ja-onereach commented 3 years ago

Issue summary

When attempting to install a custom app into Teams, the error "Something went wrong" is presented in a modal. If we use the Teams web browser client, an HTTP 500 response with the body {errorCode: "AddAppBotToChatRosterFailed"} can be seen in the network monitor.
Given the ambiguity of the error message, it has been impossible for us to discover the actual cause of the error. There may indeed be many different possible causes.
This error does not happen consistently, and it has been impossible for us to identify the variables accounting for that inconsistency. One of our customers encounters the issue 100% of the time, others have never reported it, but our internal testing team sees it only some of the time. Sometimes app installation works, sometimes it doesn't, sometimes it works after a user logs out and back in again. We have examined every Teams and Azure security and permission setting closely and can find no obvious causes, and the installation approach described below worked fine for us for a long while but has been having this problem relatively recently.

Requested remediation

This is an urgent, blocking problem for us and our customers, so any guidance that could help unblock us immediately would be greatly appreciated. Perhaps there's a hidden means of obtaining a more precise error description, or some reliable workaround steps we could take, or alternative API versions, or other such thing, that we could use while the root of this problem is being addressed. At the moment, some of our customers are entirely unable to create Teams integrations because they can't get past the last installation step and there is no useful indication of what the actual problem is.
Surface much more informative and actionable error messages through the Teams client when app installation failures occur.
Resolve any problems in Teams or Azure infrastructure and APIs that may cause such errors to occur due to factors outside of the reasonable control of the Azure tenant or Teams workspace admins.

Detailed issue description

Background

Our company's product is a tool that helps people build bot, automation, AI, and other such systems using low-code and no-code tools. We offer a MS Teams Toolkit that supports building conversation bots and interacting with the Teams API. To support our customers in getting started, we have tools that help them create the necessary configurations/manifests for Azure and Teams.

Definitions

Customer - A person who wants to use our MS Teams toolkits. That person must have access to the Azure tenant with Global Administrator permissions.
Installer - An automated process that programmatically creates the required Azure resources and generates the Teams app manifest.
Installer App - OAuth app registration in our Azure tenant that receives authorization to create new app registration and bot service in the customer's Azure tenant. See Installer App Azure Manifest Example.
App - Azure OAuth app registration that will be created in the customer's tenant by the Installer App and bound to a Bot.
Bot - Azure bot service that will be created in the customer's tenant by the Installer App.
Access Token 1 - Access token used to create the App in the Customer's tenant.
Access Token 2 - Access token used to create the Resource Group and deploy the Bot in the Customer's tenant.
Access Token 3 - Access token used to publish and install the Bot in MS Teams.
Subscription - Azure subscription.
Resource Group - Azure resource group.
App Manifest - MS Teams app manifest JSON file. This file contains all necessary information to publish the Bot to MS Teams app catalog. See MS Teams App Manifest Example.

Installation process

Customer makes OAuth access grant to the Installer App with these scopes:
- Access Azure Service Management as organization users (preview)
- Read and write to all app catalogs
- Read and write directory data
- Sign in and read user profile
- Read and write all users' full profiles
- Read and write directory data
- Read and write all applications
- Manage apps that this app creates or owns
Installer obtains Access Token 1 with permissions above. *1
Installer creates the App in the customer's tenant. See Create App Request Example
Installer adds a password to the App. See Add Password Request Example
Customer makes a further OAuth access grant to the Installer App with this scope:
- Access Azure Service Management as you (preview)
Installer obtains Access Token 2 with permission above.
Customer makes a further OAuth access grant to the Installer App with these Teams scopes:
- Read directory data
- Maintain access to data you have given it access to
- View your email address
- Sign in as you
Installer obtains Access Token 3 with permissions above.
Installer prompts the customer to choose the Subscription and create the Resource Group that are required to deploy the Bot.
Installer deploys the Bot in the client's tenant. See Deploy Bot Request Example
Installer generates a zip file that includes the App Manifest and two images. This zip file is required to publish Bot to MS Teams. The contents of the zip file are:
- color.png
- outline.png
- manifest.json
Installer publishes the Bot to the MS Teams app catalog. See Publish Bot In App Catalog Request Example.
Installer installs the Bot in the MS Teams team. See Install Bot In Team Request Example. *2

1 Installer communicate with MS Graph by Installer App access tokens.
2 This is where the issue occurs. In most cases, it works and the app indeed added to the team, but in some cases the response for this request is 500 - Failed to execute backend request.

Test environment configuration

portal.azure.com

Added two users USER_1 and USER_2. Both users were assigned the role Global Administrator. Both users use Pay-As-You-Go subscription.

admin.teams.microsoft.com

Teams apps -> Permission policies -> Global (Org-wide default):
- Microsoft Apps - Allow all apps
- Third-party apps - Allow all apps
- Custom apps - Allow all apps
Setup policies -> Global (Org-wide default):
- Upload custom apps - ON

The problem

As USER_1 with Global Admin permissions and Pay-As-You-Go subscription I am not able to add custom application (bot) to the Team, in MS Teams UI, owned by me. The Something went wrong modal appears. If we use the Teams web browser client, an HTTP 500 response with the body {errorCode: "AddAppBotToChatRosterFailed"} can be seen in the network monitor.

The app does appear in the Teams app list after the Install Process. But the user who added the application is only able to see it only after re-login. Nevertheless, the application still is not fully added to the team, because the "Add app to team" control remains available (and continue causes a AddAppBotToChatRosterFailed error).

As USER_2, the same initial behavior occurs as with the first user, but after re-login all works ok.

Appendix

Installer App Azure Manifest Example

{
  "id": "c76a5b5b-136d-498b-8b0c-bebe6bcXXXXX",
  "acceptMappedClaims": null,
  "accessTokenAcceptedVersion": 2,
  "addIns": [],
  "allowPublicClient": null,
  "appId": "d159ef8a-4559-4e8f-bfaa-ef68f4fXXXXX",
  "appRoles": [],
  "oauth2AllowUrlPathMatching": false,
  "createdDateTime": "2020-12-28T12:40:18Z",
  "disabledByMicrosoftStatus": null,
  "groupMembershipClaims": null,
  "identifierUris": [],
  "informationalUrls": {
    "termsOfService": null,
    "support": null,
    "privacy": null,
    "marketing": null
  },
  "keyCredentials": [],
  "knownClientApplications": [],
  "logoUrl": null,
  "logoutUrl": null,
  "name": "Installer",
  "oauth2AllowIdTokenImplicitFlow": false,
  "oauth2AllowImplicitFlow": false,
  "oauth2Permissions": [],
  "oauth2RequirePostResponse": false,
  "optionalClaims": null,
  "orgRestrictions": [],
  "parentalControlSettings": {
    "countriesBlockedForMinors": [],
    "legalAgeGroupRule": "Allow"
  },
  "passwordCredentials": [
    {
      "customKeyIdentifier": null,
      "endDate": "2299-12-30T22:00:00Z",
      "keyId": "6fdd26fa-820e-429e-8916-6b993f8XXXXX",
      "startDate": "2020-12-28T15:08:41.968Z",
      "value": null,
      "createdOn": "2020-12-28T15:08:57.2196769Z",
      "hint": "X_S",
      "displayName": "Password uploaded on Mon Dec 28 2020"
    }
  ],
  "preAuthorizedApplications": [],
  "publisherDomain": "TestPublisher.onmicrosoft.com",
  "replyUrlsWithType": [
    {
      "url": "https://sdkapi.staging.api.onereach.ai/http/c1d91ff9-e7bf-464a-90d7-45fb9f2XXXXX/azure/installer",
      "type": "Web"
    },
  ],
  "requiredResourceAccess": [
    {
      "resourceAppId": "797f4846-ba00-4fd7-ba43-dac1f8f63013",
      "resourceAccess": [
        {
          "id": "41094075-9dad-400e-a0bd-54e686782033",
          "type": "Scope"
        }
      ]
    },
    {
      "resourceAppId": "00000003-0000-0000-c000-000000000000",
      "resourceAccess": [
        {
          "id": "1ca167d5-1655-44a1-8adf-1414072e1ef9",
          "type": "Scope"
        },
        {
          "id": "c5366453-9fb0-48a5-a156-24f0c49a4b84",
          "type": "Scope"
        },
        {
          "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
          "type": "Scope"
        },
        {
          "id": "204e0828-b5ca-4ad8-b9f3-f32a958e7cc4",
          "type": "Scope"
        },
        {
          "id": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
          "type": "Role"
        },
        {
          "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9",
          "type": "Role"
        },
        {
          "id": "18a4783c-866b-4cc7-a460-3d5e5662c884",
          "type": "Role"
        }
      ]
    }
  ],
  "samlMetadataUrl": null,
  "signInUrl": null,
  "signInAudience": "AzureADandPersonalMicrosoftAccount",
  "tags": [],
  "tokenEncryptionKeyId": null
}

Create App Request Example

{
  method: 'post',
  url: 'applications',
  headers: {
    authorization: ACCESS_TOKEN_1
  },
  body: {
    displayName: 'App Display Name',
    requiredResourceAccess: [
      {
        resourceAppId: "00000003-0000-0000-c000-000000000000",
        resourceAccess: [
          {
            "id": "c5366453-9fb0-48a5-a156-24f0c49a4b84",
            "type": "Scope"
          },
          {
            "id": "1ca167d5-1655-44a1-8adf-1414072e1ef9",
            "type": "Scope"
          },
          {
            "id": "c529cfca-c91b-489c-af2b-d92990b66ce6",
            "type": "Role"
          },
          {
            "id": "eb6b3d76-ed75-4be6-ac36-158d04c0a555",
            "type": "Role"
          },
          {
            "id": "a267235f-af13-44dc-8385-c1dc93023186",
            "type": "Role"
          },
          {
            "id": "70dec828-f620-4914-aa83-a29117306807",
            "type": "Role"
          },
          {
            "id": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
            "type": "Role"
          },
          {
            "id": "62a82d76-70ea-41e2-9197-370581804d09",
            "type": "Role"
          },
          {
            "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9",
            "type": "Role"
          },
          {
            "id": "7b2449af-6ccd-4f4d-9f78-e550c193f0d1",
            "type": "Role"
          },
          {
            "id": "741f803b-c850-494e-b5df-cde7c675a1ca",
            "type": "Role"
          },
          {
            "id": "294ce7c9-31ba-490a-ad7d-97a7d075e4ed",
            "type": "Role"
          },
          {
            "id": "75359482-378d-4052-8f01-80520e7db3cd",
            "type": "Role"
          },
          {
            "id": "658aa5d8-239f-45c4-aa12-864f4fc7e490",
            "type": "Role"
          }
        ]
      }
    ],
    signInAudience: 'AzureADandPersonalMicrosoftAccount',
    web: {
      implicitGrantSettings: {
        enableIdTokenIssuance: false,
        enableAccessTokenIssuance: true
      },
      redirectUris: [
        "https://em.staging.api.onereach.ai/http/873c0f61-4dfc-4f8a-860e-f574616XXXXX/msteams/oauth"
      ]
    }
  },
  version: 'beta', // MS Graph API version
}

Add Password Request Example

{
  method: 'post',
  url: `applications/${APP_ID}/addPassword`,
  headers: {
    authorization: ACCESS_TOKEN_1
  },
  body: {
    passwordCredential: {
      displayName: 'Generated Secret Password'
    }
  },
  version: 'beta',
}

Deploy Bot Request Example

{
  method: 'put',
  url: `subscriptions/${SUBSCRIPTION_ID}/resourcegroups/${RESOURCE_GROUPE_NAME}/providers/Microsoft.Resources/deployments/${DEPLOYMENT_NAME}?api-version=2020-06-01`,
  headers: {
    authorization: ACCESS_TOKEN_2
  },
  body: {
    properties: {
      mode: 'Incremental',
      template: {
        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "parameters": {
          "app_id": {
            "defaultValue": APP_ID,
            "type": "String"
          },
          "botService_name": {
            "defaultValue": BOT_NAME,
            "type": "String"
          },
          "botServices_endpoint": {
            "defaultValue": 'https://em.staging.api.onereach.ai/http/c1d91ff9-e7bf-464a-90d7-45fb9f2XXXXX/in/msbot/event/0d1387bf-87c1-4fa9-8aee-d616a0cXXXXX',
            "type": "String"
          }
        },
        "resources": [
          {
            "type": "Microsoft.BotService/botServices",
            "apiVersion": "2018-07-12",
            "name": "[parameters('botService_name')]",
            "location": "global",
            "kind": "bot",
            "properties": {
              "displayName": "[parameters('botService_name')]",
              "iconUrl": "https://docs.botframework.com/static/devportal/client/images/bot-framework-default.png",
              "msaAppId": "[parameters('app_id')]",
              "endpoint": "[parameters('botServices_endpoint')]"
            }
          },
          {
            "type": "Microsoft.BotService/botServices/channels",
            "apiVersion": "2018-07-12",
            "name": "[concat(parameters('botService_name'), '/MsTeamsChannel')]",
            "location": "global",
            "dependsOn": [
              "[resourceId('Microsoft.BotService/botServices', parameters('botService_name'))]"
            ],
            "properties": {
              "properties": {
                "enableCalling": false,
                "isEnabled": true
              },
              "channelName": "MsTeamsChannel"
            }
          }
        ]
      }
    }
  }
}

MS Teams App Manifest Example

{
  "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.5/MicrosoftTeams.schema.json",
  "manifestVersion": "1.5",
  "version": "1.0.0",
  "id": APP_ID,
  "packageName": "com.generated.bot",
  "developer": {
    "name": "onereach",
    "websiteUrl": "https://www.onereach.ai",
    "privacyUrl": "https://www.onereach.ai/privacy",
    "termsOfUseUrl": "https://www.onereach.ai/terms"
  },
  "icons": {
    "color": "color.png",
    "outline": "outline.png"
  },
  "name": {
    "short": APP_NAME,
    "full": ""
  },
  "description": {
    "short": "Generated by OneReach app",
    "full": "This app is generated by OneReach. You can edit manifest.json by your self."
  },
  "accentColor": "#FFFFFF",
  "bots": [
    {
      "botId": APP_ID,
      "scopes": [
        "personal",
        "team",
        "groupchat"
      ],
      "supportsFiles": true,
      "isNotificationOnly": false
    }
  ],
  "permissions": [
    "identity",
    "messageTeamMembers"
  ],
  "validDomains": ["*.onereach.ai"]
}

Publish Bot In App Catalog Request Example

{
  method: 'post',
  url: 'appCatalogs/teamsApps',
  headers: {
    authorization: ACCESS_TOKEN_3,
    'content-type': 'application/zip',
  }
  body: GENERATED_MANIFEST_ZIP_FILE_STREAM,
}

Install Bot In Team Request Example

{
  method: 'post',
  url: `teams/${TEAM_ID}/installedApps`,
  headers: {
    authorization: ACCESS_TOKEN_3,
  }
  body: {
    'teamsApp@odata.bind': `${config.graphApiEndpoint}appCatalogs/teamsApps/${PUBLISHED_APP_ID}`
  },
  version: 'beta'
}

ghost commented 3 years ago

Hi ja-onereach! Thank you for bringing this issue to our attention. We will investigate and if we require further information we will reach out in one business day. Please use this link to escalate if you don't get replies.

Best regards, Teams Platform

Wajeed-msft commented 3 years ago

@Jagadeesh-MSFT - could you please look into this issue?

Jagadeesh-MSFT commented 3 years ago

Hi @ja-onereach, Thank you for reaching us, we are working on it, will update you soon.

ja-onereach commented 3 years ago

@Jagadeesh-MSFT Thanks for your follow-up. Apologies if this is being pushy, but I want to reiterate something from the original message:

This is an urgent, blocking problem for us and our customers, so any guidance that could help unblock us immediately would be greatly appreciated. Perhaps there's a hidden means of obtaining a more precise error description, or some reliable workaround steps we could take, or alternative API versions, or other such thing, that we could use while the root of this problem is being addressed. At the moment, some of our customers are entirely unable to create Teams integrations because they can't get past the last installation step and there is no useful indication of what the actual problem is.

As well, I should clarify that we've attempted to automate the app creation and installation process from start to finish, which is what is described in the Detailed issue description section. But we've also tried the process manually, which is where the observations of the "Something went wrong" client error message and browser network responses happened. The problem is the same whether we try adding the app programmatically via the teams/${TEAM_ID}/installedApps endpoint or do it using the manifest.zip file via the web or native clients.

Thanks!

Jagadeesh-MSFT commented 3 years ago

Can we discuss this over call? Could you please write to us at microsoftteamsdev@microsoft.com

ja-onereach commented 3 years ago

I'd be glad to... I'm free any day after 10am MT if you'd like to pick a time that's convenient for you.

Thanks! -jonathan anderson

Jagadeesh-MSFT wrote on 5/18/21 11:39 PM:

Can we discuss this over call? Could you please write to us at @. @.>

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/MicrosoftDocs/msteams-docs/issues/3178#issuecomment-843761724, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIFC2AAT3Z4OA64EWNJUMATTONFKBANCNFSM43TL4VKA.

ja-onereach commented 3 years ago

Hi @@.***>, I'm scheduling this call on your's Monday morning 9:00AM MT. I hope it would work for you, otherwise please let me know your available time.

Thanks & Regards, Jagadeesh Lankireddy

Microsoft Teams meeting Join on your computer or mobile app Click here to join the meetinghttps://teams.microsoft.com/l/meetup-join/19%3ameeting_NTgyYmY4N2MtZGE0Zi00NzQ5LThmYzItZjkzNjk3ZjFkMGNi%40thread.v2/0?context=%7b%22Tid%22%3a%2272f988bf-86f1-41af-91ab-2d7cd011db47%22%2c%22Oid%22%3a%227aed6015-3632-44dd-8559-84e649bc5b6b%22%7d Or call in (audio only) +91 22 6219 2547,,,,222654849#<tel:+912262192547,,,,222654849#> India, Mumbai 0008000402025,,,,222654849#<tel:0008000402025,,,,222654849#> India (Toll-free) Phone Conference ID: 222 654 849# Find a local numberhttps://dialin.teams.microsoft.com/576c8211-dbe8-4a9a-8707-1b52ccc23231?id=222654849 | Reset PINhttps://mysettings.lync.com/pstnconferencing Learn Morehttps://aka.ms/JoinTeamsMeeting | Meeting @.***&messageId=0&language=en-US>

From: Jonathan Anderson @.**@.>> Sent: 20 May 2021 00:39 To: MicrosoftDocs/msteams-docs @.**@.>>; Jagadeesh-MSFT @.**@.>>; Microsoft Teams Dev Community Response @.**@.>> Subject: [EXTERNAL] Re: [MicrosoftDocs/msteams-docs] Custom app installation fails with "Something went wrong" (AddAppBotToChatRosterFailed) error (#3178)

I'd be glad to... I'm free any day after 10am MT if you'd like to pick a time that's convenient for you.

Thanks! -jonathan anderson

Jagadeesh-MSFT wrote on 5/18/21 11:39 PM:

Can we discuss this over call? Could you please write to us at @.**@.>

- You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fmsteams-docs%2Fissues%2F3178%23issuecomment-843761724&data=04%7C01%7Cv-jaglan%40microsoft.com%7C3c55f8693ed747187a1408d91af987a2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637570482211613786%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0&sdata=8GZshKbosLtOsfVcwfNZZgaBCMcJP6e0MFizBmP9%2Fsk%3D&reserved=0, or unsubscribehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAIFC2AAT3Z4OA64EWNJUMATTONFKBANCNFSM43TL4VKA&data=04%7C01%7Cv-jaglan%40microsoft.com%7C3c55f8693ed747187a1408d91af987a2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637570482211623780%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0&sdata=wrwEOAY9fshJHbNl0oQLs%2FvjN1qNBnemKwd50z%2FWQQA%3D&reserved=0.

santhoshkr047 commented 3 years ago

I also had this same issue when I tried to install a custom app in MSFT teams. In my case, I was able to fix it by adding the MSFT teams channel in Azure portal under the bot service channels section.

marcin-burak commented 3 years ago

I have a similar issue, in my case I can register the bot without problems when my AAD registered app has "accessTokenAcceptedVersion": null but after i change it to "accessTokenAcceptedVersion": 2 it starts to throw this "AddAppBotToChatRosterFailed" exception when I'm uploading the MS Teams manifest.

Maybe it's because the null/1 version uses different format of the audience claim than the 2 version? 1/null sets my audience claim as api://<APP_DOMAIN>/<AAD_APP_ID>, but the 2 version sets it as just the <AAD_AAP_ID>.

That's what I think, but I'll be debugging it further in the upcoming weeks, it would be really nice to be able to use the 2 version.

EDIT: I also have the AAD app marked as multitenant, and the bot registered as the Bot Channel Registration (MS Teams channel) in my Azure tenant, it's because I'm using the "calling bot" functionality too. As I said it works with access token version 1, but breaks when changed to access token version 2.

ja-onereach commented 3 years ago

Thanks to @santhoshkr047 and @marcinburak for adding their observations here. The variety of potential causes of the same error underscores what I think is the real, critical issue here: this single error message encompasses too many possible actual underlying causes such that people have to guess their way to a solution instead of being pointed directly to it by the error message. Instead of seeing AddAppBotToChatRosterFailed or just "Something went wrong," if we saw errors like "Could not add app bot to chat roster because Teams is not enabled in Bot Channels Registration" or "...this Teams user is not permitted to install 3rd-party apps" or "...the provided access token version is prohibited for the 'POST appCatalogs/teamsApps' method", people would be able to dig themselves out of their own holes. The problem probably isn't that there's a bug in sideloading apps, it's that the success of that action is subject to too many obscure variables in the compound intersection of Graph API methods, Azure resources, Azure security settings, AAD permissions, Teams security settings, and Teams user permissions.

ja-onereach commented 3 years ago

In case it helps anyone else, here are the instructions we've been giving our customers that run into this:

The problem is most likely related to what Microsoft describe as “side-loading” apps, which seems to mean uploading the manifest instead of getting it from a marketplace, and the security and permissions settings that bear on that activity. Please go to https://admin.teams.microsoft.com and check the following sections:

Teams apps > Permission policies : Is there a policy that allows 3rd-party and custom apps to be installed by the installing user?
Teams apps > Setup policies : Is uploading of custom apps allowed?
Teams apps > Manage apps : Can you find an installation of the app in this list? If you click the Org-wide app settings do they indicate that users are allowed to install 3rd-party apps and interact with custom apps?

If you're unable to see or access any of those sections in the Teams admin center, you need to get the help of your Teams admin or get your Teams admin to elevate your privileges. With luck, this is all just some obscure issue related to permissions and security settings that were overlooked previously. Otherwise you need to undertake a process to isolate and confirm the issue while generating the data we need to send to Microsoft to get their help finding a solution.

At every juncture where an error occurs or something seems to fail, please note the specific activity and the precise date, time, and timezone when it occurred. Then sign out of Teams, quit the application, then open it again and sign in again before proceeding to the next step. Apparently there are known issues with caching so it's necessary to try to exclude that as a variable.

Confirm that all of the settings above are correct and you’re signed in as a user who has permission to upload/install 3rd-party and custom apps.
Check to see whether the app already appears in the Manage apps section or the “Built for your org” list in the Apps area of the Teams client.
If it does, try again to add that app to a channel. Note I’m saying add it to a channel instead of a team. Click the little caret next to the “Add” button and choose “Add to a chat”, then choose some existing channel in a team.
Even if that seems to fail, try @ mentioning the bot in that channel anyway. If you’re able to do that, check the logs in your account in our system to see if the event was received. If it was, then the installation only appeared to have failed but didn’t. If it’s possible to @ mention the bot but the activity isn’t hitting our system, stop there and let us know because that’s a completely different category of problem.
If it’s not possible to @ mention the bot, try adding it to the team instead of to a channel. Click the little caret next to the “Add” button and choose “Add to a team”.
Even if that seems to fail, try starting a DM chat with the bot and send it a message. If you’re able to do that, check the logs in your account in our system to see if the event was received. If it was, then the installation only appeared to have failed but didn’t. If it’s possible to send a DM chat message to the bot but the activity isn’t hitting our system, stop there and let us know because that’s a completely different category of problem.
Try deleting the app from the team, as well as any other apps that might have been created through previous attempts. Log out of Teams, quit the application, then open it and log back in again.
Try uploading the app manifest from Teams admin center (https://admin.teams.microsoft.com/policies/manage-apps) instead of the Teams client. Repeat steps 2-6.

ja-onereach commented 3 years ago

One of our customers that's been having this problem reported that the cause turned out to be the Azure subscription they were trying to use had been disabled or deactivated somehow. They fixed that and were able to proceed. So people experiencing this issue really need to check every single little piece of the App Registration, Bot Channels Registration, subscription, resource group, their AAD permissions, their Teams user permissions, whether the app is single-tenant, Teams admin security settings regarding custom apps, and who knows what else.

We had previously received guidance from Microsoft that we should try installing a custom app via the Teams admin center rather than the Teams client. In my experience, that causes the "Something went wrong" error 100% of the time, so I recommend only installing it from the Teams client.

AlexandreCamillo commented 3 years ago

@Jagadeesh-MSFT I have a similar issue, always getting "Something went wrong" (AddAppBotToChatRosterFailed) error when trying to add the custom bot. Have any news about this problem??

ChetanSharma-msft commented 2 years ago

@ja-onereach - Could you please confirm if your issue has resolved or still looking for any help?

ja-onereach commented 2 years ago

@v-chetsh I can't say it's really been resolved, we're just learning to work around it. The fundamental problem here is that many possible configuration issues can result in the same, unspecific error message so it's exceedingly hard to identify the specific problem(s) in the specific tenant at hand.

DmitriyVdE commented 2 years ago

I get the same error once I add a bot to my 'manifest.json'-file. If I leave the bot property empty, it installs just fine. This just happened during the 'Develop apps for Microsoft Teams – Associate' MS Learn course at 'Exercise - Using task modules with bots'. I also tried installing it from the Teams admin page, but I get a different error when installing the app from 'Built for your org': "App not found The app may not exist, or your organization may have disallowed you from using it"

{ "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.11/MicrosoftTeams.schema.json", "manifestVersion": "1.11", "id": "{{APPLICATION_ID}}", "version": "{{VERSION}}", "packageName": "{{PACKAGE_NAME}}", "developer": { "name": "Contoso", "websiteUrl": "https://{{PUBLIC_HOSTNAME}}", "privacyUrl": "https://{{PUBLIC_HOSTNAME}}/privacy.html", "termsOfUseUrl": "https://{{PUBLIC_HOSTNAME}}/tou.html" }, "name": { "short": "YouTube Player", "full": "YouTube Player" }, "description": { "short": "TODO: add short description here", "full": "TODO: add full description here" }, "icons": { "outline": "icon-outline.png", "color": "icon-color.png" }, "accentColor": "#D85028", "configurableTabs": [], "staticTabs": [ { "entityId": "221e7a8b-aa32-4feb-8a10-75595a75aa12", "name": "YouTube Player 1", "contentUrl": "https://{{PUBLIC_HOSTNAME}}/youTubePlayer1Tab/?name={loginHint}&tenant={tid}&theme={theme}", "scopes": [ "personal" ] } ], "bots": [ { "botId": "{{MICROSOFT_APP_ID}}", "scopes": [ "personal" ], "commandLists": [ { "scopes": [ "personal" ], "commands": [ { "title": "MentionMe", "description": "Sends message with @mention of the sender" } ] } ] } ], "connectors": [], "composeExtensions": [], "permissions": [ "identity", "messageTeamMembers" ], "validDomains": [ "{{PUBLIC_HOSTNAME}}" ], "showLoadingIndicator": false }

Meghana-MSFT commented 2 years ago

@dmitriyvde - Could you check if you have added MS Teams in the channels part of bot channel registration.

@ja-onereach - Could you please let us know what is the current issue you are facing? Also please share the repro steps.

ja-onereach commented 2 years ago

@Meghana-MSFT Our problem is a little bit complicated, a little bit meta. Our product is a platform that people use to create automation, chatbot, integration, and other such systems, and we offer a collection of tools for working with Teams bots. Very often when one of our customers tries to create a bot app for Teams, they get completely stuck because the app installation fails with this vague "Something went wrong" error. The actual, underlying reason for the error is seemingly different for every customer based on the idiosyncrasies of their Azure and O365 tenant configurations and random errors they might have made. I've listed some of the different reasons we've seen before in my previous messages here.

If you consider how many different possible configuration issues, security or access limitations, and errors (or multiple, cooccurring instances of any of those) can lead to "Something went wrong" it makes it extremely hard to figure out how to fix the problem. Every one of our customer's Azure/O365 tenants is a vast sea of complexity and idiosyncrasy and subject to different access restrictions, so every occurrence of this error requires a complicated investigation. So when I said "we're just learning to work around it," I meant that every time we encounter this we add another item to the list of things to check next time it happens. This has taken the troubleshooting process down from 2-3 weeks to a few days, but if the error message could report specifically what failed people would be able to get past this immediately and without an onerous process of investigating Azure/O365 resources and settings.

DmitriyVdE commented 2 years ago

@Meghana-MSFT Yes, I have done everything as described here in the MS learn module. A bit off topic: I might also want to add that I have reported quite a lot of feedback on these pages in terms of 'Learning content quality' since a lot of the subject matter on teams is simply outdated and a pretty much nothing in the whole MS Learn path for Teams works with de described screenshots/code snippets. As a newcomer and someone that is soon going to attempt the MS-600 exam I am really doubting this part of the exam. Are the questions even going to be relevant by the time I attempt the exam or will they be about outdated/non-working ways of working with Teams apps? Sure I could go to other places to learn these things, but then what's the point of having a learn path on this subject matter in the first place? I understand that Teams is a rapidly evolving platform and things get added pretty much all the time, but then just add a disclaimer at the top or something that the content probably doesn't apply anymore.

Meghana-MSFT commented 2 years ago

@ja-onereach - Thanks for providing the inputs, We are checking this internally. We will get back to you.

Meghana-MSFT commented 2 years ago

@ja-onereach -

Could you please share the request and response ids of any recent failure you have observed. We will investigate it internally. Please make sure you have removed any PII.
We will forward this feedback to the concerned team to include details related to the failure.

@DmitriyVdE - We will try to repro the issue by following the above mentioned MS learn module. and get back to you.

Meghana-MSFT commented 2 years ago

@ja-onereach - Could you please share the above requested details?

ekansh005 commented 2 years ago

@Meghana-MSFT @Jagadeesh-MSFT I am following MS learn module for building bot for teams and facing different issues since then:

When we generated the bot project with yo teams, why do we still need to use app studio and perform the same steps twice?
I created bot with 'single tenant' bot type and on testing, it throws error in my terminal 'error: get token request returned http error: 400 and server response: {"error":"unauthorized_client","error_description":"aadsts700016: application with identifier XXXX'
Then I created a fresh bot with Multi tenant and update my env variables but now when I try to upload my app, it gives the error 'Something went wrong' with status 400 and code as "AddAppBotToChatRosterFailed".

This is frustrating as I am struggling even in following the tutorial for 2 days. Here is the manifest in zip file. { "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.9/MicrosoftTeams.schema.json", "manifestVersion": "1.9", "id": "15327820-7ecc-11ec-ad8f-c540a8a3dbdb", "version": "0.0.2", "packageName": "conversationalbot", "developer": { "name": "Codeterian", "websiteUrl": "https://ed40-88-192-41-19.ngrok.io", "privacyUrl": "https://ed40-88-192-41-19.ngrok.io/privacy.html", "termsOfUseUrl": "https://ed40-88-192-41-19.ngrok.io/tou.html" }, "name": { "short": "Conversational Bot", "full": "Conversational Bot" }, "description": { "short": "TODO: add short description here", "full": "TODO: add full description here" }, "icons": { "outline": "icon-outline.png", "color": "icon-color.png" }, "accentColor": "#D85028", "configurableTabs": [], "staticTabs": [], "bots": [ { "botId": "49d81788-1845-4cae-9cdf-562679c84e1d", "needsChannelSelector": true, "isNotificationOnly": false, "scopes": ["team", "personal"], "commandLists": [ { "scopes": ["team", "personal"], "commands": [ { "title": "Help", "description": "Shows help information" }, { "title": "Who am I?", "description": "Shows information about your Teams user" }, { "title": "Mention me", "description": "Let the bot @mention you" } ] } ] } ], "connectors": [], "composeExtensions": [], "permissions": ["identity", "messageTeamMembers"], "validDomains": ["ed40-88-192-41-19.ngrok.io"], "showLoadingIndicator": false }

ekansh005 commented 2 years ago

Hi @Nikitha-MSFT @Wajeed-msft, Can you please help on this issue?

Meghana-MSFT commented 2 years ago

@ekansh005 - We are checking it. We will update you soon.

Meghana-MSFT commented 2 years ago

@ekansh005 -

I skipped the app studio and was still able to run the bot.
I tested with multitenant bot and it is working fine at our end.
I have tried with the manifest you shared, I was able to upload it successfully. Could you confirm if you are still facing the issue?

ghost commented 2 years ago

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 3 days. It will be closed if no further activity occurs within 3 days of this comment.

ekansh005 commented 2 years ago

Hi,

I would check this in a couple of days.

ekansh005 commented 2 years ago

Hi @Meghana-MSFT ,

I am still facing the same issue. PFA the screen recording and the package where I replicate the issue. https://1drv.ms/u/s!AmbUIBxAPz3VbqPucbyjrtoDvWA?e=M2utFt

ja-onereach commented 2 years ago

Sorry for the slow reply, I responded to the equivalent question in a support email thread and thought that was enough. I don't have any ongoing unresolved instances of this problem so unfortunately I can't share the requested details right now. The next time I hear from a customer encountering this problem I'll share whatever details I can. Let me copy what I said in the email thread here:

Please consider what I've already said a few times on that thread: this isn't just one incidence of this problem in one tenant that we need help troubleshooting, it's a recurring incident across many tenants under variable circumstances. I can't give you specific steps to reproduce it right now because we've resolved the cases we were facing before, and anyway those are not occurring in our tenants, they're happening in our customers'. Honestly the way to reproduce this problem for yourselves is to ask people who are not experts in Azure and who don't have god-level permissions in their tenants to try to get started using a Teams bot app in a variety of real-world, complicated Azure and O365 instances, and just watch what they have to go through. As noted in the thread, sometimes it's a subscription issue, sometimes a problem with the bot channels registration, sometimes some sort of permissions issue or a restriction on side-loading apps, sometimes an issue with a schema or API version being used, sometimes it's because you tried installing it from the Teams admin area instead of the client, sometimes it's the inverse. Seemingly dozens of different little problems result in the same error message, making this a nightmare to troubleshoot each time.

At this moment, our request is less of a support ticket and more of a plea—speaking as someone who is frequently trying to help Azure and O365 customers on their journey to using Teams bot apps—to make it easier to get started, or make it less susceptible to this error that halts all progress, or at least make the error message actually informative. It takes about 10 minutes to set up a bot integration with Slack, Zoom, and Webex Teams, and troubleshooting problems takes maybe a half an hour; getting started with Microsoft Teams bots usually takes hours under good conditions and days or weeks under others. Even if you manage to get something installed, with Teams instead of just learning one API or SDK you have a vast range of complicated new things to learn... but I suppose that's off-topic for this specific issue.

When this issue comes up again I'll ask the affected customer to send me as much detail as they can and also make their own support request to Microsoft, but if we keep viewing this as a single incident needing troubleshooting we'll be missing the real problem. We've done a ton of work to create tools that make it easy for people to build conversational and other automation behaviors in teams, but none of that is worth anything until customers can get their app installed.

johnmiroki commented 1 year ago

Ran into the same problem. The thing is, this error msg is too generic to be helpful.

Meghana-MSFT commented 1 year ago

@johnmiroki - Can you please share the manifest with which installation is failing? So that we will be able to check locally. Can you please let us know if it is a consistent issue or intermittent. thanks.

ghost commented 1 year ago

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 3 days. It will be closed if no further activity occurs within 3 days of this comment.

MicrosoftDocs / msteams-docs

Custom app installation fails with "Something went wrong" (AddAppBotToChatRosterFailed) error #3178

Issue summary

Requested remediation

Detailed issue description

Background

Definitions

Installation process

Test environment configuration

portal.azure.com

admin.teams.microsoft.com

The problem

Appendix

Installer App Azure Manifest Example

Create App Request Example

Add Password Request Example

Deploy Bot Request Example

MS Teams App Manifest Example

Publish Bot In App Catalog Request Example

Install Bot In Team Request Example