MS Teams SSO signin failure with resourcematch failed

[tharuds]

Discussion Type

Question

Discussion Content

Hi team,

I'm trying to implement single sign on for a simple bot app built using Teams SDK and I keep getting a 200 response with a sign in failure.

{
    "name": "signin/failure",
    "type": "invoke",
    "value": {
        "code": "resourcematchfailed",
        "message": "Resource match failed"
    }
}

I have checked the application ID URI, token exchange URL (in bot resource) and the manifest webApplicationInfo which matches the api://{azuread-client-id} going through the troubleshooting tips.

When I try to sign in from teams client the resource match failed keeps happening even if the troubleshooting checklist looks fine.
The Entra app is configured to support multiple entra ID accounts while the Azure bot resource is single tenant. I have also tried changing the Azure AD app supporting account types yet keep getting the same issue. I'm testing the bot app using the sandbox account created from the admin tenant that I used to configure azure resources, which has a different tenant id (domain - 250rr3.onmicrosoft.com).

I have also checked the jwt generated when testing the oauth connection (https://token.botframework.com/api/oauth/TestConnectionCallback) configured for the Azure bot resource and it works fine with graph endpoints.
Would be great to know what could be missing or if it could be a cache issue or an issue from the bot framework.

TIA

[mecodeatlas]

Thanks for posting in the GitHub Community, @tharuds!

We're happy you're here. You are more likely to get a useful response if you are posting your question in the applicable category, the Discussions category is solely related to conversations around the GitHub product Discussions. This question should be in the Programming Help category. I've gone ahead and moved it for you. Good luck!

[tharuds]

Thank you @mecodeatlas

[tharuds]

Thank you @Gecko51 !
I have checked the points you mentioned as well and I also believe this might be a cross tenant issue. But my question is since Microsoft no longer support multi tenant bot creations and it's said to register the bot single tenant and entra app multi tenant that's exactly what I have done.
In AzureAD authentication I have selected multiple entra id tenants for supported accounts.
I currently can't test this with a single tenant as the account (71aa9050----******** tenant) I use to register Azure resources is not setup with MS teams, so I created the sandbox environment and account (11be76eb----******** tenant) joining the developer program with my main account, which created the account with 250rr3.onmicrosoft.com domain.

For the application id uri I've been having api://{AAD_CLIENT_ID} and when I tried to specify the tenant it only allowed to use api://71aa9050----/{AAD_CLIENT_ID} otherwise it throws Failed to update application property. Error detail: The application identifier uri 'api://11be76eb----********/{AAD_CLIENT_ID} ' is invalid.

and for the diagnostic: 0000000*-0000---000000000000 is the aud coming from test connection and AAD client id is 9fcee40e-fe88---************
"webApplicationInfo": {
"id": {AAD_CLIENT_ID},
"resource": "api://{AAD_CLIENT_ID}"
}

[tharuds]

and to add to this - I have the https://token.botframework.com/.auth/web/redirect under authentication web redirect uri and token exchange url, manifest resource, application ID URI all set to api://9fcee40e-fe88---************

[tharuds]

Update: Even setting the entra app to single tenant and testing with the teams tenant (71aa9050----********) of the registered domain also fails.

[AbhinavPabbaraju]

This specific error:

signin/failure → resourcematchfailed

is almost always caused by a mismatch between the resource (audience) in the token and what Teams expects during SSO token exchange — even if everything looks correct.

---

What’s actually happening

In Teams SSO, the flow is:

1. Teams client requests a token for a specific resource
2. Azure AD issues a token with an aud (audience)
3. Bot Framework tries to exchange/validate that token

If the resource (aud) does not exactly match what your bot expects, you get:

resourcematchfailed

---

Most common root causes:

Based on your description, these are the likely issues:

---

1. Tenant mismatch (very likely in your case)

You mentioned:

Entra app = multi-tenant
Bot resource = single-tenant
Testing with a different tenant (sandbox account)

This is a red flag.

-> Teams SSO requires consistent tenant context

If:

• Token is issued from tenant A
• Bot is registered in tenant B

-> Resource validation fails

---

2. Application ID URI mismatch

Even if it “looks correct”, this must be exactly identical everywhere:

Must match across:

• Azure AD App → Application ID URI
• Teams manifest → webApplicationInfo.resource
• Token audience (aud claim)

Typical correct format:

api://<YOUR-CLIENT-ID>

Common mistake:

api://azuread-client-id   ❌
api://<client-id>         ✅

Even a small mismatch → failure

---

3. OAuth connection misconfiguration (Bot Service)

Your Bot’s OAuth connection must:

• Use the same client ID
• Use correct scopes (usually: openid profile email)
• Be tied to the same tenant

Also ensure:

Service Provider = Azure Active Directory v2

---

4. Using wrong token (Graph vs custom resource)

You said:

JWT works fine with Graph endpoints

That’s expected — but irrelevant.

Graph token:

aud = https://graph.microsoft.com

Your bot expects:

aud = api://<your-client-id>

These are different tokens.

---

How to debug properly

Decode the JWT (use jwt.ms) and check:

{
  "aud": "...",
  "iss": "...",
  "tid": "..."
}

Verify:

• aud == your Application ID URI
• tid == same tenant as bot registration

---

Fix strategy:

Step 1 — Align tenant

Pick ONE:

• Make bot multi-tenant
  OR
• Use same tenant for testing account

---

Step 2 — Fix Application ID URI

In Azure:

Expose an API → Application ID URI:
api://<client-id>

---

Step 3 — Update Teams manifest

"webApplicationInfo": {
  "id": "<client-id>",
  "resource": "api://<client-id>"
}

---

Step 4 — Recreate OAuth connection

Sometimes configs get cached:

• Delete OAuth connection
• Recreate it cleanly
• Restart bot service

---

Step 5 — Clear Teams cache (important)

Teams aggressively caches tokens:

• Sign out
• Clear cache (or use web client)
• Reinstall app

---

Key insight

This error is not about authentication failing
It’s about resource identity mismatch during token validation

Everything can “look right” — but if:

aud ≠ expected resource

→ it will always fail

---

[tharuds]

Hi,
I was able to fix the issue and couldn't update here.
Root cause was an App Registration conflict in the Developer Portal
Sharing the fix in case it helps others who hit the same "resource match failure":
The issue was caused by an inconsistency in the app registration on the Developer Portal.. the Teams client wasn't correctly matching the registered app to its manifest.
This tends to happen when the registration is done manually rather than through the M365 Agents Toolkit, which normally handles registering the app and its entities for you. The SSO sample guides don't mention this out explicitly, so if you're setting things up manually, double-check that your app registration and manifest are fully aligned.
Closing this out as resolved. Thanks all for the discussion!