I am getting “Unauthorized. Invalid AppId passed on token” in an Azure Bot with FastAPI, even though the MicrosoftAppId, Tenant, and Secret are correctly configured and loaded from App Service.

Hello Jenny Rozo,

Welcome to Microsoft Q&A and Thank you for the detailed explanation.

I understand how frustrating the “Unauthorized. Invalid AppId passed on token” error can be, especially when your MicrosoftAppId, tenant, and secret all appear to be correctly configured. Since you're using FastAPI + botbuilder-sdk (Python) + CloudAdapter + ConfigurationBotFrameworkAuthentication on Azure App Service (Linux), let’s consolidate all likely causes and troubleshooting steps into a structured approach.

What This Error Means

When Teams or Web Chat sends a message to your bot:

The request includes a JWT Bearer token.

The SDK validates the token.

It checks the aud (audience) claim inside the token.

That value must exactly match your MicrosoftAppId.

If they don’t match, you get:

PermissionError: Unauthorized. Invalid AppId passed on token

So this is always an audience / App ID mismatch problem during JWT validation.

Troubleshooting Steps,

1.Confirm Azure Bot Resource and App Registration Match

This is the #1 cause.

Go to:

Azure Portal → Azure Bot resource

Check Microsoft App ID

Now confirm it is the same value as:

Azure AD → App Registrations → Application (client) ID

MicrosoftAppId in your App Service environment variables

Common scenario:

Azure Bot resource points to App Registration A

App Service is configured with App Registration B

They must all reference the same App Registration.

2.Verify Environment Variable Names (Python SDK Requirement)

For ConfigurationBotFrameworkAuthentication, the Python SDK expects exactly:

MicrosoftAppId
MicrosoftAppPassword
MicrosoftAppTenantId
MicrosoftAppType

Not:

CLIENT_ID
APP_ID
AZURE_CLIENT_ID

Even if your app logs values at startup, confirm that:

os.environ["MicrosoftAppId"]

is the same value CloudAdapter is using.

3.Validate SingleTenant vs MultiTenant Configuration

If using SingleTenant, you must set:

MicrosoftAppType=SingleTenant
MicrosoftAppTenantId=<your tenant id>

And your App Registration must be:

Accounts in this organizational directory only

If your App Registration is multi-tenant but your bot is configured as SingleTenant (or vice versa), authentication will fail with this exact error.

4.Confirm the Client Secret Is Correct

Make sure:

You copied the Secret Value

Not the Secret ID

Using the Secret ID instead of the Secret Value will cause authentication failure.

5.Check Authorization Header

Since you're passing:

await ADAPTER.process_activity(auth_header, activity, bot_logic)

Verify:

auth_header is not empty

It includes Bearer <token>

The token is not malformed

You can temporarily log the presence (not the full value) to confirm it’s arriving correctly.

You may also test token acquisition manually using Postman to verify that the client credentials flow is working properly.

6.Decode the JWT Token and Inspect the aud Claim

This is a powerful debugging step.

Decode the incoming token (using jwt.io or a local decoder) and inspect:

"aud": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

That value must match your MicrosoftAppId exactly.

If it does not match → you have identified the root cause.

7.Review App Registration Settings

Go to:

Azure AD → App registrations → Your Bot App

Check:

• Application (client) ID matches your bot resource
• API permissions are correctly configured
• Admin consent is granted
• App ID URI (if configured) does not conflict

8.Check Azure Bot Channels Registration

If testing from:

Microsoft Teams

Web Chat

Ensure the Azure Bot Channels Registration is configured with the same App ID as your App Service.

Mismatch here will produce this exact error.

9.Check App Service Authentication

Go to App Service → Authentication

If Azure App Service Authentication is enabled, it can interfere with Bot Framework JWT validation.

Either Disable it or properly configure it for bot scenarios

10.Inspect Permissions and Role Assignments

If your bot identity requires specific roles or resource access:

Confirm correct RBAC assignments

Ensure the calling identity has required permissions

While this is less common for this specific error, it’s still worth validating.

11.Check for Token Expiration

If you are caching tokens anywhere:

• Ensure tokens are not expired
• Expired tokens can produce similar authentication failures

12.Enable Diagnostic Logging

To get deeper visibility:

Enable Application Logging in App Service

Turn on detailed logging for botbuilder authentication

Inspect stack traces around:

JwtTokenValidation.validate_auth_header
ChannelValidation.validate_identity

This often reveals audience or tenant mismatch details.

Root Cause in Your Case

Based on your description (fails in both SingleTenant and MultiTenant), the most probable cause is:

The Azure Bot resource is linked to a different App Registration than the one configured in App Service.

This is by far the most common trigger for Invalid AppId passed on token in CloudAdapter scenarios.

This error is not typically caused by FastAPI or Python 3.13. It is almost always due to:

• App ID mismatch
• Tenant mismatch
• Wrong secret value
• Bot resource misalignment
• Token audience mismatch

Please refer this

• Resolve Unauthorized Errors in Azure App Service
• Bot Framework Authentication Troubleshooting
• General Troubleshooting for Azure AI Bot Service Bots

I hope this helps, do let me know if you have any further queries.

Thank you!