Access to not installed app and custom tabs after switching account in MS Teams Android App

MajaEffenberg commented 4 months ago

Steps to reproduce

We build an app for MS Teams which does provide a chatbot to the user and some custom tabs.

We have noticed that some of our users can access these custom tabs after changing their account, even if they do not have this application installed on this new account. The error occurs on the Teams app for Android, for different users whose accounts belong to different tenants.

Expected behavior

You should not be able to access the app and its tab from an account where the app is not installed.

Actual behavior

After changing the account, the user has access to tabs, from application that is not installed on this account, but is installed on the previously active account.

Error details

No response

Prasad-MSFT commented 4 months ago

Hi @MajaEffenberg - Could you please let us know if you have created the app as Single Tenant or Multitenant app? If you have published the app with multi-tenant capability, it will show in other tenants also.

MajaEffenberg commented 4 months ago

@Prasad-MSFT Thank you for the quick answer, but it is not entirely related to this problem.

Our application is a Multitenant app and our users can install it on different tenant accounts. The problem, however, is that some users who have our app installed on their first account. Then, after switching to another tenant account where our app is not installed, they still have access to our application and its custom tabs, which should not be possible.

Additional after user switching his account, we never get installation events for our application on this other tenant, but we get information that he open our custom tabs. How this is posisible that user can open tabs of an app from another tenant on the same device on android?

ChetanSharma-msft commented 4 months ago

Hello @MajaEffenberg - Could you please try after removing the cache? Reference doc: https://learn.microsoft.com/en-us/microsoftteams/troubleshoot/teams-administration/clear-teams-cache

Also, please confirm if it's working as expected in Desktop/Web Teams clients?

The bot receives an installationUpdate event when you install a bot to a conversation thread. If you switch accounts, it will not call bot installation events.

sschoeb commented 4 months ago

@ChetanSharma-msft thanks for your reply. I'm a coworker of @MajaEffenberg.

To answer your questions: We cannot reproduce this on our side, but we get close to every day a call from a tab opened on an android teams installation which has a tenantid for which the user never got any installation event.

So what we know:

All the users where we see this problem always use the teams app on the Android Phone (never seen on any other client like desktop, web)
The user does always have multiple tenants
On one of the tenants our app Micromate is installed (we got an installation event for it)
On the other tenant our app is NOT installed (as we did not get an installation event for it)
The user can somehow open tabs of our app in both tenants (not exactly sure what the user is doing, but we get calls from our tab with both tenantids)
We see it for multiple completely different users (removing the cache can not be the solution, as this is a user of a customer to which we do not have a direct contact)

Anything else you need to know on that?

ChetanSharma-msft commented 4 months ago

Hello @sschoeb - Thanks for sharing your inputs. As we are not able to repro this issue, we will check with engineering team once and let you know the updates.

Prasad-MSFT commented 4 months ago

@sschoeb - Please do share the tenant details and android Teams version where the issue is happening

sschoeb commented 4 months ago

@Prasad-MSFT is there a secure channel to share the tenant-ids?

We do not have the android teams version of the client, as these are customers of our customers. I don't think we get that information.

Prasad-MSFT commented 4 months ago

@sschoeb - You can share tenant details via email to microsoftteamsdev@microsoft.com

sschoeb commented 4 months ago

@Prasad-MSFT I've sent you two examples. Let me know if you need more information.

Prasad-MSFT commented 4 months ago

@sschoeb - Thanks for sharing the tenant details. We have raised an ICM for this issue and assigned to engineering team. We will inform you once we have further update.

sschoeb commented 3 months ago

@Prasad-MSFT We still see this issue happening. Do you have any feedback on this?

Prasad-MSFT commented 3 months ago

Apologies. Currently there is no ETA to share. We are following up with engineering team about this issue. We will update this thread once we hear from them. Thanks!

sschoeb commented 3 months ago

@Prasad-MSFT We see that issue close to every day. Our users are having problems because of this. Please share with the development team that this gets more urgent every day as the users get frustrated with these bugs.

Prasad-MSFT commented 3 months ago

Hi @sschoeb - Engineering team need below details to investigate further. So could you please share these info?

Are the tenants listed are test tenant accounts? On Android side logs I only see 1 app (Assignment) being used in one of tenant by one user
If partner can provide a recorded video of issue reproduction it would be more helpful.
Partner mentioned they are seeing events in their telemetry. It would be helpful if they can share some dump of this data.

sschoeb commented 3 months ago

@Prasad-MSFT sorry, I missed your comment. here the info you requested:

No. These are calls from our customers installation to our backend. We usually see that they have two tenants on their devices where usually one is there employer and the other one another company where our app is running inside. Within the tenant of the employer, micromate is NOT installed.
No we cannot, this happens very randomly and this is a customer of our customer, so we do not have access to the users. But we have the logs that somehow they have managed to get the wrong tenantid from teams-js within the tab.
I do not understand this request, what exactly should be provided here?