In Bot Framework - Getting HTTP Status Code Forbidden in Web Chat

Question

I have created a bot in botframework and configured Teams channel with it but while testing, we are getting no response with error as "There was an error sending this message to your bot: HTTP status code Forbidden" inside webchat logs.

I have seen some other similar questions regarding the botframework issues.
I am concerned regarding following options:

1. if it is mandatory to use "MultiTenant" support type? Because right now I am using "SingleTenant"
   My reference for that is this documentation
   https://learn.microsoft.com/en-us/azure/bot-service/bot-service-quickstart-registration?view=azure-bot-service-4.0#manual-app-registration
2. Is it mandatory to allow-list of following URLs in that firewall?
   login.botframework.com (Bot authentication)
   login.microsoftonline.com (Bot authentication)
   westus.api.cognitive.microsoft.com (for Luis.ai NLP integration)
   *.botframework.com (channels)
   state.botframework.com (backward compatibility)
   login.windows.net (Windows login)
   login.windows.com (Windows login)
   sts.windows.net (Windows login)
   reference official doc : https://learn.microsoft.com/en-us/azure/bot-service/bot-service-resources-faq-security?view=azure-bot-service-4.0#which-specific-urls-do-i-need-to-allow-list-in-my-corporate-firewall-to-access-bot-framework-services

And if we need to change the support type to "Multitenant", I need some reasoning for that

1. why we need "Multitenant" if we are working in the single tenant network?
2. why there's option of "Singletenant" if "Multitenant" is mandatory?

because IT team is not allowing this option and concerned about security.
Kindly tell if there would be some other possibilities for the issues.

Answer 1

@Gaurav Chayal The reason for using multi-tenant is because

“A bot’s App Registration is multi-tenant due to the architecture of the Bot Service so that a token can be generated that points to api.botframework.com resource (which is hosted on the botframework tenant). botframework.com is a single-tenant resource so in order for us to grant access to the bot service’s connector resources, we create the token against the bot's app registration (hence the need for the multi-tenant registration). This app registration should only be used for this service-to-service bot authentication pattern. It should have no access to other claims, etc. If you need the app registration to have access to other resources, you should create a separate app registration to use.”

So the registration and access to the URLs are required to ensure the bot works as expected.

Answer 2

@romungi-MSFT
Thanks, for the reply but still the explanation is not clear.

In the above screenshot it is clearly mentioned that use "SingleTenant" if the target audience is internal to organization.
and use "Multitenant" if target audience are multiple organization(like schools or businesses)
So, It is obvious to choose options according to tenants.

Then, Why "SingleTenant" option is available if "MultiTenant" is mandatory to use?
Also can't find any official documentation for strictly using Multitenant while configuring Teams Channel with Bot in BotFramework .
Security Team needs proper proof and documentation for making registration as Multitenant.

Answer 3

Hi @romungi-MSFT , hope you are doing well.
We need your help again.

So now, we are stuck in proceeding further for Teams Adapter.
Our IT team have turned support type app. into Multitenant and there are no outbound traffic blocking for URL Access.
We were concerned about those two requirements and now they are fulfilled but still the issue is same.
We are getting error as "There was an error sending this message to your bot : HTTP status code Forbidden".

I have checked the required URL in the browser, they are accessible.
Is any other way to check if the URL Access are working fine?
Please guide for the next step we can check and what are the other possibilities for this issue.