🚨 Microsoft Teams Error: 'is not present in the manifest's validDomains' — Cause, Fix, and Troubleshooting Guide

What this error means

Teams renders tab content, configuration pages, and auth redirects inside a controlled webview. Any navigation to a host that is not covered by the manifest validDomains array is blocked. The tab shows a blank or “we couldn’t load this” page, and the runtime/validation surfaces a message naming the offending host.

The domain '<host>' is not present in the manifest's validDomains array.

What users report

• A configured tab loads blank, spins forever, or shows a generic “couldn’t load” page while the URL itself works fine in a normal browser.
• Tab configuration saves, but the content page never appears after install.
• SSO or third-party auth redirects dead-end inside the Teams webview instead of returning to your app.
• The app worked when the content was served from one host but breaks after moving to a new subdomain or CDN.
• Validation or the Developer Portal flags a contentUrl/configurationUrl host that is absent from validDomains.

Tenant and app configuration causes

• Missing host — a contentUrl, configurationUrl, or auth redirect points at a host you never listed in validDomains.
• Wildcard misuse — *.example.com matches subdomains only; it does not match the apex example.com. You must list the apex separately if you use it.
• Over-broad or disallowed wildcards — entries like *.microsoft.com or *.azurewebsites.net are too broad, cover domains you don’t own, and are rejected by validation.
• Scheme/port mismatch — Teams tab content must be HTTPS; entries should be bare hosts. Including https://, a path, or a port makes the entry fail to match.
• Redirect chains — an auth flow bounces through an identity provider host that also has to be present or reachable; only the final in-webview host needs to be in validDomains, but intermediate in-frame hosts do.
• Copy/paste from another environment — dev/staging hosts left in the array while prod hosts are missing.

Confirming tenant configuration

Validate the manifest and inspect exactly which hosts your URLs use versus what is declared.

# Validate the manifest against the declared schema
teamsapp validate --manifest-path ./appPackage/manifest.json

# Pull every URL the manifest navigates to
jq '.staticTabs[]?, .configurableTabs[]? | {contentUrl, configurationUrl}' manifest.json

# Compare against the declared validDomains list
jq '.validDomains' manifest.json

Extract just the hostnames from your URLs so you can eyeball the gap:

jq -r '.. | .contentUrl? // .configurationUrl? // empty' manifest.json \
  | sed -E 's#https?://([^/]+).*#\1#' | sort -u

Any host printed here that is not covered by an exact or wildcard entry in validDomains is a blocked navigation.

Resolution

List every content, configuration, and in-webview auth host explicitly. Use bare hostnames, HTTPS-served content, and remember that a wildcard covers subdomains but not the apex:

{
  "validDomains": [
    "app.contoso.com",
    "*.tabs.contoso.com",
    "contoso.com"
  ]
}

If your content lives at https://app.contoso.com/tab and your config page at https://app.contoso.com/config, a single app.contoso.com entry covers both. If you later add https://reports.tabs.contoso.com, the *.tabs.contoso.com wildcard picks it up, but a page served from the apex contoso.com still needs its own entry.

Do not add domains you do not own or control. Listing *.microsoft.com, *.azurewebsites.net, or your identity provider’s login domain is both rejected by validation and a security smell — those redirect targets are handled outside the tab webview and do not belong in validDomains. Remove any leftover https:// prefixes, paths, or ports from entries.

After editing, repackage and re-upload the app so the updated manifest takes effect, then reload the tab.

Avoiding tenant drift

• Apex vs subdomain — *.contoso.com will not save you if you also serve from contoso.com; add both.
• Ports and paths silently fail — an entry like app.contoso.com:8443 or app.contoso.com/tab won’t match; use the bare host.
• HTTP is a non-starter — tab content served over HTTP is blocked regardless of validDomains; serve over HTTPS.
• Changing your CDN or host — any migration to a new subdomain is a manifest change; ship a new package version.
• Wildcards can’t be nested at the top level — a single * label; *.*.contoso.com is not a valid entry.
• Cached installs — after updating the manifest, existing installs may need the app updated/reinstalled to pick up the new domain list.

Related tenant errors

• Manifest Validation Failed
• Adaptive Card Render Failure
• 403 Authorization_RequestDenied