setup blueprint: identifierUris set to api://<appId> instead of api://botid-<appId>, breaking Teams message delivery

Description

a365 setup blueprint / a365 setup all stamps the blueprint Entra app's identifierUris as api://<appId>. Teams requires the botid- prefix (api://botid-<appId>) for Activity Protocol routing and token exchange. Without it, messages sent to an agent instance are silently never delivered to the configured Notification URL — no error surfaces anywhere.

The offending line is BlueprintSubcommand.cs#L1260:

var identifierUri = $"api://{appId}";

applied at L1264 via PATCH /v1.0/applications/{objectId}.

The CLI's own dry-run output disagrees with what it does. Three places print the prefixed form:

• PublishCommand.cs#L318 — webApplicationInfo.resource -> api://botid-{ClientAppId}, but L353 writes webInfo["resource"] = $"api://{blueprintId}"
• NonDwSetupOrchestrator.cs#L61, L95, L96 — prints api://botid-<appId>, but that method is a stub (LogWarning at L50: "not yet fully implemented")

Possible provenance: #191 specified $IdentifierUri = "api://<blueprint-id>" in its repro script, and that appears to have been implemented literally. The botid- text in NonDwSetupOrchestrator looks like a holdover from the classic Azure Bot / App Registration flow, which did apply the prefix — which is why developers who onboarded via the older path never hit this.

Behavior is identical across --authmode obo|s2s|both, --m365, --aiteammate, and standalone setup blueprint.

Expected behavior

identifierUris is set to api://botid-<appId>, matching the CLI's dry-run output, and messages sent to an agent instance reach the configured Notification URL.

SDK Version

1.1.214

Language/Runtime

.NET 8 (a365 CLI global tool); agent runtime Node.js 20 / TypeScript Teams SDK

OS

macOS 14

How to Reproduce

1. a365 setup all --agent-name <name> --m365
2. Start a Teams SDK app on a public HTTPS endpoint; set that endpoint as the blueprint's Notification URL (Agent Type: API Based) in Developer Portal
3. Publish + activate the generated package via M365 Admin Center
4. Create an agent instance from the Teams Store
5. Send the instance a chat message

The app receives nothing. No error in the app, in Developer Portal, or from the CLI.

Output

$ az ad app show --id <blueprint-id> --query identifierUris -o json
[
  "api://<blueprint-id>"
]

After manually applying the prefix, messages are delivered immediately on the next send:

$ az ad app update --id <blueprint-id> --identifier-uris "api://botid-<blueprint-id>"

Note that once messages do flow, a separate missing-grant problem surfaces as AADSTS65001 naming the instance app rather than the blueprint — which sends you looking at instance consent instead of blueprint inheritance. Filing that separately.

Screenshots

N/A

Code of Conduct

• I agree to follow the Microsoft Open Source Code of Conduct.