MS Teams机器人认证报错AADSTS700016：应用在目录中未找到

我首次开发用于企业Teams频道的MS Teams机器人，计划迁移现有Slack机器人功能。我拥有Teams自定义应用上传权限，但无Azure门户访问权限，同事已为机器人创建Microsoft Entra ID (Azure AD)应用，并提供以下凭据：

• Application (Client) ID
• Client Secret
• Tenant ID

作为MS Teams开发新手，我使用VS Code的MS Teams Toolkit（JavaScript）生成项目结构，发现环境变量缺少BOT_TENANT_ID键，因config.js从环境变量读取租户ID，遂手动添加该键及对应值。

调试时机器人可加入频道接收消息，但无法发送响应，抛出AADSTS700016错误：

App received message: hi
[onTurnError] unhandled error ServerError: unauthorized_client: Error(s): 700016 - Timestamp: 2025-02-27 13:26:16Z - Description: AADSTS700016: Application with identifier 'xxx' was not found in the directory 'Bot Framework'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: xxx Corre
lation ID: xxx Timestamp: 2025-02-27 13:26:16Z - Correlation ID: xxx - Trace ID: xxx
    at ResponseHandler.validateTokenResponse (\src\chatops_test\node_modules\@azure\msal-node\lib\msal-node.cjs:6740:33)
    at ClientCredentialClient.executeTokenRequest (\src\chatops_test\node_modules\@azure\msal-node\lib\msal-node.cjs:11333:25)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async ConfidentialClientApplication.acquireTokenByClientCredential (\src\chatops_test\node_modules\@azure\msal-node\lib\msal-node.cjs:11679:20) {
  errorCode: 'unauthorized_client',
  errorMessage: "Error(s): 700016 - Timestamp: 2025-02-27 13:26:16Z - Description: AADSTS700016: Application with identifier 'xxx' was not found in the directory 'Bot Framework'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: xxx  Correlation ID: xxx Timestamp: 2025-02-27 13:26:16Z - Correlation ID: xxx - Trace ID: xxx'', 
  subError: '',
  errorNo: 700016,
  status: 400,
  correlationId: 'xxx'
}
ServerError: unauthorized_client: Error(s): 700016 - Timestamp: 2025-02-27 13:26:16Z - Description: AADSTS700016: Application with identifier 'xxx' was not found in the directory 'xxx'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: xxx  Correlation ID: xxx Timestamp: 2025-02-27 13:26:16Z - Correlation ID: xxx - Trace ID: xxx
    at ResponseHandler.validateTokenResponse (\src\chatops_test\node_modules\@azure\msal-node\lib\msal-node.cjs:6740:33)
    at ClientCredentialClient.executeTokenRequest (\src\chatops_test\node_modules\@azure\msal-node\lib\msal-node.cjs:11333:25)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async ConfidentialClientApplication.acquireTokenByClientCredential (\src\chatops_test\node_modules\@azure\msal-node\lib\msal-node.cjs:11679:20) {
  errorCode: 'unauthorized_client',
  errorMessage: "Error(s): 700016 - Timestamp: 2025-02-27 13:26:16Z - Description: AADSTS700016: Application with identifier 'xxx' was not found in the directory 'xxx'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: xxx Correlation ID: xxx Timestamp: 2025-02-27 13:26:16Z - Correlation ID: xxx - Trace ID: xxx",
  subError: '',
  errorNo: 700016,
  status: 400,
  correlationId: 'xxx'
}

我已验证Application ID正确，但目录（租户）信息有误，推测为Tenant ID问题。已确认.env文件中BOT_TENANT_ID配置正确，参考微软现有AAD应用文档但发现其过时，与当前模板不匹配。现咨询：

1. MS Teams Toolkit期望Tenant ID设置在何处？
2. 机器人可能从哪些其他位置获取该值？
3. 如何确保认证时使用正确的Tenant ID？

1. MS Teams Toolkit期望Tenant ID的设置位置 #

• 核心位置是.env系列文件（如.env.local、.env.development，根据调试环境选择对应文件），需确保BOT_TENANT_ID键值对配置正确。
• 检查teamsapp.yml或teamsapp.local.yml配置文件，其中的tenantId字段需与提供的租户ID一致，Toolkit会从这里读取租户信息用于部署和调试。
• 可直接在VS Code左侧Teams Toolkit面板的「环境」选项中编辑Tenant ID，Toolkit会自动同步到对应.env文件。

2. 机器人可能获取Tenant ID的其他位置 #

• MSAL配置文件：若项目中有单独的MSAL认证配置文件（如authConfig.js），检查是否存在authority字段，格式应为https://login.microsoftonline.com/{your-tenant-id}，确认此处租户ID正确。
• Bot Framework SDK配置：查看config.js或bot.js中初始化Bot的代码，是否直接指定租户ID，或从其他未注意的环境变量（如AZURE_TENANT_ID）读取。
• VS Code用户设置：若之前用Toolkit登录过其他租户，可能在VS Code的Teams Toolkit设置中缓存了旧的租户ID，需清理或切换到正确租户。
• 本地缓存目录：项目下的.toolkit目录可能残留旧的租户信息，清理该目录后重试。

3. 确保认证使用正确Tenant ID的步骤 #

• 强制指定Authority：在MSAL初始化代码中，直接设置authority为https://login.microsoftonline.com/{your-tenant-id}，不依赖默认值，避免SDK自动使用错误目录。
• 验证变量加载：在config.js中添加日志，打印读取到的BOT_TENANT_ID值，确认程序实际加载的是正确的租户ID，排除变量名拼写错误或文件未加载的问题。
• 检查应用权限：确认同事创建的Entra ID应用已在目标租户完成管理员授权，且机器人应用已安装到对应Teams团队/频道。
• 重启调试环境：修改配置后，完全重启VS Code和调试进程，确保新配置生效，避免缓存旧值。

内容的提问来源于stack exchange，提问作者Bomteyer