Multi tenancy Support for Microsoft Entra app

How to support Multi-tenancy single sign-on in TeamsFx project

When SSO is enabled, Teams Toolkit will by default provision a single-tenant Microsoft Entra app, which means only user and guest accounts in the same directory as your M365 account can successfully sign in to your Teams app.

To support multi-tenant, you can follow the steps below to update your TeamsFx project.

Note: This document is only for TeamsFx projects that have already enabled single sign on.

Update your project

1. Open ./aad.manifest.json, find signInAudience and set value as AzureADMultipleOrgs.

2. Open infra/azure.parameter.${env}.json and find the following line:

   "m365TenantId": "{{state.fx-resource-aad-app-for-teams.tenantId}}",
   

   and replace with:

   "m365TenantId": "common",
   

3. [For Local Debug] Open teamsapp.local.yml, find the following lines:

   # Generate runtime environment variables for backend
   - uses: file/createOrUpdateEnvironmentFile
     with:
       target: ./api/.localConfigs
       envs:
         M365_CLIENT_ID: ${{AAD_APP_CLIENT_ID}}
         M365_CLIENT_SECRET: ${{SECRET_AAD_APP_CLIENT_SECRET}}
         M365_TENANT_ID: ${{AAD_APP_TENANT_ID}}
         M365_AUTHORITY_HOST: ${{AAD_APP_OAUTH_AUTHORITY_HOST}}
         ALLOWED_APP_IDS: ...
   

   and update the value of M365_TENANT_ID:

   - uses: file/createOrUpdateEnvironmentFile
     with:
       target: ./api/.localConfigs
       envs:
         M365_CLIENT_ID: ${{AAD_APP_CLIENT_ID}}
         M365_CLIENT_SECRET: ${{SECRET_AAD_APP_CLIENT_SECRET}}
         M365_TENANT_ID: common
         M365_AUTHORITY_HOST: ${{AAD_APP_OAUTH_AUTHORITY_HOST}}
         ALLOWED_APP_IDS: ...
   

Provision and Deploy your project

Run Provision and Deploy or Local Debug in your project.