A Russian military court handed life sentences to four gunmen and 11 accomplices. Four other defendants were given between 19 and 22 years, state media reported.
Gunmen opened fire at Crocus City Concert Hall on the outskirts of Russia's capital on 22 March 2024 and set fire to the venue.
An Islamic State group affiliate admitted it had carried out the attack and posted video evidence. Moscow has repeatedly alleged Ukrainian involvement, which Kyiv has strenuously denied.
Some 6,000 people had been at the auditorium in Krasnogorsk for a rock concert on the evening of the attack when gunmen burst into the complex and started shooting randomly.
The attackers then set fires which engulfed the venue and caused the roof to collapse. Many of the victims died from bullet wounds and some from smoke inhalation.
The four men convicted of carrying out the shooting are all citizens of Tajikistan, according to Russia's state news agency Tass.It is not clear how the defendants pleaded or whether they will appeal.
The trial has been conducted behind closed doors and there are likely to have been confessions made under duress.
When the men first appeared in court two years ago, they showed visible signs of having been beaten and one was brought into court in a wheelchair.
IS-K, the group which admitted the attack, is an offshoot of IS which seeks to establish a Muslim caliphate across Afghanistan, Pakistan, Turkmenistan, Tajikistan, Uzbekistan and Iran.
Graphic video released by IS, showing attackers firing on the crowd inside the concert hall, was verified as genuine by the BBC.
Russian officials have continued to claim that Ukraine was linked to the attack - the neighbour Russia has been at war with since it launched a full-scale invasion in 2022. No evidence has been provided for the claims.
President Volodymyr Zelensky previously said it was "absolutely predictable" that Russian President Vladimir Putin would blame it on Ukraine.