Replace CloudEnvironment with MSAL-aligned Instance property for sovereign cloud support

Libraries/Microsoft.Teams.Api/Auth/ClientCredentials.cs

@@ -10,7 +10,12 @@ public class ClientCredentials : IHttpCredentials
     public string ClientId { get; set; }
     public string ClientSecret { get; set; }
     public string? TenantId { get; set; }
-    public CloudEnvironment Cloud { get; set; } = CloudEnvironment.Public;
+
+    /// <summary>
+    /// The Entra ID login endpoint, following the Microsoft Identity Web configuration schema.
+    /// Override this for sovereign clouds (e.g. "https://login.microsoftonline.us" for US Gov).
+    /// </summary>
+    public string Instance { get; set; } = "https://login.microsoftonline.com";
 
     public ClientCredentials(string clientId, string clientSecret)
     {
@@ -27,9 +32,10 @@ public ClientCredentials(string clientId, string clientSecret, string? tenantId)
 
     public async Task<ITokenResponse> Resolve(IHttpClient client, string[] scopes, CancellationToken cancellationToken = default)
     {
-        var tenantId = TenantId ?? Cloud.LoginTenant;
+        var tenantId = TenantId ?? "botframework.com";
+        var instance = Instance.TrimEnd('/');
         var request = HttpRequest.Post(
-            $"{Cloud.LoginEndpoint}/{tenantId}/oauth2/v2.0/token"
+            $"{instance}/{tenantId}/oauth2/v2.0/token"
         );
 
         request.Headers.Add("Content-Type", ["application/x-www-form-urlencoded"]);

Libraries/Microsoft.Teams.Api/Clients/BotSignInClient.cs

@@ -7,8 +7,6 @@ namespace Microsoft.Teams.Api.Clients;
 
 public class BotSignInClient : Client
 {
-    public string TokenServiceUrl { get; set; } = "https://token.botframework.com";
-
     public BotSignInClient() : base()
     {
 
@@ -33,7 +31,7 @@ public async Task<string> GetUrlAsync(GetUrlRequest request)
     {
         var query = QueryString.Serialize(request);
         var req = HttpRequest.Get(
-            $"{TokenServiceUrl}/api/botsignin/GetSignInUrl?{query}"
+            $"https://token.botframework.com/api/botsignin/GetSignInUrl?{query}"
         );
 
         var res = await _http.SendAsync(req, _cancellationToken);
@@ -44,7 +42,7 @@ public async Task<string> GetUrlAsync(GetUrlRequest request)
     {
         var query = QueryString.Serialize(request);
         var req = HttpRequest.Get(
-            $"{TokenServiceUrl}/api/botsignin/GetSignInResource?{query}"
+            $"https://token.botframework.com/api/botsignin/GetSignInResource?{query}"
         );
 
         var res = await _http.SendAsync<SignIn.UrlResponse>(req, _cancellationToken);

Libraries/Microsoft.Teams.Api/Clients/BotTokenClient.cs

@@ -7,9 +7,8 @@ namespace Microsoft.Teams.Api.Clients;
 
 public class BotTokenClient : Client
 {
-    public static readonly string DefaultBotScope = "https://api.botframework.com/.default";
+    public static readonly string BotScope = "https://api.botframework.com/.default";
     public static readonly string GraphScope = "https://graph.microsoft.com/.default";
-    public string BotScope { get; set; } = DefaultBotScope;
 
     public BotTokenClient() : this(default)
     {

Libraries/Microsoft.Teams.Api/Clients/UserTokenClient.cs

@@ -10,8 +10,6 @@ namespace Microsoft.Teams.Api.Clients;
 
 public class UserTokenClient : Client
 {
-    public string TokenServiceUrl { get; set; } = "https://token.botframework.com";
-
     private readonly JsonSerializerOptions _jsonSerializerOptions = new()
     {
         DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
@@ -40,31 +38,31 @@ public UserTokenClient(IHttpClientFactory factory, CancellationToken cancellatio
     public async Task<Token.Response> GetAsync(GetTokenRequest request)
     {
         var query = QueryString.Serialize(request);
-        var req = HttpRequest.Get($"{TokenServiceUrl}/api/usertoken/GetToken?{query}");
+        var req = HttpRequest.Get($"https://token.botframework.com/api/usertoken/GetToken?{query}");
         var res = await _http.SendAsync<Token.Response>(req, _cancellationToken);
         return res.Body;
     }
 
     public async Task<IDictionary<string, Token.Response>> GetAadAsync(GetAadTokenRequest request)
     {
         var query = QueryString.Serialize(request);
-        var req = HttpRequest.Post($"{TokenServiceUrl}/api/usertoken/GetAadTokens?{query}", body: request);
+        var req = HttpRequest.Post($"https://token.botframework.com/api/usertoken/GetAadTokens?{query}", body: request);
         var res = await _http.SendAsync<IDictionary<string, Token.Response>>(req, _cancellationToken);
         return res.Body;
     }
 
     public async Task<IList<Token.Status>> GetStatusAsync(GetTokenStatusRequest request)
     {
         var query = QueryString.Serialize(request);
-        var req = HttpRequest.Get($"{TokenServiceUrl}/api/usertoken/GetTokenStatus?{query}");
+        var req = HttpRequest.Get($"https://token.botframework.com/api/usertoken/GetTokenStatus?{query}");
         var res = await _http.SendAsync<IList<Token.Status>>(req, _cancellationToken);
         return res.Body;
     }
 
     public async Task SignOutAsync(SignOutRequest request)
     {
         var query = QueryString.Serialize(request);
-        var req = HttpRequest.Delete($"{TokenServiceUrl}/api/usertoken/SignOut?{query}");
+        var req = HttpRequest.Delete($"https://token.botframework.com/api/usertoken/SignOut?{query}");
         await _http.SendAsync(req, _cancellationToken);
     }
 
@@ -81,7 +79,7 @@ public async Task SignOutAsync(SignOutRequest request)
         // This is required for the Bot Framework Token Service to process the request correctly.
         var body = JsonSerializer.Serialize(request.GetBody(), _jsonSerializerOptions);
 
-        var req = HttpRequest.Post($"{TokenServiceUrl}/api/usertoken/exchange?{query}", body);
+        var req = HttpRequest.Post($"https://token.botframework.com/api/usertoken/exchange?{query}", body);
         req.Headers.Add("Content-Type", new List<string>() { "application/json" });
 
         var res = await _http.SendAsync<Token.Response>(req, _cancellationToken);

Libraries/Microsoft.Teams.Apps/App.cs

@@ -51,8 +51,6 @@ internal string UserAgent
 
     public App(AppOptions? options = null)
     {
-        var cloud = options?.Cloud ?? CloudEnvironment.Public;
-
         Logger = options?.Logger ?? new ConsoleLogger();
         Storage = options?.Storage ?? new LocalStorage<object>();
         Credentials = options?.Credentials;
@@ -79,7 +77,7 @@ public App(AppOptions? options = null)
 
                 if (Token.IsExpired)
                 {
-                    var res = Credentials.Resolve(TokenClient, [.. Token.Scopes.DefaultIfEmpty(cloud.BotScope)])
+                    var res = Credentials.Resolve(TokenClient, [.. Token.Scopes.DefaultIfEmpty(BotTokenClient.BotScope)])
                     .ConfigureAwait(false)
                     .GetAwaiter()
                     .GetResult();
@@ -92,9 +90,6 @@ public App(AppOptions? options = null)
         };
 
         Api = new ApiClient("https://smba.trafficmanager.net/teams/", Client);
-        Api.Bots.Token.BotScope = cloud.BotScope;
-        Api.Bots.SignIn.TokenServiceUrl = cloud.TokenServiceUrl;
-        Api.Users.Token.TokenServiceUrl = cloud.TokenServiceUrl;
         Container = new Container();
         Container.Register(Logger);
         Container.Register(Storage);

Libraries/Microsoft.Teams.Apps/AppOptions.cs

@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
-using Microsoft.Teams.Api.Auth;
 using Microsoft.Teams.Apps.Plugins;
 
 namespace Microsoft.Teams.Apps;
@@ -16,7 +15,6 @@ public class AppOptions
     public Common.Http.IHttpCredentials? Credentials { get; set; }
     public IList<IPlugin> Plugins { get; set; } = [];
     public OAuthSettings OAuth { get; set; } = new OAuthSettings();
-    public CloudEnvironment? Cloud { get; set; }
 
     public AppOptions()
     {