Fix Teams Bot Does Not Respond for a Guest User

When a guest user sends a message to a bot in Microsoft Teams, the bot may never reply. This issue occurs even though the same bot works for internal users. The root cause is usually a mismatch between the bot’s authentication settings and the guest user’s tenant context. This article explains why the bot fails and provides step-by-step fixes for both the Teams admin and the bot developer.

Guest users in Teams are external identities added to your tenant. They have limited access and often trigger different authentication flows. Bots that rely on Azure AD tokens sometimes reject these flows because the token audience or tenant ID does not match. The fixes below cover policy changes, app permission updates, and code-level adjustments.

Why a Teams Bot Ignores Guest Users

Bots in Teams are registered as Azure AD applications. When a user chats with a bot, Teams sends an activity to the bot’s endpoint. The bot then validates the user’s identity using the token in the request. For internal users, the token contains the home tenant ID. For guest users, the token may contain the guest tenant ID or a combined ID. If the bot’s code only accepts the home tenant, it silently rejects the guest request.

Another common cause is the app permission policy. Teams admins can restrict which apps are available to guest users. Even if the bot is installed in a channel, a guest may not have permission to interact with it. The bot appears unresponsive because the user’s message never reaches the bot endpoint.

Finally, the bot’s authentication flow may not support the implicit grant. Many Teams bots use Azure AD implicit flow to obtain tokens. If the app registration does not allow this flow, guest users who cannot complete the interactive login will see no response.

Guest Access and Tenant Context

When a guest user sends a message, the activity object contains a tenant.id field. This value may differ from the tenant where the bot is registered. The bot must compare this ID with its own tenant ID and respond accordingly. If the bot does not handle the mismatch, it simply drops the message.

Steps to Diagnose and Fix the Bot Non-Response

Follow these steps in order. Each step addresses a specific cause. You may need to perform all of them to fully resolve the issue.

1. Verify guest access is enabled in Teams
   Go to the Teams admin center at admin.teams.microsoft.com. Select Org-wide settings then Guest access. Confirm that Allow guest access in Microsoft Teams is turned on. If it is off, turn it on and save the change. Wait up to 24 hours for the change to propagate.
2. Check the app permission policy for guests
   In the Teams admin center, go to Messaging policies. Select the policy assigned to the guest user. Ensure that Private chat is enabled. Also check App permissions under Manage apps and confirm the bot app is allowed. If the app is blocked, allow it and save.
3. Review the Azure AD app registration
   Open the Azure portal and go to Azure Active Directory > App registrations. Find the app that represents your bot. Select Authentication. Under Implicit grant and hybrid flows, check both Access tokens and ID tokens. Save the changes.
4. Update the bot code to handle guest tenant IDs
   In your bot’s OnTurnAsync method, inspect the activity’s ChannelData or Conversation object. Look for the tenant.id property. If it does not match your bot’s tenant ID, do not throw an exception. Instead, respond with a message that acknowledges the guest user. This simple change prevents the bot from appearing dead.
5. Test with a guest account
   Create a test guest account in your tenant. Invite the guest to a team where the bot is installed. Send a message to the bot. Observe the bot’s response. If it still fails, check the bot’s logs for errors related to token validation or tenant mismatch.
6. Use the Bot Framework Emulator for local testing
   Run your bot locally and use the Bot Framework Emulator to send an activity with a guest tenant ID. This tool lets you simulate a guest request without needing a real guest account. If the bot responds in the emulator, the issue is likely in the Teams configuration, not the code.

Adjusting the Bot’s Authentication Code

If your bot uses the Bot Framework SDK, you can set the AllowedTenants property in your adapter or controller. This property accepts a list of tenant IDs that are allowed to access the bot. Add the guest tenant ID to this list. For example, in C# you might write:

options.AllowedTenants = new List<string> { "your-tenant-id", "guest-tenant-id" };

This approach tells the bot to accept tokens from the guest tenant. Without this, the bot rejects the token and remains silent.

If the Bot Still Does Not Respond

Guest User Cannot See the Bot in the Chat

If the guest cannot even find the bot, the app may not be installed in the guest’s personal scope. Ask the team owner to add the bot to the channel again. In the team, select the Apps icon, find the bot, and click Add. The bot will appear in the channel for all members, including guests.

Bot Responds Only to Internal Users

This symptom points to a code issue. The bot likely checks the user’s email domain or tenant ID and rejects external users. Review your authentication middleware. Remove any hard-coded domain checks. Use the AllowedTenants list instead, as shown above.

Guest Receives a “Bot is not available” Error

This error often appears when the bot’s endpoint is unreachable. Check the bot’s hosting service status. If the bot is hosted on Azure, verify that the app service is running. Also confirm that the messaging endpoint URL in the bot registration is correct and uses HTTPS.

New Teams Guest Bot Experience vs Internal User Experience: Key Differences

Item	Guest User	Internal User
Tenant ID in activity	Guest tenant or combined ID	Home tenant ID
Authentication flow	May require implicit flow	Standard OAuth flow
App permission policy	May be restricted by admin	Usually allowed by default
Bot response behavior	Silent if tenant mismatch	Responds normally

Understanding these differences helps you diagnose the issue faster. The table shows that the main variable is the tenant context and the authentication method.

After applying the fixes, test again with a guest account. The bot should now reply to guest messages. For advanced scenarios, consider using the TeamsInfo.getMember method to fetch guest profile details. This method helps you customize responses for guest users based on their external identity.