fix: validate caller app on Entra inbound Agent ID tokens

[Corina (corinagum)]

Summary

Inbound activities authenticated with an Entra (Agent ID) token are now accepted only when the token was requested by the Agent 365 platform. The caller app is read from azp, falling back to appid for v1 tokens, and compared case-insensitively. Tokens from any other client app are rejected with 401. Bot Framework tokens are unaffected.

Changes

InboundActivityTokenValidator checks the caller app after Entra token validation succeeds.

Behavior change

Entra-authenticated activities sent from any app other than the Agent 365 platform (for example, a custom client or another bot calling the bot's endpoint directly with an Entra token) now receive 401.

Testing

• Unit tests for allowed azp, allowed appid, case-insensitive match, azp precedence, disallowed azp, disallowed appid, missing caller claims, and Bot Framework tokens unaffected.
• Verified locally end to end: an Entra token from a different app registration with the bot as audience returns 401, and the activity is not processed.

[Copilot]

🟡 Changes recommended

Malformed azp values can incorrectly fall back to an allowed appid.

1 open finding

• Reject malformed azp instead of falling back to appid · New

What changed in this PR

Restricts Entra-authenticated inbound activities to the Agent 365 platform.

Changes:

• Validates azp, with appid fallback.
• Adds caller-validation and Bot Framework regression tests.

File	Description
inbound-activity-token-validator.ts	Adds caller-app authorization.
inbound-activity-token-validator.spec.ts	Tests accepted and rejected callers.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.