Bot Framework REST API returns "Authorisation has been denied for this request"

Question

I’m developing a multi-tenant Teams bot registered in Azure AD. The bot obtains an app-only access token via client_credentials from the botframework.com tenant:

POST https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token
scope = https://api.botframework.com/.default

The decoded JWT shows the correct aud (https://api.botframework.com) and the expected appid (our bot’s client ID).

Using that token, I call the Bot Connector REST endpoint to send a proactive Adaptive Card into a personal chat:

POST https://smba.trafficmanager.net/{region}/{tenantId}/v3/conversations/{conversationId}/activities
Authorization: Bearer <token>
Content-Type: application/json

Problem: Every POST returns HTTP 403 Forbidden with the plain-text error:

Authorization has been denied for this request.

No additional diagnostics are returned in the body or headers.

---

Troubleshooting done so far

1. Token validation
   • Claims (aud, iss, appid, exp) all match Microsoft’s docs.
   • Token lifetime and system clocks are in sync.
2. Request shape
   • Confirmed correct Authorization: Bearer … header (no custom header names).
   • Content-Type: application/json is set.
   • URL and conversationId are copied verbatim from the incoming Teams activity.
   • Tried minimal payload ({ "type":"message","text":"ping", … })—same 403.
3. Bot installation / permissions
   • Bot is installed in the user’s personal scope; user can send messages to the bot.
   • App registration is multi-tenant; API permissions for Microsoft Graph and Bot Framework are granted and admin-consented.

The weird part is, this was working fine till yesterday. I've been following the same flow for more than a year now and it hasn't caused a problem. Suddenly I'm getting this "Authorisation has been denied to this request" error responses. Any assistance would be appreciated.

Answer 1

Hi Nithish, 

Thanks for reaching out to the Microsoft Q&A forum. 

I understand how frustrating and disruptive it can be when a workflow that has been functioning smoothly for a year suddenly encounters the "Authorization has been denied to this request" error. I'm here to assist you in resolving this issue. 

To better understand and address the problem, could you please provide the following information: 

1. Can you confirm that the authentication token you're using is valid and hasn't expired? 
2. Are there any Conditional Access policies or other tenant-level restrictions that might be preventing the request? 
3. Has the service principal associated with your app registration been assigned the necessary roles within the target tenant? 
4. Could you share the full body of the API request you're using for the multi-tenant Teams bot? This will help in pinpointing any potential issues. 

If you have any updates or additional information, please don't hesitate to share. Your feedback is invaluable in helping me find the best solution for you. 

Thank you for your understanding and patience as we work through this together!