Azure AI Foundry Agent Works in Studio but Fails When Deployed to Microsoft Teams

Because Teams requests produce neither Foundry traces nor Logic App runs, first verify that the published Activity Protocol endpoint is being invoked; only troubleshoot the MCP identity after a Teams request reaches Foundry.

1. Isolate the Teams invocation path

1. Reset the Teams conversation by sending:

      /foundry_new_preview
   

   A tool error can lock a conversation so subsequent messages continue failing. This command creates a fresh session; the previous conversation cannot be restored.^1^
2. Temporarily publish or route a version that can answer a simple prompt without invoking either MCP tool.
   • If that also creates no trace and times out, investigate endpoint authorization/networking below.
   • If it responds, but a tool-required prompt fails, proceed to the published identity and MCP checks.
3. Confirm tracing is enabled for the project and that the connected Application Insights resource is accessible. Without that setup, an empty trace view does not prove that Teams never reached Foundry.^2^

Teams invokes the published application through the Activity Protocol, not the Responses API used by direct application tests.^3^

2. Check endpoint authorization

Inspect the published agent endpoint’s authorization_schemes. If it contains BotServiceRbac, store visibility does not grant invocation permission.

• For selected users, assign Foundry Agent Consumer at the agent or project scope—not merely Foundry User on the underlying development resource.
• For tenant-wide access, publish with People in your organization, obtain Microsoft 365 administrator approval, and then replace BotServiceRbac with BotServiceTenant using the documented PATCH procedure.
• Do not configure both Bot Service schemes.^4^

For one selected user, the documented agent-scope assignment is:

AGENT_SCOPE="/subscriptions/[Subscription ID] ID]/resourceGroups/[Resource Group] Group]/providers/Microsoft.CognitiveServices/accounts/<account-name>/projects/<project-name>/agents/<agent-name>"

az role assignment create \
  --assignee-object-id "<user-object-id>" \
  --assignee-principal-type User \
  --role "eed3b665-ab3a-47b6-8f48-c9382fb1dad6" \
  --scope "$AGENT_SCOPE"

Allow several minutes for propagation, then reset the Teams conversation and retest.^4^

3. Check networking if public access is disabled

If the Foundry project disables public network access, Teams traffic does not use Private Link. The REST publishing configuration must set:

{
  "agent_endpoint": {
    "protocol_configuration": {
      "activity": {
        "enable_m365_public_endpoint": true
      }
    }
  }
}

Microsoft 365 and Teams use this source-IP-filtered public Activity Protocol route. A missing or false setting can produce 403 NetworkAccessDenied at the channel adapter.^5^

4. After Teams reaches Foundry, validate the published identity

Publishing creates a dedicated agent identity; permissions assigned to the project identity do not transfer automatically.^6^

Retrieve the published application’s agentIdentityId, then grant that principal the downstream permissions required by the Logic Apps MCP connection. For an MCP server that triggers Logic Apps, Microsoft lists Logic Apps Standard Operator on the Logic App resource as the common role assignment.^6^

Also check the Teams conversation for an MCP approval card. If approval was dismissed or missed, start a new conversation and approve the pending request.^1^

The two registry entries and the Teams entry’s empty tool display do not, by themselves, establish whether tool discovery failed. The decisive evidence is the Activity Protocol request, endpoint authorization, and—once a trace exists—the MCP tool-discovery/tool-call result.

5. Formatting fallback

If traces eventually show successful execution and the direct endpoint works, but Teams still fails while rendering the answer, test plain-text output without Markdown tables, citation markup, or complex layouts. That resolved a similar Teams/Copilot case, but that case had successful endpoint execution and therefore does not explain the current no-trace symptom.^7^

Published agents formally do not support streaming responses or citations.^5^

References

1. Troubleshoot publishing agents to Microsoft Copilot and Microsoft Teams
2. Agent tracing overview - Microsoft Foundry | Microsoft Learn
3. Publish your agent as an Agent Application
4. Troubleshoot authorization errors for agents published to Microsoft Copilot and Teams
5. Publish agents to Microsoft 365 and Teams by using the REST API ...
6. Agent identity concepts in Microsoft Foundry
7. Published Azure AI Foundry Agent not working in Teams when adding tools like AI Search - Microsoft Q&A