Summary

Teams channel does not deliver messages to my bot's /api/messages endpoint when the endpoint is hosted behind a Cloudflare → AWS NLB → Emissary (Envoy) reverse-proxy stack. The same bot, same manifest, same AAD App, and same Azure Bot registration work correctly when the messaging endpoint is switched to an ngrok tunnel pointing at a local instance of the same code.

Environment

• @microsoft/teams.apps (latest)
• Bot Type: Single Tenant
• Channels enabled: Microsoft Teams, Web Chat, Direct Line (all "Healthy")
• Production endpoint path: https://<host>/api/messages behind:
  • Cloudflare (no custom WAF rules, Security Level disabled, Bot Fight Mode off)
  • AWS Network Load Balancer
  • Emissary Ingress (Envoy)
  • linkerd-proxy sidecar
  • Express + @microsoft/teams.apps SDK

Behaviour matrix

What I verified

• botId, webApplicationInfo.id, webApplicationInfo.resource all consistent and match the Azure Bot's MicrosoftAppId.
• AAD App configured (Single Tenant, secrets valid).
• Tenant ID configured on Azure Bot matches the Teams user's tenant.
• Messaging endpoint configured on Azure Bot points to the deployed URL.
• validDomains contains the deployed host.
• teams app doctor runs cleanly except for unrelated SSO setup warnings (we don't use SSO).
• Cloudflare admin confirmed no WAF / IP rules / Bot Fight Mode are active.
• Teams app is sideloaded via Developer Portal "Preview in Teams"; sending a message in Teams shows the "delivered" checkmark.

Diagnostic logs (Azure Bot)

Enabled BotRequest diagnostic settings to a Log Analytics workspace.

• 0 entries with ChannelId == "msteams" for inbound activities.
• Only Channel: service entries (control-plane API calls).

So ABSBotRequests does not appear to capture Teams channel inbound delivery attempts when they fail.

Workaround currently in use

Pointing the messaging endpoint at an ngrok tunnel of a local instance is reliable. Production deployment behind the proxy stack is blocked.