Support separate Teams Graph tenant

DanBotero · DanBotero · commit c6dcc0f9e41f · 2026-05-26T22:13:55.000-07:00
diff --git a/docs/channels/msteams.md b/docs/channels/msteams.md
@@ -93,6 +93,8 @@ The output will show `CLIENT_ID`, `CLIENT_SECRET`, `TENANT_ID`, and a **Teams Ap
       appId: "<CLIENT_ID>",
       appPassword: "<CLIENT_SECRET>",
       tenantId: "<TENANT_ID>",
+      // Optional: customer tenant for Graph/RSC calls when different from the bot tenant.
+      // graphTenantId: "<CUSTOMER_TENANT_ID>",
       webhook: { port: 3978, path: "/api/messages" },
     },
   },
@@ -272,6 +274,8 @@ Creation of new multi-tenant bots was deprecated after 2025-07-31. Use **Single
       appId: "<APP_ID>",
       appPassword: "<APP_PASSWORD>",
       tenantId: "<TENANT_ID>",
+      // Optional: customer tenant for Graph/RSC calls when different from the bot tenant.
+      // graphTenantId: "<CUSTOMER_TENANT_ID>",
       webhook: { port: 3978, path: "/api/messages" },
     },
   },
@@ -680,6 +684,7 @@ Key settings (see `/gateway/configuration` for shared channel patterns):
 
 - `channels.msteams.enabled`: enable/disable the channel.
 - `channels.msteams.appId`, `channels.msteams.appPassword`, `channels.msteams.tenantId`: bot credentials.
+- `channels.msteams.graphTenantId`: optional Microsoft Graph tenant override for customer-tenant/RSC calls when different from the bot tenant.
 - `channels.msteams.webhook.port` (default `3978`)
 - `channels.msteams.webhook.path` (default `/api/messages`)
 - `channels.msteams.dmPolicy`: `pairing | allowlist | open | disabled` (default: pairing)
diff --git a/docs/gateway/config-channels.md b/docs/gateway/config-channels.md
@@ -711,7 +711,7 @@ Microsoft Teams is plugin-backed and configured under `channels.msteams`.
     msteams: {
       enabled: true,
       configWrites: true,
-      // appId, appPassword, tenantId, webhook, team/channel policies:
+      // appId, appPassword, tenantId, optional graphTenantId, webhook, team/channel policies:
       // see /channels/msteams
     },
   },
diff --git a/extensions/msteams/src/channel.test.ts b/extensions/msteams/src/channel.test.ts
@@ -75,6 +75,19 @@ describe("msteams config schema", () => {
     }
   });
 
+  it("accepts a separate Graph tenant id", () => {
+    const res = MSTeamsConfigSchema.safeParse({
+      tenantId: "bot-tenant-id",
+      graphTenantId: "customer-tenant-id",
+    });
+
+    expect(res.success).toBe(true);
+    if (res.success) {
+      expect(res.data.tenantId).toBe("bot-tenant-id");
+      expect(res.data.graphTenantId).toBe("customer-tenant-id");
+    }
+  });
+
   it("accepts replyStyle at global/team/channel levels", () => {
     const res = MSTeamsConfigSchema.safeParse({
       replyStyle: "top-level",
diff --git a/extensions/msteams/src/graph.test.ts b/extensions/msteams/src/graph.test.ts
@@ -300,6 +300,25 @@ describe("msteams graph helpers", () => {
     expect(getAccessToken).toHaveBeenCalledWith("https://graph.microsoft.com");
   });
 
+  it("uses graphTenantId for Graph tokens without changing bot credentials", async () => {
+    mockGraphTokenResolution();
+
+    await expect(
+      resolveGraphToken({
+        channels: {
+          msteams: {
+            graphTenantId: "customer-tenant-id",
+          },
+        },
+      }),
+    ).resolves.toBe("resolved-token");
+
+    expect(loadMSTeamsSdkWithAuthMock).toHaveBeenCalledWith({
+      ...mockCredentials,
+      tenantId: "customer-tenant-id",
+    });
+  });
+
   it("fails when credentials or access tokens are unavailable", async () => {
     resolveMSTeamsCredentialsMock.mockReturnValue(undefined);
     await expectRejectsToThrow(resolveGraphToken({ channels: {} }), "MS Teams credentials missing");
diff --git a/extensions/msteams/src/graph.ts b/extensions/msteams/src/graph.ts
@@ -36,6 +36,10 @@ export function escapeOData(value: string): string {
   return value.replace(/'/g, "''");
 }
 
+function normalizeOptionalTenantId(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
 async function requestGraph(params: {
   token: string;
   path: string;
@@ -214,11 +218,14 @@ export async function resolveGraphToken(
   if (!creds) {
     throw new Error("MS Teams credentials missing");
   }
+  const graphTenantId = normalizeOptionalTenantId(msteamsCfg?.graphTenantId) ?? creds.tenantId;
+  const graphCreds =
+    graphTenantId === creds.tenantId ? creds : { ...creds, tenantId: graphTenantId };
 
   // Try delegated token if requested and configured
   if (options?.preferDelegated && msteamsCfg?.delegatedAuth?.enabled && creds.type === "secret") {
     const delegated = await resolveDelegatedAccessToken({
-      tenantId: creds.tenantId,
+      tenantId: graphTenantId,
       clientId: creds.appId,
       clientSecret: creds.appPassword,
     });
@@ -228,7 +235,7 @@ export async function resolveGraphToken(
     // Fall through to app-only token
   }
 
-  const { app } = await loadMSTeamsSdkWithAuth(creds);
+  const { app } = await loadMSTeamsSdkWithAuth(graphCreds);
   const tokenProvider = createMSTeamsTokenProvider(app);
   const graphTokenValue = await tokenProvider.getAccessToken("https://graph.microsoft.com");
   const accessToken = readAccessToken(graphTokenValue);
diff --git a/src/config/bundled-channel-config-metadata.generated.ts b/src/config/bundled-channel-config-metadata.generated.ts
diff --git a/src/config/types.msteams.ts b/src/config/types.msteams.ts
@@ -95,6 +95,8 @@ export type MSTeamsConfig = {
   appPassword?: SecretInput;
   /** Azure AD Tenant ID (for single-tenant bots). */
   tenantId?: string;
+  /** Optional customer tenant ID for Microsoft Graph app-only calls when it differs from the bot tenant. */
+  graphTenantId?: string;
   /**
    * Authentication type.
    * - `"secret"` (default): uses `appPassword` (client secret).
diff --git a/src/config/zod-schema.providers-core.ts b/src/config/zod-schema.providers-core.ts
@@ -1514,6 +1514,7 @@ export const MSTeamsConfigSchema = z
     appId: z.string().optional(),
     appPassword: SecretInputSchema.optional().register(sensitive),
     tenantId: z.string().optional(),
+    graphTenantId: z.string().optional(),
     authType: z.enum(["secret", "federated"]).optional(),
     certificatePath: z.string().optional(),
     certificateThumbprint: z.string().optional(),
