I'm having trouble retrieving user data in Microsoft Teams using the TeamsInfo.getMember method from BotBuilder. The request returns an "Unauthorized" error.

Question

Hello,

I developed a chatbot using BotBuilder, and at one stage of the flow, I implemented a module responsible for collecting user data.

import { TeamsInfo, TurnContext } from "botbuilder";
import { UserValidator } from "./validateUser.js";
import { userStateInfo } from "../../dto/interfaceInfoUserState.js";
export class UserService {
    static async getValidateUser(context: TurnContext): Promise<userStateInfo> {
        const member = await TeamsInfo.getMember(context, context.activity.from.id);
        const user = UserValidator.validate(member);
            
        return user;
    }
}

Previously, I was using this same method within the Azure Bot Service, which allowed me to specify whether the bot was multi-tenant or single-tenant, without requiring any additional permission configurations or further setup.

However, after Microsoft’s recent update, I started encountering the following errors:

[onTurnError] unhandled error: UserDataError: Error invalid user: RestError: Authorization has been denied for this request.
RestError: Authorization has been denied for this request. 
 {
  "name": "RestError",
  "statusCode": 401,
  "details": {
    "message": "Authorization has been denied for this request."
  },

The errors are occurring precisely at the step where I retrieve the user's information. At this point in the flow, I have a piece of code that handles authentication using BotBuilder, and the authentication itself completes successfully.

import {
    CloudAdapter,
    ConfigurationServiceClientCredentialFactory,
    createBotFrameworkAuthenticationFromConfiguration
} from 'botbuilder';
import { env } from '../env.js'

const credentialsFactory = new ConfigurationServiceClientCredentialFactory({
    MicrosoftAppId: env.MicrosoftAppId,
    MicrosoftAppPassword: env.MicrosoftAppPassword,
    MicrosoftAppType: "MultiTenant"
});

const botFrameworkAuthentication = createBotFrameworkAuthenticationFromConfiguration(null, credentialsFactory);

const adapter = new CloudAdapter(botFrameworkAuthentication);
const streamingAdapter = new CloudAdapter(botFrameworkAuthentication)

const onTurnErrorHandler = async (context, error) => {
    console.error(`\n [onTurnError] unhandled error: ${ error }`);

    await context.sendTraceActivity(
        'OnTurnError Trace',
        `${ error }`,
        'https://www.botframework.com/schemas/error',
        'TurnError'
    );

    await context.sendActivity('The bot encountered an error or bug.');
    await context.sendActivity('To continue to run this bot, please fix the bot source code.');
};

adapter.onTurnError = onTurnErrorHandler;
streamingAdapter.onTurnError = onTurnErrorHandler;

export { adapter, streamingAdapter };

Is it possible that I'm missing a configuration step?

Here's what I’ve done so far:

Created the Azure Bot Service.

Set up the communication channels with Microsoft Teams.

In Azure Entra ID, I assigned the required permissions (as shown in the attached image) and generated the client secret to use in the source code.

In the Microsoft Teams Developer Portal, I configured the bot application using the service’s App ID.

Could you please let me know if there’s anything else I need to configure? I’m wondering if I may be missing a crucial step.

Answer 1

Mateus Epifanio Linhares hi,

your code and setup look correct, which means the issue is almost certainly with the api permissions for your azure ad app registration.

the TeamsInfo.getMember call requires a specific permission that might have been reset or changed during the recent microsoft update. your bot needs the User.Read.All application permission to read user profiles in teams.

go to the azure portal and find the app registration for your bot. under 'manage', go to 'api permissions'.

check if the User.Read.All permission from microsoft graph is present. it must be an application permission, not a delegated permission.

if it is not there, you need to add it. click 'add a permission', select 'microsoft graph', then 'application permissions', and find User.Read.All in the 'user' section. add it.

after adding the permission, you must grant admin consent for it. there will be a button for this next to the permission. without admin consent, the permission is not active.

once the permission is granted, wait a few minutes for the change to propagate, and then test your bot again. the 401 unauthorized error should be resolved.

try to verify your bot's app registration has the User.Read.All application permission from microsoft graph and that admin consent has been granted.

regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/