- Ya
- 4 Septemba 2026, 02:48 UTC
- Mwandishi
- Kamo
- Ahadi ya
- ae4a41b
The per-phone-server credentials still win — that is the most specific source. What changes is the fallback underneath them: the org's own MICROSOFT_TEAMS registration if it has one, and only then Kamo's multi-tenant app. The redirect URI is org-scoped for the same reason it is registration data at all: an org on its own Entra app registered its own, and Microsoft requires the value replayed on the token exchange to match the authorization byte-for-byte. So the callback resolves it under the same org it authorized under.