"Authorization has been denied for this request" - Bot Framework REST API returns this error despite a successful access token retreival

The error message "Authorization has been denied for this request" typically indicates that there is an issue with the token being used for authentication. Since you mentioned that the access token retrieval is successful and the tokens match except for the tenant ID (tid), this suggests that the token may not be valid for the tenant you are trying to send the proactive message to.

Here are some points to consider:

1. Tenant ID Mismatch: The tid in the access token must match the tenant ID of the Microsoft Teams environment you are trying to access. If the tid does not match, the authorization will fail even if the token is valid for another tenant.
2. Single-Tenant vs Multi-Tenant: You mentioned switching to a single-tenant model. If your bot is registered as single-tenant, it will only work with users from the same tenant. Ensure that the bot's app registration is correctly configured for the tenant you are targeting.
3. Proactive Messaging Requirements: When sending proactive messages, ensure that you are using the correct service URL and that you have called MicrosoftAppCredentials.TrustServiceUrl before sending the message. This is crucial for authorization to succeed.
4. Documentation Updates: As for the deprecation of multi-tenant bot creation, it is advisable to follow the latest guidelines provided in the documentation. If you are using a multi-tenant setup, consider migrating to a single-tenant model as recommended.
5. Common Issues: Since multiple users are facing the same issue, it could be beneficial to check if there are any known service issues or bugs affecting the Bot Framework in the specific tenant.

If the problem persists, you may want to review the authentication flow and ensure that all configurations are set correctly according to the latest documentation.

Hi Nithish

Thank you for reaching out to Microsoft Q&A forum

Based on your description, I understand you can successfully obtain access tokens (both from botframework.com and a tenant‑specific authority), but posting proactive messages to the Bot Framework Connector for Microsoft Teams fails with “Authorization has been denied for this request.” And now you want clarity on

1. Whether the deprecation of multi‑tenant bot creation also applies to bots created in the Teams Developer Portal
2. Whether a service bug is preventing some tenants from using proactive messaging.

Regarding your first question: Does this also apply to bots created in the Developer Portal?

Based on my research, the answer is YES, the deprecation covers new multi‑tenant bot creation across Azure Bot Service, including flows initiated from the Teams Developer Portal/Teams Toolkit. After 2025‑07‑31, attempts to create a multi‑tenant bot in those experiences return the explicit 400 error: “Multitenant bot creation is deprecated. Please use SingleTenant or UserAssignedMSI.”

So, in this situation, you should register new bots as Single‑Tenant (or User‑Assigned Managed Identity) and then distribute cross‑tenant by publishing your Teams app to AppSource/Teams Store. Other tenants can install and use the app even though the bot identity is single‑tenant, however, service‑to‑service auth for the Bot Connector must come from your bot’s home tenant authority.

You can read here for more information:

https://github.com/OfficeDev/microsoft-365-agents-toolkit/issues/14385

https://github.com/microsoft/Agents/issues/216

https://learn.microsoft.com/en-us/azure/bot-service/bot-service-quickstart-registration?view=azure-bot-service-4.0&tabs=multitenant#supported-app-types

Regarding your second question: Is there a bug preventing some tenants from using the service?

From my perspective view, there is no documented, tenant‑wide service bug affecting proactive messaging in Microsoft Teams. The recurring 401/403 “Authorization has been denied” responses are typically caused by configuration and authentication issues, including acquiring the Bot Connector token from the wrong authority for single‑tenant bots (use your home‑tenant endpoint with scope https://api.botframework.com/.default), failing to trust the current serviceUrl from the latest conversation reference before sending, and app availability controls as states in this document

Hope my answer will help you, for any further concern, kindly let me know in the comment section.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.