How to handle SSO in Teams with the new Agents SDK Release?

Kumble, Rahul 35 Reputation points
2025-11-26T08:47:53.76+00:00

I am building a conversational chatbot for microsoft teams using the new Agents SDK in python, I built a different bot using the 0.3.2 release of the framework in the past where I would handle user consent and SSO in my messaging endpoint like so:


@AGENT_APP.activity("message")
async def on_message(context: TurnContext, _: TurnState) -> None:
    user_id: str = context.activity.from_property.aad_object_id
    token = None

    typing_indicator = TypingIndicator(interval=800)
    await typing_indicator.start(context)

    if token_cache.does_valid_token_exist(user_id):
        token: Optional[str] = token_cache.get_token(user_id)

    if not token:
        token_response: Optional[TokenResponse] = await AGENT_APP.auth.get_token(
            context, "GRAPH"
        )
        if token_response and token_response.token:
            token: str = token_response.token
            token_cache.add_user_token(user_id, token)
        else:
            async with AGENT_APP.auth.open_flow(context, "GRAPH") as flow:
                flow_response: FlowResponse = await flow.begin_or_continue_flow(
                    context.activity
                )

                if flow_response.sign_in_resource:
                    await context.send_activity(
                        create_oauth_signin_activity(flow_response)
                    )
                    return

    if user_id not in message_cache.cache:
        hist: List[Dict[str, str]] = await get_n_message_history(context, token, 10)
        message_cache.add_history(user_id, hist)

    message_cache.add_new_message(user_id, context.activity.text)

    async with httpx.AsyncClient() as client:
        agent_response: Response = await client.post(
            f"{API_BASE_URL}/v1/agent/messages",
            json={
                "user": context.activity.from_property.name,
                "history": message_cache.get_user_history(user_id),
            },
            timeout=30.0,
        )
        response: Dict = agent_response.json()

    bot_message: Optional[str] = response.get("message")

    if bot_message not in tools:
        message_cache.add_new_message(user_id, bot_message, True)
        await context.send_activity(f"{bot_message}")
        typing_indicator.stop()
    else:
        await context.send_activity(tools.get(bot_message)())
        typing_indicator.stop()

however since then, the open_flow() and access to FlowResponse or really any way to control the oauth flow has been removed according to this Pull Request . Since the framework is almost completely undocumented I would like to know what the new way of doing this is.

PS: even though there are no changes in my code, running the same code on a different bot instance gives me the following error banner when clicking on the oauth card:

This action can't be performed since the app does not exist or has been uninstalled.

I have cross referenced the previous bots config and there are almost no differences I would like to know how to fix this error as well because I noticed that clicking on the signin button on the card makes no network requests to the bot so I need to fix this issue as well.

Microsoft Teams | Development
Microsoft Teams | Development
Building, integrating, or customizing apps and workflows within Microsoft Teams using developer tools and APIs
0 comments No comments
{count} vote

1 answer

Sort by: Most helpful
  1. Kha-N 5,295 Reputation points Microsoft External Staff Moderator
    2025-11-26T10:19:01.42+00:00

    Hi @Kumblerahul,

    Welcome to Microsoft Q&A, and thank you for reaching out.

    Please note that as a Microsoft Q&A moderator, I don’t have access to your specific configuration, and my testing environment is limited. I can only assist using available documentation and resources, but I’ll do my best to help.

    Regarding the OAuth flow: From my research based on Microsoft’s official guidance on Team bot Authentication, currently, there isn’t an alternative approach to control OAuth flow.

    As far as I know, in Teams native built-in, OAuth/SSO is handled through Invoke activities (not Event activities). Your bot should forward the invoke to the appropriate dialog or handler. The Teams client attempts token exchange first and only fall back to a sign-in card if necessary. This is the model the Agents SDK follows, the SDK manages card emission and token exchange rather than requiring you to control the flow manually.

    About the error when running the same Python script on a different bot, could you clarify the purpose of the second bot compared to the first? Depending on the use case, the script might behave differently due to functional differences.

    Additionally, as I checked, based on this StackOverflow thread, ensure the following domains are listed in the validDomains section of your app manifest:

    • token.botframework.com
    • login.microsoftonline.com

    This often resolves the “app does not exist or has been uninstalled” error when clicking the sign-in button.

    This link will take you to StackOverflow, which is outside Microsoft’s domain. Please note that Microsoft is not responsible for the accuracy, security, or advertising on external sites.

    At this point, I don’t have further insights beyond what’s documented. I’ve researched, but due to environment limitations and lack of official documentation, I couldn’t uncover new findings. Therefore, I recommend checking GitHub discussions or Microsoft Tech Community forums, where experienced developers share practical solutions and troubleshooting tips. These platforms often provide valuable perspectives that can help resolve such issues.

    Thank you for your understanding.


    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.