[Bug] Targeted Messages (devPreview) returns 403 THREADACCESSDENIED-209 on all thread types including valid @thread.v2 group chats

[Splashing23]

Steps to reproduce

1. Enable Teams public developer preview on the desktop client
   (Settings > About Teams > Developer Preview)

2. Create an app manifest with the following bot configuration:

   {
   "manifestVersion": "devPreview",
   "$schema": "https://raw.githubusercontent.com/OfficeDev/microsoft-teams-app-schema/preview/DevPreview/MicrosoftTeams.schema.json",
   "bots": [
   {
   "botId": "{{BOT_ID}}",
   "scopes": ["personal", "team", "groupChat"],
   "supportsTargetedMessages": true
   }
   ]
   }

3. Sideload the app package into a tenant with developer preview enabled.

4. Create a standard group chat (3+ human participants, resulting in a
   thread ID of the form 19:xxxxx@thread.v2).

5. Add the bot to the group chat via the Apps (+) button.

6. In the group chat compose box, type "/" — the bot appears correctly
   in the slash command autocomplete menu.

7. Select the bot from the slash command menu, type a message, click Send.

8. Teams client shows "Failed to send." immediately. The bot endpoint
   receives no activity whatsoever.

9. Confirmed via Teams desktop DevTools
   (Engineering Tools > Open Dev Tools > Network tab):

   POST https://teams.microsoft.com/api/chatsvc/amer/v1/users/ME/
   conversations/{conversationId}/targetedmessages
   Status: 403 Forbidden
   Response header: mfeDiagCode: 002-THREADACCESSDENIED-209

Docs reference:
https://learn.microsoft.com/en-us/microsoftteams/platform/agents-in-teams/targeted-messages

Expected behavior

The targeted message POST to /targetedmessages should succeed (HTTP 200/201)
for a valid @thread.v2 group chat where all of the following are true:

• The sending user's Teams client is in developer preview mode
• The bot app manifest includes "supportsTargetedMessages": true
  with manifestVersion "devPreview"
• The bot is installed as a member of the group chat
• The conversation thread is a standard group chat
  (not a meeting chat, not a 1:1)

The bot should receive the targeted message activity with isTargeted: true
on its messaging endpoint, per the documentation linked above.

Actual behavior

The POST to /targetedmessages returns HTTP 403 Forbidden with
mfeDiagCode: 002-THREADACCESSDENIED-209 on ALL thread types tested,
including the correct @thread.v2 group chat. The bot endpoint receives
zero traffic. "Failed to send." appears immediately in the Teams client UI.

Three thread types were tested — all return the identical error:

Thread type 1 — Meeting chat (19:meeting_xxxxx@thread.v2):
Expected: documented as unsupported, 403 is acceptable here
Actual: 403, mfeDiagCode: 002-THREADACCESSDENIED-209 ✓ expected

Thread type 2 — 1:1 chat (19:userA_userB@unq.gbl.spaces):
Expected: documented as unsupported, 403 is acceptable here
Actual: 403, mfeDiagCode: 002-THREADACCESSDENIED-209 ✓ expected

Thread type 3 — Standard group chat (19:xxxxxxxxxxxxxxxx@thread.v2):
Expected: 200/201 — this is the documented supported thread type
Actual: 403, mfeDiagCode: 002-THREADACCESSDENIED-209 ✗ BUG

The slash command UI works correctly (bot appears in autocomplete),
confirming the manifest is being read. The failure is entirely server-side
at the msgapi ACL layer, not client-side or manifest-related.

Teams client version: 26149.1207.4799.7632 (clientVer: 49/26052906114)
OS: Windows NT 10.0

Error details

=== Trace 3: Standard group chat — the critical failure ===

Request:
POST https://teams.microsoft.com/api/chatsvc/amer/v1/users/ME/
conversations/19%3Axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%40thread.v2/
targetedmessages

Status: 403 Forbidden
Remote Address: 52.123.130.14:443

Response Headers:
contextid: tcid=0,server=msgapi-production-scus-13-0,
cv=HMM4V+Yb+Ema2by0Pu2nFg.0,
mfeDiagCode: 002-THREADACCESSDENIED-209
ms-cv: HMM4V+Yb+Ema2by0Pu2nFg.0
date: Tue, 16 Jun 2026 20:59:30 GMT
content-type: application/json; charset=utf-8

=== Trace 1: Meeting chat (for completeness) ===

contextid: mfeDiagCode: 002-THREADACCESSDENIED-209
ms-cv: jr42UFIjhUGFl37xjCX0tw.0
date: Tue, 16 Jun 2026 20:50:55 GMT

=== Trace 2: 1:1 chat (for completeness) ===

contextid: mfeDiagCode: 002-THREADACCESSDENIED-209
ms-cv: RkIujLyzMUSGChB4p31Exg.0
date: Tue, 16 Jun 2026 20:58:04 GMT

=== Environment ===
Teams client: 26149.1207.4799.7632
clientVer: 49/26052906114
OS: Windows NT 10.0
Client mode: Developer Preview enabled
Manifest version: devPreview
supportsTargetedMessages: true (confirmed in manifest)
Bot installed in chat: yes, confirmed before testing
Token scope: Teams.AccessAsUser.All (confirmed in JWT scp claim)
x-ms-test-user: False

[microsoft-github-policy-service]

Hi @Splashing23! We will investigate and if we require further information we will reach out to you. Please use this link to escalate if you don't get replies in two working days.

Best regards, Teams Platform

[m365-agent-toolkit-assistant]

👋 Hi @Splashing23,

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 1 business day

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

Classification: Upstream — your repro matches documented support, so the 403 on a valid @thread.v2 group chat points to a Teams service/ACL regression rather than manifest or bot code.

• Learn says targeted messages are supported in channels, group chats, and meeting chats, and only 1:1 chats are excluded. It also requires supportsTargetedMessages: true, which you already set.
• The slash command appearing in autocomplete is consistent with the manifest being recognized.
• The failure occurs before any bot activity is delivered, and the response comes from chatsvc/.../targetedmessages with mfeDiagCode: 002-THREADACCESSDENIED-209, which is consistent with a server-side access check failure.
• I did not find a separate similar open issue in the searched repos yet.

Upgrade check: No client/SDK changelog fix was found to verify a workaround version.

What to do now:

1. Escalate as a Teams platform incident with the captured ms-cv, contextid, timestamp, region, and conversation type.
2. Include that docs currently state group chat + meeting chat support.
3. Use 1:1 fallback while preview is blocked.

Useful links:

• No similar issues found in the searched repos.
• https://learn.microsoft.com/microsoftteams/platform/agents-in-teams/targeted-messages

If you want, I can help draft the escalation note.

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!

[Splashing23]

Yes please, draft the escalation note. Here is the additional context:

• The issue reproduces consistently across all three thread types tested
  (meeting chat, 1:1 chat, and standard group chat @thread.v2)
• The @thread.v2 group chat is the documented supported type and still fails
• All three failures return the identical mfeDiagCode: 002-THREADACCESSDENIED-209
• The bot is confirmed installed in the group chat prior to testing
• Developer Preview is confirmed enabled on the client
• supportsTargetedMessages: true is confirmed in the devPreview manifest
• The slash command autocomplete works correctly, confirming manifest is read
• The bearer token carries Teams.AccessAsUser.All scope (confirmed via JWT)
• No bot activity is received on the bot endpoint in any of the three cases
• This blocks all testing of the targeted messages developer preview feature

ms-cv correlation vectors for server-side log lookup:
Group chat (@thread.v2): HMM4V+Yb+Ema2by0Pu2nFg.0 (2026-06-16T20:59:30Z)
1:1 chat (@unq.gbl.spaces): RkIujLyzMUSGChB4p31Exg.0 (2026-06-16T20:58:04Z)
Meeting chat (@thread.v2): jr42UFIjhUGFl37xjCX0tw.0 (2026-06-16T20:50:55Z)

Teams client: 26149.1207.4799.7632 / clientVer 49/26052906114
Region: AMER (confirmed from chatsvc URL)
Date: 2026-06-16

[sayali-MSFT]

Hello @Splashing23 ,Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[sayali-MSFT]

Hello @Splashing23,
Thank you for your patience! We were able to reproduce the issue. We have reported this as a bug for further investigation.

We will keep you updated as soon as we receive further information. Thank you for bringing this to our attention!