MSAL Issue with Toolkit

[alexfdezflores]

Describe the bug
Using the weather template from the tool in my own demo tenant following the steps to set it up creates an error and the app never lounch on teams and gives the following error in the terminal.
This error started since A365 is avialable in the Frontier Programme.

warn: Microsoft.Agents.Authentication.Msal.MsalAuth[0]
False MSAL 4.70.2.0 MSAL.NetCore .NET 9.0.11 Microsoft Windows 10.0.26200 [2025-12-01 17:22:20Z - 307fa38a-4697-4c4a-976b-910681804b4f] Request retry failed.
fail: Microsoft.Agents.Authentication.Msal.MsalAuth[0]
False MSAL 4.70.2.0 MSAL.NetCore .NET 9.0.11 Microsoft Windows 10.0.26200 [2025-12-01 17:22:20Z - 307fa38a-4697-4c4a-976b-910681804b4f] === Token Acquisition (1004) failed.
Host: login.microsoftonline.com.
fail: Microsoft.Agents.Authentication.Msal.MsalAuth[0]
False MSAL 4.70.2.0 MSAL.NetCore .NET 9.0.11 Microsoft Windows 10.0.26200 [2025-12-01 17:22:20Z - 307fa38a-4697-4c4a-976b-910681804b4f] Exception type: Microsoft.Identity.Client.MsalServiceException
, ErrorCode: invalid_client
HTTP StatusCode 401
CorrelationId 307fa38a-4697-4c4a-976b-910681804b4f
Microsoft Entra ID Error Code AADSTS7000229
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging

fail: Microsoft.Agents.Authentication.Msal.MsalAuth[0]
False MSAL 4.70.2.0 MSAL.NetCore .NET 9.0.11 Microsoft Windows 10.0.26200 [2025-12-01 17:22:20Z - 307fa38a-4697-4c4a-976b-910681804b4f] Exception type: Microsoft.Identity.Client.MsalServiceException
, ErrorCode: invalid_client
HTTP StatusCode 401
CorrelationId 307fa38a-4697-4c4a-976b-910681804b4f
Microsoft Entra ID Error Code AADSTS7000229
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func2 onBeforePostRequestData) at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger) at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger) at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.GetAccessTokenAsync(CancellationToken cancellationToken, ILoggerAdapter logger) at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.ExecuteAsync(CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext() --- End of stack trace from previous location --- at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func1 codeBlock)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

To Reproduce
Steps to reproduce the behavior:

1. create a new project with the weather template
2. follow the steps
3. Run using Teams browser on edge
4. See error

Expected behavior
App recognised on the tenant

Screenshots

[m365-agent-toolkit-assistant]

👋 Hi @alexfdezflores,

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 2 business days

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

Thanks for providing the error details. The error:

MsalServiceException, ErrorCode: invalid_client, HTTP StatusCode 401, Microsoft Entra ID Error Code AADSTS7000229

means there is a problem with your Azure AD app registration—usually with the client secret, client ID, or manifest.

Known issue references:

• MSAL Weather App not working in Teams
• AAD provisioning in m365agents.local.yml

Actionable Steps:

1. Check your Azure AD app registration:
   • Confirm the client ID and client secret in your .env match those in Azure.
   • Ensure the secret hasn’t expired.
2. Sign-in audience:
   • For multi-tenant, set signInAudience to "AzureADMultipleOrgs" in your provisioning YAML.
3. Update m365agents.local.yml:
   • Use the existing aadApp/create block, update values if needed (don’t duplicate).
4. Re-provision via Microsoft 365 Agents Toolkit.

If the above doesn’t help, please share:

• Your development environment (VS, VS Code, CLI)
• Toolkit version
• Steps you followed
• Redacted error logs

This helps pinpoint the cause.

✨We'd love your feedback! Please take a moment to fill out our survey.

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!

[HuihuiWu-Microsoft]

@alexfdezflores Can you help confirm the Agents Toolkit version? And what do you mean by 'This error started since A365 is avialable in the Frontier Programme.'? We don't have any A365 related templates/samples in ATK for VS.