| App does not appear in meeting | Setup policy not assigned or not propagated | Verify the setup policy assignment in Teams Admin Center. Wait up to 48 hours. Restart the Teams client. |
| Consent prompt shows “Need admin approval” | Signed-in user does not have the required Entra ID role. | Sign in with a Global Administrator or Cloud Application Administrator account. |
| ”AADSTS65001: The user or administrator has not consented” | Multitenant app consent was not granted or has been revoked. | Go to App registration -> API permissions and run Grant admin consent again. |
| ”Insufficient privileges” on Graph API calls | Required Graph permissions were not added or not consented in App registration. | Go to Entra ID -> App registrations -> your multitenant app -> API permissions. Add missing permissions and click Grant admin consent. |
| ”Cannot reach app” in Teams meeting | Network firewall blocking the app host URL. | Add the correct URL to your HTTPS allowlist: altouraremoteacs.azurewebsites.net (SaaS) or your custom URL (Customer Tenant). Verify connectivity with a browser. |
| Blank screen in meeting tab | Browser/client cache issue | Clear the Teams client cache or press F5 to reload the tab. Check browser console for errors. |
| App registration not found during setup | Looking under Enterprise applications instead of App registrations. | Go to Entra ID -> App registrations and search by Application (client) ID or app name. |
| Sign-in fails with redirect/callback error | Redirect URI is missing or mismatched in Authentication settings. | Open App registration -> Authentication and add the exact callback URL provided for your deployment model. |
| Teams SSO token audience/scope error | Expose API configuration is incomplete (Application ID URI/scope missing). | Open App registration -> Expose an API and configure Application ID URI plus required scope, then re-test. |
| Teams SSO still fails after scope setup | Authorized client applications are incomplete under Expose an API. | Open App registration -> Expose an API -> Add a client application and confirm all three are present with the access_as_user scope checked: the Teams client IDs 1fec8e78-bce4-4aaf-ab1b-5451cc387264 (desktop/mobile) and 5e3ce6c0-2b1f-4285-8d4b-75ee78787346 (web), plus the uploaded Teams app’s Object ID. |
| Teams app opens but SSO/token fails immediately | Teams manifest webApplicationInfo values don’t match App registration (id/resource mismatch). | In Teams app package manifest, set webApplicationInfo.id to App registration client ID and webApplicationInfo.resource to Application ID URI from Expose an API, then re-upload app package. |
| External tenant users cannot authenticate | The external user’s tenant has not granted consent for the multitenant app. | Ensure multitenant account type is configured and required tenant consent is completed for participating external organizations. |
