SERVICE_CONNECTION__SETTINGS__AUTHTYPE to either "ClientSecret" or "UserManagedIdentity" but only achieved receiving request while response is rejected with 401.
I am not opposed to some other "local" dev workflow say with M365 Agents Playground but I do not really understand if ATK is supported or not at all since samples for Python in it (Agent Framework Sample Agent - Python and OpenAI Sample Agent - Python) are not connected to ATK.

[MattB-msft]

Sorry for the slow response here folks, I missed this one.

Auth in Python, JS and .net have been aligned to support virtually the same features. Which include multi-tenant auth and agentic identity auth.

There are a few significant changes that have occurred here.
We have altered the way tokens are created for communicating back to the calling service, we now prefer the tenant ID that is provided by the incoming message request if its present. otherwise, we will use the tenant ID listed in the settings. This means that the agent will attempt to create the token against the requesting tenant vs the common tenant.

as a general rule, for multi-tenant auth, if you have azure bot service instance provisioned with a multi-tenant app, which was created by Azure Bot Service (this has been disabled by ABS now and you cannot create new ones), you would set the Tenant ID to botframework.com. Otherwise, you use common.

[axelsrz]

Closing due to inactivity, if problem persist please open a new issue or re-open this one