Search code examples
azurebotframeworkmicrosoft-teams

IP address restriction to Teams channel of Azure Bot Service

I am creating bots through Azure Portal Bot Service registration. Concerning Teams channel of an Azure Bot Service, I want to know is it possible to restrict access by IP address to the channel of a bot service through a setting on Azure Portal?

I have read about Conditional Access Location Policies, however this seems applied to the scope of Azure Active Directory and I am not sure where that plays a role in the scope of a bot service. If Conditional Access Location Policies are relevant to my issue, further information on how it works in relation to bot services would be appreciated.

Edit:

I included the helpful image from this article. https://hilton.giesenow.com/how-bot-calls-actually-work

For a bot which can be either public or private, I want to apply some form of restriction or authentication at step #2 of the image i.e. from Microsoft Bot Framework Services on Azure Portal.

enter image description here

Solution

  • All (running) bots are public accessible.

    • You cannot prevent Teams from sending you messages from any tenant,
    • nor you can prevent someone from installing your bot if they have your app manifest.
    • you can even @ mention a bot withouth installing it

    so you as a developer must prevent your bot from processing the undesired messages.

    You have two different options for restricting incoming messages that your bot processes.

    1. If you are dealing with secure data, it is definitely recommended to use OAuth to authenticate the users.

    2. Using middleware to filter (to allow only your subscribed customers) is another good option. For example, in the case of the Teams channel, add the TeamsTenantFilteringMiddleware class to your bot, and wire it up in your startup method.
      See these examples:

    So for tenant filtering that would look something like:

                if (!this.tenantMap.Contains(tenantId))
            {
                throw new UnauthorizedAccessException("Tenant Id '" + tenantId + "' is not allowed access.");
            }