🐞 Unable to deploy app via sideloading using Teams clients (works via Teams Admin Center)

[andrewconnell]

Describe the bug

When building & testing an app, suddenly, install via sideloading is not working consistently. Rarely does it work, but in the last few days, it's stopped working with the following error:

I'm a tenant admin, side loading is enabled & allowed on the default org-wide policy which includes all users (it's a test tenant).

I've tried all the following with no effect:

• using the URL that the ATK generates when running the launch config Debug in Edge
• using multiple browsers (Chrome, Edge, Safari)
• using regular / private/incognito sessions
• clearing all history & cookies in each browser before trying
• Teams Admin Center:
  • resetting the sideloading options
  • trying different users in the same policy
  • removing the policy from specific users & re-applying it
  • forcing the policy to re-propogate

To Reproduce

Steps to reproduce the behavior:

1. See above for all scenarios I've tried to get this to work

Workaround (which confirms issue with Teams Client)

1. Start the app locally (leave browser open so the debugger doesn't die & stop the processes) OR manually start the relevant tasks, just skip the open browser task
2. From the Teams Admin Center (signing in with the tenant admin account... same account I've used for everything):
3. upload the app package
4. Install the app for all users
5. Pin the app for all users
6. Keep refreshing the Teams client... after a few minutes, the pinned app appears
7. Select app & test... works as expected, hitting local site (for tabs) or web service (for bots)

🚨 This workaround confirms that this is a Teams client issue or a permission issue, as I'm logging in with the EXACT SAME user on the same machine via the browser in both instances (Teams web clients or Teams Admin Center).

Expected behavior
Apps install just like they normally do with sideloading enabled.

VS Code Extension Information (please complete the following information):

• OS: macOS 26.0.1 (Tahoe)
• Version: v6.2.2

CLI Information (please complete the following information):
n/a because doing this through the browser, but...

• OS: macOS 26.0.1 (Tahoe)
• Version 1.1.1

Additional context
n/a

[m365-agent-toolkit-assistant]

👋 Hi @andrewconnell,

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 2 business days

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

This is a known issue currently affecting Microsoft Teams clients across multiple tenants—even for admins with sideloading enabled ("Upload custom apps" ON in Teams Admin Center).

Key findings:

• Many users report being unable to sideload or upload apps, with the “Contact IT admin to request access” tooltip, despite correct policy setup.
• Workarounds: Uploading via Teams Admin Center works, but client-based sideload remains blocked or inconsistent.
• Root cause: Recent Teams client updates/platform changes—tracked as a bug by Microsoft.
• Propagation delays: Even after confirming policy changes, they can take up to 24–48 hours to fully propagate.

Actionable steps:

1. Double-check “Upload custom apps” in Teams Admin Center for your user.
2. Wait at least 24–48 hours if you just changed policies.
3. Try signing out/in and clearing Teams cache.
4. Monitor Agents Toolkit issue #14193 and msteams-docs issue #13088 for platform bug updates.
5. Use Admin Center upload as an interim workaround.

Apologies, this is a Microsoft Teams client issue—fix pending from Microsoft.

✨We'd love your feedback! Please take a moment to fill out our survey.

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!

[andrewconnell]

Possibly related #14688

[Mutantpenguin]

I think we are having the exact same problem. We followed all instructions and get the same message.

When trying via Teams in Edge, the console shows the following:

{
    "name": "Error",
    "message": "TransformFailed",
    "stack": [],
    "reason": "TransformFailed",
    "serverResponse": {
        "status": 400,
        "headers": {
            // omitted for brevity
        },
        "body": {},
        "url": "https://teams.microsoft.com/api/mt/emea/beta/users/apps/definitions/appPackage"
    },
    "innerException": {
        "name": "Error",
        "message": "{\"errorCode\":\"Create1on1ConversationWithBotFailed\",\"status\":400}",
        "stack": []
    }
}

[nikita-preql]

Admin-based/Dev-console-based/Teams-app-based sideload still doesn't work.

The loading itself succeeds, but adding an app to a channel - doesn't - it raises 'BadRequest'

[Mutantpenguin]

I think we are having the exact same problem. We followed all instructions and get the same message.

When trying via Teams in Edge, the console shows the following:

{
"name": "Error",
"message": "TransformFailed",
"stack": [],
"reason": "TransformFailed",
"serverResponse": {
"status": 400,
"headers": {
// omitted for brevity
},
"body": {},
"url": "https://teams.microsoft.com/api/mt/emea/beta/users/apps/definitions/appPackage"
},
"innerException": {
"name": "Error",
"message": "{"errorCode":"Create1on1ConversationWithBotFailed","status":400}",
"stack": []
}
}

We tried so much out that I am not completely sure, but I think giving each Developer the role "Application Developer" fixed the problem for us.

[nikita-preql]

More context:

https://www.loom.com/share/75f4a17b9cfe46a4b0011e210940b6f6

MS Teams Custom Bot Sideloading: Troubleshooting Report

Context & Goal

• Objective: Sideload and install a Teams bot (multi-tenant app registration, Azure Bot resource) from personal org (Entra tenant) to a different client org’s Teams tenant, purely for development/testing—not for store/AppSource publishing.

Steps Taken

1. App Registration & Azure Bot Setup

   • Registered app as multi-tenant in source org’s Entra tenant.
   • Created Azure Bot in Bot Service, linked to the registration. Selected “Single Tenant” as only option but verified client ID and endpoint matched.
   • Messaging endpoint enabled and externally accessible via ngrok.

2. Manifest Packaging

   • Created Teams app manifest (manifest.json) with correct bot ID and expanded scopes to include "team", "personal", "groupchat".
   • Ensured all manifest elements conformed to schema; included icons/zip as per MS standards.

3. Tenant & Teams Configuration

   • Verified target org Teams admin center:
     • Custom app upload policy enabled (screenshots attached).
     • Sideloading policy assigned to user.
     • App appeared as “Unblocked” in org app management and visible in org app listings.

4. Upload/App Install Attempts

   • Methods tested: Teams Client, Teams Admin Center, Teams Developer Portal.
   • All methods allowed upload. Issue emerged when attempting actual installation to a team/channel/personal scope.
   • Initially hit “BadRequest” errors (fixed with scope/manifest changes per MS docs & community feedback).

5. Current Blocking Error

   • After updates, now hit:

     You don't have access to this app.
     Due to your org's messaging policy, you are not allowed to install this app.
     

   • Verified in Teams Admin Center:
     • App permission and custom app policies are enabled and “Allow”, both global and specifically assigned to affected users.
     • No other restrictions (channel or team settings) are present, and user has all necessary ownership/admin permissions.

6. Other Debugging Steps

   • Waited >60 minutes for policy propagation.
   • Tested both team- and personal-level install (“Add to app” and “Upload for me”)—same error.
   • Cleared Teams caches and tried across multiple client/web sessions.

Observed Result

• Teams client and portal allow app upload, manifest validates, and app appears in catalog.
• Any attempt to add to team/channel or personal scope results in “You don't have access to this app. Due to your org's messaging policy, you are not allowed to install this app.”
• All relevant policies are enabled and assigned correctly—error persists.

Request to Support

• Is there a backend bug or undocumented policy/rollout logic affecting cross-tenant, multi-tenant sideloaded apps, or ways to further debug org policy enforcement in Teams?
• Can Microsoft confirm any known breaking changes or issues with custom app installation as of November 2025 for cross-tenant scenarios?
• Is there additional propagation time, a hidden limitation, or diagnostic trace to run to clarify root cause?

manifest.json

{
    "$schema": "https://developer.microsoft.com/json/schemas/teams/v1.16/MicrosoftTeams.schema.json",
    "manifestVersion": "1.16",
    "version": "1.0.1",
    "id": "8e037183-60bd-4d9b-b2cc-1dad5e5825a9",
    "packageName": "com.preql.agent.teams",
    "developer": {
        "name": "Preql Engineering Agent",
        "websiteUrl": "https://talented-aware-redfish.ngrok-free.app",
        "privacyUrl": "https://talented-aware-redfish.ngrok-free.app/privacy",
        "termsOfUseUrl": "https://talented-aware-redfish.ngrok-free.app/terms"
    },
    "name": {
        "short": "Preql Agent",
        "full": "Preql Engineering Agent - AI Assistant"
    },
    "description": {
        "short": "AI Engineering Assistant integrated with Teams",
        "full": "AI-powered engineering assistant that helps with technical tasks, integrated directly into Microsoft Teams for seamless collaboration."
    },
    "accentColor": "#FFFFFF",
    "icons": {
        "color": "color.png",
        "outline": "outline.png"
    },
    "bots": [
        {
            "botId": "8e037183-60bd-4d9b-b2cc-1dad5e5825a9",
            "scopes": [
                "team",
                "personal",
                "groupchat"
            ],
            "supportsFiles": false,
            "isNotificationOnly": false,
            "commandLists": [
                {
                    "scopes": [
                        "team",
                        "personal",
                        "groupchat"
                    ],
                    "commands": [
                        {
                            "title": "Help",
                            "description": "Get help with using the agent"
                        }
                    ]
                }
            ]
        }
    ],
    "permissions": [
        "identity",
        "messageTeamMembers"
    ],
    "validDomains": [
        "talented-aware-redfish.ngrok-free.app"
    ]
}

[summzhan]

This is a known issue as part of Bot auth migration from Multi-tenant to single tenant and it's happening only for admin users. We are working on it, and current ETA is end of December.

As a work around, follow below steps to prevent insufficient permission error
Once the bot is created, login to Aure portal
Find the Application registration.
Click on "Create Service Principal" on the Application registration overview page.
once the service principal is created, resume local debug.