You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

本地测试Teams命令Bot遇AADSTS500021租户访问拒绝错误求助

avatar
安全阿岳
2026-7-21
Teams本地测试命令Bot时出现AADSTS500021认证错误

问题背景

我使用C#开发，已在Visual Studio中安装Teams Toolkit，通过模板创建了新的命令Bot。执行“Prepare Teams App Dependencies”并登录Microsoft 365，同时启动了ngrok HTTP隧道。按F5测试Bot时，能接收请求但认证出现错误：AADSTS500021: Access to 'Bot Framework' tenant is denied。

已尝试的排查步骤

  • 移除App ID和密码后Bot可正常运行；
  • 执行官方故障排查指南中的curl命令时，同样返回*"error":"invalid_grant"*及AADSTS500021错误提示。

疑问

  1. 我的理解是无需部署到Azure即可本地测试，且模板应自动生成App ID和密码，该理解是否正确？
  2. 若理解正确，是否需要在Azure AD租户中进行额外配置？我的IT部门表示租户无限制。

完整错误日志 

info: NetTeamsApp.Commands.HelloWorldCommandHandler[0]
      Bot received message: helloworld

fail: Microsoft.Bot.Builder.Integration.AspNet.Core.CloudAdapter[0]
      [OnTurnError] unhandled error : Failed to acquire token for client credentials. (AADSTS500021: Access to 'Bot Framework' tenant is denied.
      Trace ID: 88c0cb6e-cdf7-4dc3-bf93-da0799613a00
      Correlation ID: 35e7aead-412b-415e-8428-17029c5e97e6
      Timestamp: 2023-05-17 14:49:23Z)
      System.AggregateException: Failed to acquire token for client credentials. (AADSTS500021: Access to 'Bot Framework' tenant is denied.
      Trace ID: 88c0cb6e-cdf7-4dc3-bf93-da0799613a00
      Correlation ID: 35e7aead-412b-415e-8428-17029c5e97e6
      Timestamp: 2023-05-17 14:49:23Z)
       ---> Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS500021: Access to 'Bot Framework' tenant is denied.
      Trace ID: 88c0cb6e-cdf7-4dc3-bf93-da0799613a00
      Correlation ID: 35e7aead-412b-415e-8428-17029c5e97e6
      Timestamp: 2023-05-17 14:49:23Z
       ---> Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: Response status code does not indicate success: 400 (BadRequest).
         at Microsoft.Identity.Core.OAuth2.OAuthClient.GetResponseAsync[T](Boolean respondToDeviceAuthChallenge)
        ErrorCode: BadRequest
        StatusCode: 400
         --- End of inner exception stack trace ---
         at Microsoft.Identity.Core.OAuth2.OAuthClient.GetResponseAsync[T](Boolean respondToDeviceAuthChallenge)
         at Microsoft.Identity.Core.OAuth2.OAuthClient.GetResponseAsync[T]()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.SendHttpMessageAsync(IRequestParameters requestParameters)
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.SendTokenRequestAsync()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.CheckAndAcquireTokenUsingBrokerAsync()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.RunAsync()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.AcquireTokenForClientCommonAsync(String resource, ClientKey clientKey)
         at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.AcquireTokenAsync(String resource, ClientCredential clientCredential)
         at Microsoft.Bot.Connector.Authentication.AdalAuthenticator.AcquireTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.Retry.Run[TResult](Func`1 task, Func`3 retryExceptionHandler)
        ErrorCode: invalid_request
        StatusCode: 400
         --- End of inner exception stack trace ---
         at Microsoft.Bot.Connector.Authentication.Retry.Run[TResult](Func`1 task, Func`3 retryExceptionHandler)
         at Microsoft.Bot.Connector.Authentication.AdalAuthenticator.GetTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.AdalAuthenticator.Microsoft.Bot.Connector.Authentication.IAuthenticator.GetTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.AppCredentials.GetTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.AppCredentials.ProcessHttpRequestAsync(HttpRequestMessage request, CancellationToken cancellationToken)
         at Microsoft.Bot.Connector.Conversations.ReplyToActivityWithHttpMessagesAsync(String conversationId, String activityId, Activity activity, Dictionary`2 customHeaders, CancellationToken cancellationToken)
         at Microsoft.Bot.Connector.ConversationsExtensions.ReplyToActivityAsync(IConversations operations, String conversationId, String activityId, Activity activity, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.CloudAdapterBase.SendActivitiesAsync(ITurnContext turnContext, Activity[] activities, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.TurnContext.<>c__DisplayClass31_0.<<SendActivitiesAsync>g__SendActivitiesThroughAdapter|1>d.MoveNext()
      --- End of stack trace from previous location ---
         at Microsoft.Bot.Builder.TurnContext.SendActivityAsync(IActivity activity, CancellationToken cancellationToken)         at Microsoft.TeamsFx.Conversation.ActivityCommandResponse.SendResponseAsync(ITurnContext turnContext, CancellationToken cancellationToken)
         at Microsoft.TeamsFx.Conversation.CommandResponseMiddleware.OnTurnAsync(ITurnContext turnContext, NextDelegate next, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.MiddlewareSet.ReceiveActivityWithStatusAsync(ITurnContext turnContext, BotCallbackHandler callback, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.BotAdapter.RunPipelineAsync(ITurnContext turnContext, BotCallbackHandler callback, CancellationToken cancellationToken)

fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
      System.AggregateException: Failed to acquire token for client credentials. (AADSTS500021: Access to 'Bot Framework' tenant is denied.
      Trace ID: 88c0cb6e-cdf7-4dc3-bf93-da07a7613a00
      Correlation ID: e8367844-44b8-42ae-8f07-be1db3d15c8c
      Timestamp: 2023-05-17 14:49:23Z)
       ---> Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS500021: Access to 'Bot Framework' tenant is denied.
      Trace ID: 88c0cb6e-cdf7-4dc3-bf93-da07a7613a00
      Correlation ID: e8367844-44b8-42ae-8f07-be1db3d15c8c
      Timestamp: 2023-05-17 14:49:23Z
       ---> Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: Response status code does not indicate success: 400 (BadRequest).
         at Microsoft.Identity.Core.OAuth2.OAuthClient.GetResponseAsync[T](Boolean respondToDeviceAuthChallenge)
        ErrorCode: BadRequest
        StatusCode: 400
         --- End of inner exception stack trace ---
         at Microsoft.Identity.Core.OAuth2.OAuthClient.GetResponseAsync[T](Boolean respondToDeviceAuthChallenge)
         at Microsoft.Identity.Core.OAuth2.OAuthClient.GetResponseAsync[T]()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.SendHttpMessageAsync(IRequestParameters requestParameters)
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.SendTokenRequestAsync()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.CheckAndAcquireTokenUsingBrokerAsync()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.RunAsync()
         at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.AcquireTokenForClientCommonAsync(String resource, ClientKey clientKey)
         at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.AcquireTokenAsync(String resource, ClientCredential clientCredential)
         at Microsoft.Bot.Connector.Authentication.AdalAuthenticator.AcquireTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.Retry.Run[TResult](Func`1 task, Func`3 retryExceptionHandler)
        ErrorCode: invalid_request
        StatusCode: 400
         --- End of inner exception stack trace ---
         at Microsoft.Bot.Connector.Authentication.Retry.Run[TResult](Func`1 task, Func`3 retryExceptionHandler)
         at Microsoft.Bot.Connector.Authentication.AdalAuthenticator.GetTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.AdalAuthenticator.Microsoft.Bot.Connector.Authentication.IAuthenticator.GetTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.AppCredentials.GetTokenAsync(Boolean forceRefresh)
         at Microsoft.Bot.Connector.Authentication.AppCredentials.ProcessHttpRequestAsync(HttpRequestMessage request, CancellationToken cancellationToken)
         at Microsoft.Bot.Connector.Conversations.ReplyToActivityWithHttpMessagesAsync(String conversationId, String activityId, Activity activity, Dictionary`2 customHeaders, CancellationToken cancellationToken)
         at Microsoft.Bot.Connector.ConversationsExtensions.ReplyToActivityAsync(IConversations operations, String conversationId, String activityId, Activity activity, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.CloudAdapterBase.SendActivitiesAsync(ITurnContext turnContext, Activity[] activities, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.TurnContext.<>c__DisplayClass31_0.<<SendActivitiesAsync>g__SendActivitiesThroughAdapter|1>d.MoveNext()
      --- End of stack trace from previous location ---
         at Microsoft.Bot.Builder.TurnContext.SendActivityAsync(IActivity activity, CancellationToken cancellationToken)         at Microsoft.Bot.Builder.TurnContext.SendActivityAsync(String textReplyToSend, String speak, String inputHint, CancellationToken cancellationToken)
         at NetTeamsApp.AdapterWithErrorHandler.<>c__DisplayClass0_0.<<-ctor>b__0>d.MoveNext() in C:\Users\tomlinss\dev\NetTeamsApp\AdapterWithErrorHandler.cs:line 21
      --- End of stack trace from previous location ---
         at Microsoft.Bot.Builder.BotAdapter.RunPipelineAsync(ITurnContext turnContext, BotCallbackHandler callback, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.CloudAdapterBase.ProcessActivityAsync(AuthenticateRequestResult authenticateRequestResult, Activity activity, BotCallbackHandler callback, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.CloudAdapterBase.ProcessActivityAsync(String authHeader, Activity activity, BotCallbackHandler callback, CancellationToken cancellationToken)
         at Microsoft.Bot.Builder.Integration.AspNet.Core.CloudAdapter.ProcessAsync(HttpRequest httpRequest, HttpResponse httpResponse, IBot bot, CancellationToken cancellationToken)
         at NetTeamsApp.Controllers.BotController.PostAsync(CancellationToken cancellationToken) in C:\Users\tomlinss\dev\NetTeamsApp\Controllers\BotController.cs:line 24
         at lambda_method4(Closure , Object )
         at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|20_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
         at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
         at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

问题分析与解决建议

关于你的疑问

你的理解完全正确：Teams Toolkit支持无需部署到Azure的本地测试，模板会自动生成用于本地测试的App ID和密码，这些信息会被写入项目的配置文件（如appsettings.json）中。

错误原因

AADSTS500021错误的核心原因是你的Azure AD租户无法访问Bot Framework服务，或者自动生成的测试应用缺少必要的权限配置。

解决步骤

  1. 确认租户Bot Framework访问权限
    尽管IT部门表示租户无限制，仍需确认租户未被禁用Bot Framework相关服务。联系Azure AD管理员，检查租户是否允许创建Bot类型应用，以及是否开启了Bot Framework服务的访问权限。

  2. 重新生成测试用App ID和密码
    自动生成的测试应用可能存在配置异常：

    • 删除项目配置文件（如appsettings.json）中的MicrosoftAppId和MicrosoftAppPassword；
    • 重新执行Prepare Teams App Dependencies步骤，让Toolkit重新生成测试应用；
    • 检查新生成的配置值是否正确，确保无空格或格式错误。

  3. 手动配置测试应用权限
    如果租户有特殊安全策略，自动配置的权限可能不生效，需手动添加：

    • 登录Azure门户，找到与项目同名的自动生成测试应用；
    • 进入“API权限”页面，添加Bot Framework的应用权限，勾选Channel.Create、Channel.ReadBasic.All等必要权限；
    • 完成管理员授权（若租户要求）。

  4. 验证curl命令参数
    执行排查用curl命令时，确保参数正确：

    • resource值必须为https://api.botframework.com/；
    • client_id对应MicrosoftAppId，client_secret对应MicrosoftAppPassword。

内容的提问来源于stack exchange，提问作者Tommo56700

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
火山引擎 最新活动
全面开放
Doubao-Seedance-2.5全新模型升级

模型再升级,30秒超长叙事, 模态参考扩容

HOT
方舟Codingplan

模型自由，工具不限，最新支持 Deepseek-V4 系列、GLM-5.3 系列

HOT
方舟Agent plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列

HOT
新用户特惠专场

大模型19元起，Al应用9.9元畅享，新人首购爆款尽享优惠

最近更新时间：2026.07.21 16:29:52