To create a bot with the Microsoft Bot Framework SDK 4.x you will have to create an App Registration in Azure Active Directory with the Multitenant option enabled ("Who can use this application or access this API? => Accounts in any organizational directory").
If one does not take security measures within the bot code, everyone in the world will have access to that bot and can chat to it. What is generally helpful when designing public bots on the web channel is inconvenient when designing bots specifically for the MS Teams channel. Especially since guest users in the tenant often stumble upon those apps / bots, they may also start using them. The solution is to query the AD / MS Graph and check whether the current user has permissions to use it.
Is there any other way to restrict bot / app usage? If not, does anyone has a good best practice on how to restrict the bot within the code in a secure, reliable way without any side effects?
Thank you very much!