AdaptiveCard with "mailto" Action.OpenUrl no longer works

Question

On Microsoft Teams, we have a bot that sends AdaptiveCard message activities to users through the Microsoft Bot Framework REST API. Sometimes, the AdaptiveCard contains an Action.OpenUrl. With regular links such as https://google.com it works as expected, but since about one month, URL parameters with a mailto url such as mailto:[email protected] no longer work: the message is sent, the button appears but clicking it does not do anything.

Sample request:

POST https://smba.trafficmanager.net/emea/v3/conversations/<conversation_id>/activities

Body:

  "recipient": {
    "id": "29:1uuzUvFTkcseXZ1Q2wOva1inGkpH1SqbHwqdXjG8MhUa8mkFsdUnvrgn4FnPbX8CwBl_GwDHSQGIlRSPKczwUFg"
  },
  "type": "message",
  "attachments": [
    {
      "contentType": "application/vnd.microsoft.card.adaptive",
      "content": {
        "type": "AdaptiveCard",
        "version": "1.0",
        "body": [
          {
            "type": "ActionSet",
            "actions": [
              {
                "type": "Action.OpenUrl",
                "url": "mailto:[email protected]",
                "title": "TEST"
              }
            ]
          }
        ],
        "actions": []
      }
    }
  ]
}

Answer 1

Currently openSafeUrlMT does not allow mailto urls. we already have a backlog feature request on this. Concern team is working on this.