Greptile Summary

This PR fixes a long-standing bug where the sts.windows.net issuer entry in BOT_FRAMEWORK_ISSUERS was hardcoded to a single tenant UUID, causing all SingleTenant bot deployments (other than the one matching that specific UUID) to receive 401 Unauthorized on every incoming Bot Framework webhook. The fix converts the static string to a dynamic function (tenantId) => \https://sts.windows.net/${tenantId}/\`` — consistent with the existing pattern for the login.microsoftonline.com entry — and updates the corresponding test to use creds.tenantId.

Confidence Score: 5/5

This PR is safe to merge — the fix is minimal, targeted, and consistent with the established pattern already used for the Entra v2.0 issuer entry.

No P0 or P1 findings. The change is a one-line fix in sdk.ts plus a matching test update. The dynamic issuer function correctly scopes validation to the configured tenant (correct SingleTenant security behavior), the JWKS endpoint is shared and valid for both Azure AD v1 and v2.0, and all related code paths (allowedIssuers computation and resolveIssuerEntry) already handle function-based issuers correctly.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix(msteams): use dynamic tenant ID for ..." | Re-trigger Greptile}

Closing this as implemented after Codex review.

Current main already includes the tenant-scoped sts.windows.net/{tenantId}/ issuer handling for Microsoft Teams JWT validation, plus regression tests for both the valid tenant-scoped issuer and rejection of the old hardcoded tenant. The same implementation is present in release v2026.4.23, so this PR is superseded by code already shipped on main/release.

What I checked:

• Current main uses dynamic STS issuer: BOT_FRAMEWORK_ISSUERS already defines the sts.windows.net issuer as a tenant-scoped function instead of a hardcoded UUID. (extensions/msteams/src/sdk.ts:652, 11804a484ded)
• Current main has regression coverage: The Teams JWT validator tests already cover accepting https://sts.windows.net/${creds.tenantId}/ and rejecting the old hardcoded tenant issuer. (extensions/msteams/src/sdk.test.ts:328, 11804a484ded)
• Latest release already contains the fix: Release commit a9797214338ba31c52c796adbb75afb16e0684a9 contains the same tenant-scoped STS issuer implementation in the Teams SDK. (extensions/msteams/src/sdk.ts:652, a9797214338b)
• Docs align with SingleTenant Teams setup: The public Teams setup docs already direct users to create a Single Tenant bot and capture tenantId, matching the tenant-scoped issuer behavior now in code. Public docs: docs/channels/msteams.md. (docs/channels/msteams.md:143, 11804a484ded)

So I’m closing this as already implemented rather than keeping a duplicate issue open.

Review notes: reviewed against 11804a484ded; fix evidence: release v2026.4.23, commit a9797214338b.