AADSTS500011: The resource principal named {xyz} was not found in the tenant named Bot Framework.

Hi @Craig Noll 

Thank you for posting your question in the Microsoft Q&A forum. 

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data. 

Based on your description and screenshots, the issue comes from a mismatch between the application type and the OAuth scope configuration. 

With the following configuration: 

MicrosoftAppType=MultiTenant  
MicrosoftAppOAuthScope=https://api.botframework.com/.default 

the SDK requests a token for the Bot Framework resource (https://api.botframework.com). Azure AD then attempts to resolve the application in the Bot Framework tenant, but your app registration exists only in your own tenant. Because of this, Azure cannot locate the resource and returns: AADSTS500011: The resource principal named <app> was not found in the tenant named Bot Framework. 

Here are correct configurations: 

1.Single tenant app 

MicrosoftAppType=SingleTenant 
MicrosoftAppOAuthScope=https://api.botframework.com/.default  

This configuration works because Azure AD issues a token for the Bot Framework resource using the credentials from your tenant. 

2.Multi-tenant app  

MicrosoftAppType=MultiTenant 
MicrosoftAppOAuthScope=api://<AppClientID>/.default  

In this scenario, the token is requested for your own application resource rather than the Bot Framework resource.  

Required configuration steps in Microsoft Entra ID:  

-Set Supported account types to Accounts in any organizational directory. 

-Configure an Application ID URI, for example: api://<AppClientID> 

-Expose at least one scope. 

This allows Azure AD to resolve the resource in the tenant where the application registration exists.  

When the bot is installed in other tenants, administrator consent must be granted so the service principal is created in those tenants.  

Note: Multi-tenant bots with custom scopes are an advanced scenario and may have limitations with some Bot Framework features. 

I hope this helps. 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Error AADSTS500011 indicates that the resource (application) being requested cannot be found or accessed in the tenant that is handling the token request.

From the context, the relevant points for AADSTS500011 are:

• The error means the resource principal named in the request does not exist in the tenant, or is not accessible from that tenant.
• Typical causes:
  • The resource application is not provisioned in the tenant.
  • No user/admin has consented to the application in that tenant.
  • The resource URL / App URI ID is incorrect.
  • The tenant ID in the request is wrong.
  • The app is single‑tenant but is being accessed from a different tenant.

In this scenario:

• MicrosoftAppId and Directory (tenant) ID are both in tenant <PII removed>.
• MicrosoftAppType=MultiTenant, but the error message mentions the tenant name Bot Framework, which is the special botframework.com tenant used when acquiring tokens with the scope https://api.botframework.com/.default.
• This combination means the token request is being sent to the Bot Framework tenant as the resource, and that tenant cannot find the app registration corresponding to the MicrosoftAppId in its directory, so it returns AADSTS500011.

To resolve this:

1. Verify the resource and tenant in the failing token request
   • Use the error details or https://login.microsoftonline.com/error with the error code to confirm which resource (or scope) and tenant are in the failing request.
   • Ensure the request is sent to the tenant that owns the app registration (<PII removed>) and that the resource matches a valid application in that tenant.
2. Check that the resource application exists and is consented in the tenant
   • In Azure portal, go to Microsoft Entra ID → Enterprise applications.
   • Confirm that the resource application (the one whose App URI ID or resource URL is in the error) is present.
   • If it is missing, provision it (for example, by adding it from the gallery or granting permissions) and grant admin/user consent as required.
3. Validate the App URI ID / resource URL
   • Ensure that the MicrosoftAppOAuthScope or any resource/scope parameter used in token acquisition matches the App URI ID of an application that actually exists in the tenant.
   • If the App URI ID belongs to a different tenant, either:
     • Make that app registration multi‑tenant so it can be accessed cross‑tenant, or
     • Change the tenant in the request so it targets the tenant where that App URI ID is registered.
4. Align tenant type and usage
   • If the bot is effectively single‑tenant (used only in the sandbox tenant), configure both the Azure Bot resource and the app registration as single‑tenant and send token requests only to that tenant.
   • If multi‑tenant access is required, ensure the app registration is configured as multi‑tenant and that each consuming tenant has the corresponding service principal provisioned and consented.

These steps address the documented causes of AADSTS500011 by ensuring that the resource application and tenant in the token request are valid and correctly configured.

References:

• AADSTS500011 - Resource Principal Not Found
• Troubleshoot consent issues in Microsoft Entra ID
• Unexpected error when performing consent to an application
• Authentication Troubleshooting
• Troubleshooting Bot Framework authentication
• Teams App / Bot 'Unauthorized' error when responding to an activity - Microsoft Q&A