Azure AI Bot Service (Teams channel): New single-tenant bot gets random 401/403 "Failed to decrypt conversation id" on replies

Yogendra Jaiswal 0 Reputation points
2026-10-19T17:34:12.4466667+00:00

Service: Azure AI Bot Service, Microsoft Teams channel, Bot Connector REST API (smba.trafficmanager.net).

Scenario: We created a new single-tenant Azure Bot for a 1:1 (personal scope) Teams bot. The same valid token and the same request get different answers from the Teams service from one call to the next, so the bot only works sometimes.

Environment

  • Azure Bot rolai_routing, app ID 9c0a3687-49e9-4a54-8377-18c1b4ac05ca, bot type Single Tenant, F0, global. App registration created 2026-10-19 08:59 UTC.
  • App registration: signInAudience AzureADMyOrg, enabled service principal in the same tenant as the bot resource.
  • Channels: Microsoft Teams (enabled, commercial, terms accepted), Web Chat, Direct Line, all provisioning state Succeeded.
  • Teams app package: botId = the app ID above, scope personal, installed by a user in the bot's own tenant.
  • Messaging endpoint: HTTPS (ngrok) endpoint that validates the inbound Bot Framework JWT. Service URL on activities: https://smba.trafficmanager.net/in/<tenant-id>/.

Steps to reproduce

  1. Get a client-credentials token from https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token, scope https://api.botframework.com/.default. The token decodes to aud https://api.botframework.com, appid = the app ID, tid = the bot tenant.
  2. Call GET {serviceUrl}/v3/conversations/{conversationId}/members for the 1:1 chat 10 times with that token. POST .../activities fails the same way.

Result (one token, repeated calls, 2026-10-19 UTC)

  • About 15:25, host 52.123.207.194: 401 x9, 200 x1. Host 52.123.212.114: 200 x10.
  • About 15:50, both hosts mixed; 52.123.212.114 returned 200 and 403 within the same minute.
  • About 17:20, 52.123.207.194: 401 x9, 403 x1. From a US network the name resolved to 52.112.114.127: 403 x10.
  • 401 body: {"message":"Authorization has been denied for this request."}
  • 403 body: {"error":{"code":"BadArgument","message":"Failed to decrypt conversation id"}}

Related symptoms in the same window: some inbound messages and Adaptive Card submits never reached the endpoint (Teams showed "Unable to reach app"), and re-uploading the same app package later failed with "Please make sure the bot is registered and Teams channel is enabled". One reply at 15:28 UTC did reach the user, and the conversation ID for the same 1:1 chat changed between 15:32 and 15:51 UTC without a reinstall.

Troubleshooting done

  • Checked the tenant authority, token audience, service principal, bot type, channel state and manifest botId; all match.
  • Flushed DNS, pinned each host IP, and tried a different network; every host still returns mixed or failing results.
  • Read the existing Q&A and GitHub threads on "Failed to decrypt conversation id" and single-tenant 401s; their causes (tenant mismatch, missing service principal, Developer Portal-only bot) do not apply here.

Question: Is there a known propagation delay for new single-tenant bots across the Teams and Bot Connector backends, or does something need to be reset on the Microsoft side for this app ID? We can share the tenant ID and request correlation IDs privately.

Azure AI Bot Service
Azure AI Bot Service

An Azure service that provides an integrated environment for bot development.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-19T17:35:39.16+00:00

    Restart the Microsoft Teams channel on the Azure Bot resource without deleting it; if the same fresh conversation still alternates between 200, 401, and 403 afterward, open an Azure support request for Microsoft to investigate inconsistent Bot Connector/Teams backend state.

    Safe self-service action

    1. In the Azure portal, open the Azure Bot resource.
    2. Select Channels.
    3. Open Microsoft Teams and select Restart.
    4. Send a new personal-scope message to the bot.
    5. From that newly received activity, capture its exact:
      • serviceUrl
      • conversation.id
      • activity timestamp
    6. Reply using those values without substituting a regional URL or an older conversation reference.
    7. Repeat the members/reply request and record each response.

    Microsoft specifically documents restarting the Teams channel when Teams stops delivering through a healthy development tunnel. It also warns not to delete and re-add the channel because doing so generates new keys and invalidates stored 29:xxx and a:xxx identifiers.^1^^2^

    Do not recreate the channel as a troubleshooting step. If it has ever been deleted and re-enabled, previously stored conversation references must be discarded and reacquired from new activities because the generated keys change.^2^

    This is not explained by a documented propagation interval

    There is no published propagation-delay duration or guarantee for a newly created single-tenant bot in the available Microsoft guidance. Public reports establish a known issue pattern involving single-tenant bots and intermittent 401/403 responses, including random “Failed to decrypt conversation id”, but not a confirmed platform-wide incident or a documented customer-accessible reset.[^3^](https://learn.microsoft.com/en-us/answers/questions/6009770/teams-channel-on-bot-returns-failed-to-decrypt-con "Teams channel on bot returns "Failed to decrypt conversation id" after ...")^4^

    The observed combination is significant:

    • One token and identical request alternate between success and failure.
    • Results vary across Connector addresses and even on the same address.
    • Inbound activities and card submissions are also intermittently lost.
    • Teams package validation intermittently fails against the same bot registration.
    • The personal-chat conversation ID changed without reinstalling.

    Because the identity, tenant, service principal, manifest, channel, DNS, and network paths have already been checked, repeating those checks is unlikely to discriminate this case. Connector documentation only classifies 401 as unauthenticated and 403 as unauthorized; it advises inspecting the returned error object and channel-specific guidance.^5^

    Escalate if restart does not stabilize it

    Create a request through Azure portal → Help + support → Create a support request, selecting the affected Azure Bot resource. Include:

    • Azure Bot resource ID and app/client ID.
    • Tenant ID, supplied only in the private support case.
    • Exact UTC timestamps for successful and failed calls.
    • HTTP method and sanitized request URL.
    • Status code and complete response body.
    • Connector destination IP observed for each call.
    • Request/correlation IDs from response headers.
    • Decoded non-secret token claims: aud, appid, tid, iat, and exp.
    • The newly captured serviceUrl and conversation ID, shared privately.
    • Evidence that one unchanged token/request returned both 200 and 401/403.
    • The inbound-delivery and app-upload failures from the same time window.
    • The result before and after restarting the Teams channel.

    Select Yes for Advanced diagnostic information if organizational policy permits it; Azure Support can collect resource diagnostics only when permission is granted through the portal support case.^6^ The support-request form accepts reproduction steps, start time, logs or traces, business-impact severity, and the preferred contact method.^7^

    Ask support to trace the requests across Azure AI Bot Service/Bot Connector and the Microsoft Teams channel registration, and to check whether the app ID has inconsistent registration, key, or conversation-mapping state across backend instances. There is no documented self-service operation that resets those backend mappings.

    References

    1. Troubleshoot your Microsoft Teams app
    2. Connect a bot to Microsoft Teams
    3. Teams channel on bot returns "Failed to decrypt conversation id" after ...
    4. Getting random error 403 Failed to decrypt conversation id on Teams ...
    5. API reference for the Bot Framework Connector service
    6. Manage an Azure support request
    7. Create an Azure support request
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.