Action required: ensure your Microsoft Teams apps are ready for upcoming domain changes

Chris Yanasak

In April 2023, Microsoft announced that it would be undertaking a multi-year effort to reduce domain fragmentation among authenticated, user-facing Microsoft 365 apps and services by bringing them onto a single, consistent and cohesive domain: This consolidation will help improve security, administration, and user experience across the board, and will ultimately lay a foundation for better and tighter integration across the Microsoft 365 ecosystem.

As we prepare to migrate the Teams, Outlook, and Microsoft 365 web apps to the domain, developers of Teams apps – including those that run on Outlook and Microsoft 365 – need to take the actions described below to ensure that those apps continue to function on the new domain. If no action is taken, your app may not render in the new domain ( when it goes live in June 2024. If you are unable to update your app before that time, any tenant running your app will remain on while we work with you to make the necessary changes.

This change impacts embedded applications where an external web app is rendered inside Teams, Outlook or Microsoft 365. If your app falls into this category, it will be affected.

How to prepare your app for

Today, apps that embed their web content in a Microsoft 365 host application such as Teams, Outlook, or run on a set of inherently trusted domains that are hardcoded in the TeamsJS client library. To support the rollout of applications under domain and make future cross domain app integration more seamless, Microsoft will migrate this list of trusted domains to a new CDN endpoint to be called on app initialization. This change was released in early January 2024 as part of Teams JS version 2.19 release. This new list will be dynamic, which will limit the impact of any future domain changes on your app.

To avoid any breaking changes to your app in the new domain, you will need to perform the following actions:

  1. Upgrade Teams JS library to version 2.19 or higher.
  2. Update your x-frame-options/CSP headers to allow for the new domains. To ensure the app keeps working across existing and future Microsoft 365 hosts, please ensure to allow “*”.

Timeline and impact:

To prepare your app for the transition to, please complete the changes above as soon as you are able. The domain is now available for testing, with full operation alongside expected in June. At that time, the expected user experience will be as follows:

App opened in

  • Everything will work as expected.

App opened in

  • CTAs complete: Everything will work as expected.
  • CTAs not complete: Error message given with guidance for the user to navigate to to use the app.

The transition to will benefit users and developers across the Microsoft 365 ecosystem. We are excited to take the next steps toward bringing Teams, Outlook, and Microsoft 365 onto the unified domain, and extending those benefits to app developers as well.

More information

Follow us on X (Twitter) / @Microsoft365Dev and subscribe to our YouTube channel to stay up to date on the latest developer news and announcements.


Discussion is closed. Login to edit/delete existing comments.

  • A W 0

    what does ‘CTAs not complete’ mean here ?

    do we need to change teams manifest file too ?

    • Chris YanasakMicrosoft employee 1

      The 2 CTAs being referenced are just above in the post:

      1. Upgrade Teams JS library to version 2.19 or higher.
      2. Update your x-frame-options/CSP headers to allow for the new domains. To ensure the app keeps working across existing and future Microsoft 365 hosts, please ensure to allow “*”.”

      So “CTAs not complete” means the app developer has not performed those two actions in order to be ready for this domain change.

      • A W 0

        do we need to add * as valid domain in manifest.json ?

        "validDomains": [

        just realize “CTAs ” mean Calls to Action 🙂

        • Chris YanasakMicrosoft employee 0

          No, you don’t need to make any changes to your manifest.

  • Jie Han 0

    Any action items for Teams app built not with JS library but legacy Python SDK?

    • Chris YanasakMicrosoft employee 0

      Hi Jie. Not sure what you’re referencing with “legacy Python SDK” as we don’t have a “python SDK” – but if you mean Teams JS v1, then in addition to the above noted CTAs you will need to update to Teams JS v2 as we will not be supporting the new domains on v1.

  • Janit Giri 0

    With this new migration , I have a question for simple tab apps built on react for teams , our app is launched directly from the URL we have given in the manifest json file , so where do we put the CSP headers , or , are they at all required for such use cases similar to ours ?

  • Takeuchi Yuuki 0

    I am developing a Teams app using the TeamsFx library with .net core blazor app. I have updated the TeamsFx library to the latest version, but it internally loads Teams.js version 2.17, and I do not know how to update it ourselves.

    TeamsFx Lib

    • John MillerMicrosoft employee 0

      We will update the dependency for this in TeamsFx during the next pre-release version coming soon.

  • Matt Hutton 0

    We have a pretty generic content security policy and don’t use the Teams JS library, but we have recieved multiple emails on this.

    I am wondering what we need to do?

Feedback usabilla icon