Single Tenant Teams Bot (Dev Portal only) gets 401 Unauthorized on Outbound Messages

Question

Body:

Hi Microsoft Teams Developer Support,

I am developing a Single Tenant bot registered via the Teams Developer Portal (dev.teams.microsoft.com).

My bot successfully receives messages (via ngrok webhook), but fails to send any outbound messages (replies or proactive).

What I have tried:

1. Bot Framework SDK (Python):
   • Receiving messages works perfectly (I see the incoming JSON).
   • Sending replies (turn_context.send_activity) fails with 401 Unauthorized.
   • Sending proactive messages (connector.conversations.send_to_conversation) fails with 401 Unauthorized.
   • Verified: App ID/Secret are correct (Token acquisition works), Service URL is trusted, Tenant ID is correct.
2. Microsoft Graph API Workaround:
   • I tried bypassing the SDK by using POST /chats/{id}/messages (using the Chat ID found via GET /users/{id}/chats).
   • This fails with 403 Forbidden (RosterCreationNotAllowed / Missing role permissions). My App has Chat.ReadWrite.All.

My Question:

Is it possible for a bot registered only in the Developer Portal (without an Azure Bot resource) to send outbound messages in a real Teams environment?

If yes, what configuration authorizes my App ID to talk to smba.trafficmanager.net?

If no, is there any alternative for developers restricted from creating Azure resources?

Error Details:

POST https://smba.trafficmanager.net/apis/v3/conversations/.../activities

Status: 401 Unauthorized

Body: {"message":"Authorization has been denied for this request."}

Thank you.

Answer 1

If the bot was created only in Developer Portal, Microsoft notes that “if you created your bot through the Bot Framework or Developer Portal, your bot isn't registered in Azure”, and outbound replies/proactive messages have to go back through the Connector using the incoming activity’s serviceUrl as “the base URI for any subsequent requests” (Teams is typically https://smba.trafficmanager.net/teams/), so you’ll hit 401 until the bot is registered

To send outbound messages, you need an “Azure Bot resource registration” that “registers your web service as a bot with the Bot Framework” (Azure Bot or Bot Channels Registration) using the same Entra App ID/secret

This doesn’t mean you have to host in Azure, since “your bot code doesn't need to be hosted on Microsoft Azure” and you can “enter in Azure the web address where your bot is hosted” (ngrok/local for dev is fine)

Answer 2

It appears that a bot registered only in the Teams Developer Portal may face limitations when it comes to sending outbound messages in a real Teams environment. The 401 Unauthorized error indicates that there may be issues with the bot's authentication or permissions when trying to communicate with the Teams service.

To successfully send outbound messages, the bot needs to be properly authenticated and authorized. Here are some steps you can take:

1. Ensure Bot Registration: Verify that your bot is registered correctly in the Teams Developer Portal and that the App ID and Secret are accurate.
2. Service URL Trust: Make sure that the service URL is trusted by calling MicrosoftAppCredentials.TrustServiceUrl before sending messages.
3. Check Permissions: If you are using the Microsoft Graph API, ensure that your app has the necessary permissions assigned in Azure AD. For sending messages, permissions like Chat.ReadWrite.All are required, but you may also need to check if your app has the correct roles assigned.
4. Consider Azure Bot Service: If possible, consider creating an Azure Bot resource, as this may provide additional capabilities and permissions that are not available through the Developer Portal alone.

If you are restricted from creating Azure resources, you may need to explore other options or workarounds, but the Developer Portal alone may not suffice for sending outbound messages in a production environment.

---

References:

• Status codes from bot conversational APIs
• Bot Framework Security and Privacy Frequently Asked Questions

Answer 3

Hi @Tom Carmi 

Thank you for posting your question in the Microsoft Q&A forum. 

A bot registered only in the Microsoft Teams Developer Portal cannot send outbound messages in a real Microsoft Teams tenant. The Developer Portal registration is intended for design-time configuration only and does not create a bot identity in the Bot Framework Service, establish trust with smba.trafficmanager.net, or authorize outbound message transport. As a result, all outbound message attempts will consistently fail with HTTP 401 Unauthorized, regardless of the SDK, programming language, or API permissions used.  

To send outbound messages through https://smba.trafficmanager.net, the bot must be backed by an Azure Bot resource such as Bot Channels Registration or Azure Bot that is linked to the same Microsoft Entra App ID. This Azure resource registers the App ID in the Bot Framework Service, enables outbound messaging, issues valid Bot Connector tokens, and authorizes calls to smba.trafficmanager.net. Without this resource, outbound messaging is not supported in real tenants or production environments. 

Unfortunately, there is no supported alternative for sending outbound messages via smba.trafficmanager.net without Azure Bot registration.

The available options are: 

-Ask your IT admin to register the Azure Bot resource in the tenant. This does not require hosting in Azure, you can still run locally with ngrok. The registration is only for identity and channel configuration.

-Or use the Microsoft 365 Developer Program sandbox, which provides a free Microsoft 365 tenant and linked Azure subscription. However, this is for development and testing purposes only and does not provide access to your company’s real tenant. 

I hope this information is helpful. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.