Is the command bot endpoint safe?

Question

Hello,

I have deployed the Teams command bot to App Service following this instruction and added the bot to the channels of my organization.

Build command bot with JavaScript - Teams | Microsoft Learn

Is the command bot endpoint safe from malicious third parties? Could a malicious third party call the endpoint of the bot? How can I lock up the bot so that only Microsoft Team service(?) can call the bot endpoint?

Answer 1

The command bot endpoint seems to be safe from malicious third parties. However, anyone can call the endpoint of the bot if they have access to it.
You can implement bot authentication if you want users of your organization or tenant to have access to it. https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/authentication/add-authentication?tabs=dotnet%2Cdotnet-sample

Please refer this and let us know if it helps: https://learn.microsoft.com/en-us/azure/bot-service/dl-network-isolation-concept?view=azure-bot-service-4.0#example-scenario

Thanks, 
Prasad Das

************************************************************************* 

If the response is helpful, please click "Accept Answer" and upvote it. You can share your feedback via Microsoft Teams Developer Feedback link.