Bot Service in Azure: Building Helpful Assistants That Talk to Your Customers
A beginner-friendly guide to Azure Bot Service: what bots are, how messages travel from chat apps to your code, how channels, state, dialogs and language services fit together, and how to build, secure and run a bot in the cloud.
Imagine a hotel with one very busy front desk. Guests keep asking the same questions: what time is breakfast, how do I get Wi-Fi, can I book a taxi, where is the swimming pool. The receptionist answers politely each time, but the queue grows, and guests who ask at midnight find nobody there. Now imagine a helpful assistant who stands beside the receptionist, answers the common questions instantly at any hour, takes taxi bookings, and calls the receptionist only when a guest needs a real person. That assistant is what we call a bot, and Azure Bot Service is the part of Azure that helps you build, connect and run such assistants.
In this guide we will learn Azure Bot Service from the very beginning. You do not need any earlier experience with bots, artificial intelligence or programming. Each new word will be explained when it first appears, with a simple comparison from everyday life. By the end, you will understand how a bot is built, how people reach it through apps such as Microsoft Teams or a website, how it remembers a conversation, and how to keep it secure, helpful and affordable.
1What Is a Bot, and What Is Azure Bot Service?
A bot is a program that holds a conversation, and Azure Bot Service connects that program to the places where people chat.
Let us start with the basic words. Azure is Microsoft’s cloud platform, a large collection of computers in data centers that you rent when you need them. A bot is a software program that talks with people through text, buttons or speech. You may already have met bots: the chat window on a shopping website that asks “How can I help you?”, or the assistant in a messaging app that reminds you of appointments.
Building a bot involves two different jobs. The first job is the brain, the code that decides what to say in reply. The second job is the connection: making the bot reachable from many chat places, handling identity and security, and passing messages back and forth reliably. Azure Bot Service focuses on the second job. It registers your bot in Azure, gives it an identity, and connects it to channels, which are the apps and websites where users actually type their messages. Your own code, hosted somewhere in Azure, supplies the brain.
Bots are typically built with the Bot Framework SDK, a software development kit, which is a bundle of ready-made code pieces that makes common bot tasks easier. It supports languages such as C# and JavaScript, and also Python and Java in the past. Microsoft’s bot tools have been evolving, and newer offerings such as Microsoft Copilot Studio and the Microsoft 365 Agents SDK now appear alongside them, so always check current guidance before starting a new project.
Think of a telephone exchange. Callers use many different phone companies, but the exchange connects every call to the right desk. Azure Bot Service is the exchange: it receives messages from many chat apps and delivers them to your bot’s desk. Your code is the clerk at the desk who reads each message and writes the reply.
2Kinds of Bots: From Simple Menus to Smart Assistants
Bots range from fixed button menus to assistants that understand free text and write their own answers.
Not every bot needs to be clever. Choosing the right style for your problem saves time and money. Here are the common styles, from simplest to most advanced.
Rule-based bots
These follow a fixed script. The bot offers buttons or exact commands, such as “Press 1 for opening hours”. They are predictable, easy to test and cheap, but they cannot cope with questions outside the script.
FAQ bots
These match a user’s question to a prepared list of questions and answers. If someone types “when do you open?”, the bot finds the closest question and returns the saved answer. They work well for support content that does not change much.
Intent-based bots
These use language understanding to find the user’s goal, called an intent, and the key details, called entities. For “Book a table for four on Friday”, the intent is booking, and the entities are four people and Friday.
Generative bots
These use large language models to write flexible, natural replies. When linked to your own documents, they can answer questions about your products using up-to-date company information. They need extra care about accuracy, safety and cost.
| Style | How It Decides | Strength | Weakness |
|---|---|---|---|
| Rule-based | Fixed script and buttons | Predictable and cheap | Rigid |
| FAQ | Matches to saved answers | Quick to set up | Limited to known questions |
| Intent-based | Finds intent and entities | Handles tasks with details | Needs example phrases to train |
| Generative | Language model writes replies | Flexible and natural | Needs guardrails and checking |
A rule-based bot is like a vending machine: press the exact button and receive the exact item. An FAQ bot is like a help leaflet. An intent-based bot is like a trained waiter who understands “something light and vegetarian, please”. A generative bot is like an experienced concierge who can chat about almost anything, and therefore needs training and supervision.
3The Big Picture: How the Pieces Fit Together
A message travels from the user, through a channel and the Bot Service, to your code and back.
Before studying each part, let us look at the whole journey. When a user types a message in a chat app, the app is a channel. The channel sends the message to the Bot Connector, which is the relay service built into Azure Bot Service. The connector checks the bot’s identity and forwards the message, wrapped in a standard format, to your bot’s web address. Your code, running on a hosting service, reads the message, perhaps asks other services for help, and sends a reply back through the same path.
flowchart LR
U["User"] --> CH["Channel: Teams, web page, other apps"]
CH --> BS["Azure Bot Service: connector and identity"]
BS --> BC["Your bot code on Azure hosting"]
BC --> L["Language and AI services"]
BC --> D["Storage for conversation state"]
BC --> BS
BS --> CH
Channel
The place where the user chats, such as Teams or a website chat window.
Azure Bot resource
The registration in Azure that gives your bot an identity and connects it to channels.
Bot code and hosting
Your program, running on a service such as Azure App Service, which holds the logic of the conversation.
Supporting services
Language understanding, search, generative AI and storage that make the bot smarter and give it memory.
It is like sending a letter through a postal system. The sender uses a letterbox, which is the channel. The postal service checks the address and delivers it, which is the Bot Service. The receiver at the destination reads and answers, which is your code, and the reply returns by the same route.
4The Azure Bot Resource and Bot Identity
The Azure Bot resource is the official registration that tells Azure who your bot is and where to send messages.
When you create an Azure Bot resource, you register your bot with a few key details. The most important are an identity and a messaging endpoint.
Bot identity (app registration)
Each bot has a Microsoft Entra application identity, with an application ID. This proves that messages really come from and go to your bot. The identity can be secured with a secret, a certificate or, preferably, a managed identity that Azure manages for you.
Messaging endpoint
This is the secure web address of your running bot code, for example on Azure App Service. The Bot Connector sends every incoming message to this address.
There are different identity types. Single-tenant bots belong to one organization’s directory. User-assigned managed identity bots use an Azure-managed identity, which removes the need to store and rotate secrets. Older multi-tenant bot creation has been phased out for new bots, so current guidance favors single-tenant or managed identity. Since options change, always check the latest documentation when creating a bot.
Registering a bot is like registering a business. The identity is its registration certificate, proving who it is. The messaging endpoint is its street address, so the post office knows where to deliver letters.
Registering the bot with a wrong or outdated messaging endpoint, for example after moving the hosting. The bot then seems silent, because messages are delivered to an address where nothing is listening. Update the endpoint whenever hosting changes.
A managed identity removes passwords that could leak or expire. When possible, choose it so that your bot’s credentials are handled by Azure.
5Channels: Meeting Users Where They Are
A channel is a connection between your bot and a chat application, so one bot can serve many audiences.
People use different tools to chat, and a good bot meets them there. Azure Bot Service supports many channels, and you add them to the same bot with a few settings, without rewriting your code for each one. Available channels change over time, so check the current list, but common ones include the following.
Microsoft Teams
Lets employees chat with the bot inside the app they already use all day, ideal for internal helpdesks.
Web Chat
A chat window you embed in your website, so visitors can talk to the bot on your own pages.
Direct Line
A programming interface that lets your own mobile app, desktop program or device talk to the bot, with full control of the look and feel.
Messaging apps
Connectors for popular consumer messaging services, subject to each provider’s rules and approvals.
SMS and voice
Reach people through text messages or phone calls using partner services and speech features.
Lets the bot read and answer emails for slower, less urgent conversations.
Each channel has its own abilities. Some show rich cards and buttons, some show only plain text, and some limit message length. Your bot should be written to work gracefully when a channel cannot show a fancy feature.
Channels are like the different doors of a shop: the street entrance, the side door for staff, the delivery hatch and the telephone line. The same shopkeeper serves everyone, but how each customer reaches the counter differs.
A reply that looks perfect in the web chat window may appear differently in Teams or as a text message. Test the bot on every channel you plan to support.
6Activities and Turns: How a Conversation Moves
Every message and event is wrapped in a standard package called an activity, and each exchange is a turn.
Bots talk in a common format so that every channel looks the same to your code. This format is called an activity. An activity is a small package of information, sent over the web, that says what happened. The most common activity is a message, which holds the text a user typed. But there are other kinds, such as a notice that a user has joined the conversation, a typing indicator, or a custom event.
Each time the bot receives an activity and handles it, one turn of the conversation takes place. A turn is like one round of ping-pong: the user sends something, the bot responds. A conversation is a series of turns, and an important detail is that the bot’s code does not stay running between turns. It wakes up for each activity, does its work and finishes. This is why remembering things between turns needs special care, which we discuss next.
sequenceDiagram
participant U as User
participant C as Channel
participant S as Bot Service
participant B as Bot Code
U->>C: Types a message
C->>S: Sends the message
S->>B: Delivers an activity over HTTPS
B->>B: Runs handlers and logic
B-->>S: Sends reply activity
S-->>C: Passes reply along
C-->>U: Shows reply
Message activity
Carries text, attachments or cards sent by the user or the bot.
Conversation update
Announces that someone joined or left the conversation, a good moment to send a welcome message.
Typing
Shows that someone is typing, which makes the conversation feel natural.
Event
Carries custom information that is not a normal chat message, such as a signal from your website.
An activity is like a standard envelope used by every post office. No matter which town a letter comes from, your clerk knows where to find the address, the sender and the letter inside.
7The Bot Framework SDK: Core Building Blocks
The SDK supplies ready-made pieces so you write only the conversation logic.
The Bot Framework SDK handles tedious work such as checking identity tokens, parsing activities and sending replies. You focus on what the bot should say. Several core ideas appear in every bot built with it.
Adapter
The adapter is the doorman of your bot. It receives incoming web requests, checks that they are genuine, turns them into activities, and sends your replies back out.
Turn context
For each turn, the SDK creates a turn context, a small package that holds the incoming activity and gives you tools to reply and to read or save information.
Activity handler
The handler is the part you write. It has simple methods that react to each kind of activity, such as “when a message arrives, do this” and “when someone joins, send a welcome”.
Middleware
Middleware are small helpers that sit in the path of every message, before and after your handler. They are used for tasks like logging every conversation, translating languages or checking for abusive content.
Imagine a hotel reception. The doorman checks each visitor, which is the adapter. The visitor’s file is brought to the desk for each visit, which is the turn context. The receptionist deals with the request, which is the handler. Security cameras and a translator in the lobby are the middleware.
Microsoft’s bot tooling is evolving, and newer options such as the Microsoft 365 Agents SDK and Copilot Studio exist. The concepts in this guide remain useful, but check the official documentation before deciding which SDK to start a new project with.
8State and Storage: Giving the Bot a Memory
Because bot code forgets everything between turns, any information it needs later must be saved.
We learned that the bot’s code runs only for each turn. If a user says “my name is Asha” in one turn and asks “what is my name?” in the next, the bot must have saved the name somewhere. This saving is called state management. The SDK provides simple tools for it.
Conversation state
Information tied to one conversation, such as which step of a booking the user is on.
User state
Information about a person that follows them across conversations on a channel, such as language preference.
Private conversation state
Information tied to one user inside one conversation, useful in group chats.
Where the state is stored
State must live in a storage service. Memory storage keeps it only inside the running program, which is fine for learning but lost on a restart and not suitable when several copies of the bot run. For real bots, teams use durable storage such as Azure Blob Storage or Azure Cosmos DB, which survive restarts and can be shared by many copies of the bot.
A bot without saved state is like a shop assistant with no notebook who forgets every customer the moment they walk away. State is the notebook: conversation state is the note about the current customer, and user state is the loyalty card that remembers them next time.
Using in-memory storage in production. When the hosting restarts or scales out to several copies, every conversation forgets its progress, and users are forced to start again. Use durable storage for live bots.
Avoid saving sensitive personal information in state unless truly required, and set sensible limits on how long stored conversations are kept.
9Dialogs and Conversation Design
Dialogs guide a user through a multi-step conversation, one question at a time.
Many tasks need several pieces of information: to book a flight you need the origin, destination and date. A dialog is a reusable piece of conversation that asks for these step by step, checks each answer, and saves progress. A common type is the waterfall dialog, a series of steps where the output of one step flows into the next, like water falling down a stepped waterfall.
flowchart TD
S["User asks to book a table"] --> Q1["Ask: how many people?"]
Q1 --> V1{"Valid number?"}
V1 -- No --> Q1
V1 -- Yes --> Q2["Ask: which date and time?"]
Q2 --> V2{"Valid date?"}
V2 -- No --> Q2
V2 -- Yes --> C["Confirm details with the user"]
C --> Y{"User agrees?"}
Y -- Yes --> D["Make booking and send confirmation"]
Y -- No --> Q1
The SDK includes prompts, ready-made steps that ask for specific kinds of answers such as numbers, dates, choices or yes and no, and that re-ask politely when the answer is not valid. Dialogs can start other dialogs, so you can build a library of small conversations, such as signing in, collecting an address or confirming a payment, and reuse them in many bots.
Principles of good conversation design
Say what the bot can do
Start with a short welcome that lists a few things the bot can help with, so users know what to ask.
Ask one thing at a time
Short questions get better answers than long messages with many requests inside.
Handle mistakes kindly
When the bot does not understand, say so, offer examples or buttons, and never loop endlessly.
Allow escape routes
Let users cancel, restart, or ask for a human at any time.
A waterfall dialog is like filling a paper form with a helpful clerk. The clerk asks for one field at a time, checks that it is filled correctly, and passes you to the next field, only finishing when the whole form is complete.
10Rich Messages: Cards, Buttons and Suggested Actions
Buttons and cards make a bot easier to use than plain text alone.
Typing is slow, especially on a phone. Bots can send more than text to make life easier for users.
Suggested actions
A row of quick-reply buttons, such as “Track my order” and “Talk to a person”, that disappear after the user picks one. They guide users and reduce typing mistakes.
Hero and thumbnail cards
Simple cards with a title, picture, short text and buttons, suited to showing a product or an option.
Adaptive Cards
A flexible card format described in a simple data layout that adapts to the look of each channel. They can show forms with text boxes, date pickers and buttons, letting users fill in several fields in one go.
Attachments and carousels
Files, images or a sideways-scrolling list of cards, handy for browsing several choices.
Some channels show cards, others show only text. Provide a clear text fallback so the conversation still works everywhere.
Putting too many buttons or too much text in a single message. On a small screen, users get overwhelmed. Keep messages short and options few.
11Understanding Language: Intents, Entities and Answers
Language services help a bot understand free text without a rigid script.
People never type the exact words a programmer expected. They write “I need to change my flight”, “can I move my booking?” or “reschedule please”, all meaning the same thing. Azure offers language services that learn to understand these variations.
Conversational language understanding
Part of Azure AI Language. You provide example phrases for each intent, and the service learns to find the intent and entities in new messages. It replaced the older LUIS service, which has been retired.
Custom question answering
Builds a knowledge base from your documents, web pages and question lists, and returns the best-matching answer to a user’s question.
Translation
Lets a bot serve people in many languages by translating messages in and out.
Speech
Converts speech to text and text to speech, so people can talk with the bot instead of typing.
Collect examples
Gather real phrases people use for each goal, because real wording trains better than invented wording.
Train and test
Train the model, then test it with new phrases it has never seen to see how well it understands.
Connect to the bot
The bot sends each user message to the service, reads the intent, and routes the user to the right dialog or answer.
Improve from real use
Review messages the bot misunderstood, add them as examples and retrain, so quality grows over time.
Language understanding is like training a new receptionist. You show many example requests and which department each should go to. After enough examples, the receptionist can route even oddly phrased requests correctly.
12Generative AI and Grounded Answers
Language models can write natural replies, but they need your own data and guardrails to stay accurate.
A large language model is an AI system trained on huge amounts of text that can write human-like replies. Services such as Azure OpenAI make these models available in Azure. A bot can pass the user’s question to a model and relay the answer. But a model on its own does not know your company’s private information, and it can sometimes produce confident but wrong statements.
A popular solution is retrieval-augmented generation, or RAG. In this pattern, the bot first searches your own documents, for example using Azure AI Search, finds the most relevant passages, and gives them to the model together with the question. The model then writes an answer based on those passages, and the bot can show which documents were used. This keeps answers closer to your real information and makes them easier to check.
Receive the question
The user asks something such as “What is your refund policy for online orders?”
Search your documents
The bot finds the relevant passages in your policy documents using a search service.
Ask the model with context
The model receives the question plus the passages and is told to answer only from them.
Reply and cite
The bot answers in natural language and points to the source documents, so users can verify the information.
RAG is like an open-book exam. Instead of answering from memory and risking mistakes, the student first looks up the relevant pages in the textbook and then writes the answer using them. The answer is more reliable, and the student can point to the page.
Letting a generative bot answer anything with no limits. It may invent information, discuss unrelated topics or reveal sensitive details. Use grounding, clear instructions, content safety filters and testing.
13Signing Users In and Sending Proactive Messages
Bots can act on behalf of a signed-in user and can also start conversations themselves.
User sign-in with OAuth
Some bots must access private data, such as a user’s calendar or order history. For this, the bot needs the user’s permission. Azure Bot Service supports OAuth connections, a standard way of signing in without sharing passwords with the bot. The user is shown a sign-in screen from the identity provider, such as Microsoft Entra ID, approves the access, and the bot receives a token that it can use for a limited time.
OAuth is like a hotel key card. You prove who you are at the front desk, and receive a card that opens only your room and expires on checkout. The bot gets the card, not your master password.
Proactive messages
Normally a bot only speaks when spoken to. A proactive message lets the bot start the conversation, for example sending a reminder, a delivery update or an alert. To do this, the bot must have saved a reference to the conversation earlier, and the channel must allow it. Many channels have rules to prevent unwanted messages, so use proactive messages carefully and only where users expect them.
Sending too many unrequested messages annoys users and may break channel rules. Give users control to opt out, and keep notifications useful and rare.
14Hosting and Deployment
Your bot code needs a place to run, and Azure offers several choices.
The Azure Bot resource only registers and connects the bot. The code itself must run somewhere that exposes a secure web address. Common choices include the following.
| Hosting Option | Good For | Notes |
|---|---|---|
| Azure App Service | Most bots, simple deployment | Fully managed web hosting with scaling and slots |
| Azure Container Apps | Bots packaged as containers | Scales automatically, including to zero in some setups |
| Azure Functions | Light, event-driven bots | Pay per use, but check cold-start delay |
| Azure Kubernetes Service | Large, complex systems | Most control, most effort |
Build and test locally
Run the bot on your own computer and test it with the Bot Framework Emulator.
Create the Azure resources
Create the hosting, the bot identity and the Azure Bot resource, and set the messaging endpoint.
Deploy the code
Publish the bot to the hosting, ideally using an automated pipeline so deployments are repeatable.
Add channels and test again
Connect the channels you need, and test on each one using the real environment.
Release gradually
Use a test copy first, then roll out to a small group of users before opening to everyone.
Keep different copies for development, testing and production, each with its own bot identity and settings. This prevents experiments from disturbing real users.
15Testing Your Bot
Several tools let you try a bot before real users ever see it.
Bot Framework Emulator
A desktop program that lets you chat with a bot running on your own computer and inspect every activity sent and received.
Test in Web Chat
A quick chat window in the Azure portal that tests the deployed bot through the real Bot Service.
Tunnels
Services that give your local computer a temporary public address so channels can reach a bot you are still developing.
Automated tests
Programs that replay scripted conversations to check that important paths still work after every change.
Good testing covers more than the happy path. Try misspellings, very long messages, empty messages, changing your mind halfway, and questions the bot was never designed for. Real users will do all of these.
Testing a bot is like rehearsing a play. You do not only practice the perfect performance; you also practice what happens if an actor forgets a line or the lights fail, so the show survives real life.
16Security and Privacy
A bot talks to many people and often touches private data, so security must be designed in from the start.
Protect the bot identity
Use managed identities or certificates where possible, store any secrets in Azure Key Vault, and never place them in code or public repositories.
Verify every incoming request
The SDK checks tokens on messages arriving at the bot’s endpoint. Do not bypass this check, or anyone could send fake messages to your bot.
Embed web chat safely
For websites, exchange a secret for a short-lived token on your own server instead of placing the Direct Line secret in web page code.
Limit what the bot can do
Give the bot’s identity only the permissions it needs on databases and other services, following the rule of least privilege.
Respect privacy
Tell users they are talking to a bot, avoid collecting unneeded personal data, redact sensitive details from logs and follow your organization’s data rules.
Pasting the Direct Line secret into a web page so that the chat window works quickly. Anyone viewing the page source can copy it and use your bot as they like. Always use tokens issued by your own server.
For sensitive systems, Azure offers options such as private networking for bots, so that traffic between the bot service and your hosting does not cross the public internet. Check current documentation for the options supported.
17Monitoring, Logging and Analytics
Watching how people use the bot tells you what to improve.
After launch, the real work begins: finding out whether the bot actually helps. Azure offers several ways to look at a bot’s behavior.
Application Insights
Collects errors, response times and custom events from your bot code, and lets you build charts and alerts.
Conversation transcripts
Saved records of conversations, stored with care for privacy, used to review misunderstandings.
Bot Service metrics
Shows the number of messages and channel activity, helping you see growth and busy periods.
Custom measures
Events that you define, such as “booking completed” or “user asked for a human”, which measure real success.
Useful questions to ask of the data
How many conversations finish the task?
Completion rate shows whether the bot really solves the problem it was built for.
Where do users give up?
Find the steps where many users leave or repeat themselves, and redesign them.
What does the bot fail to understand?
Collect unrecognized messages and add them to training examples or the knowledge base.
How often do users ask for a human?
A high number points to topics where the bot needs improvement or should hand over earlier.
Transcripts may contain personal information. Redact or avoid storing sensitive details, restrict who can read logs and delete them after a sensible period.
18Handing Over to a Human
The best bots know their limits and pass the conversation to a person when needed.
No bot can solve everything. Some users are upset, some problems are unusual, and some requests involve money or health that deserve a human’s care. A well-designed bot includes human handoff, a smooth way to transfer the conversation to a live agent along with the history so the customer does not repeat everything.
When to hand off
When the user asks for a person, when the bot fails to understand several times in a row, when the user shows strong frustration, or when the topic is sensitive or high-risk.
How to hand off well
Tell the user what is happening, pass along a short summary of the conversation, show expected waiting time, and offer another way to reach the team if no agent is available.
A good assistant at a bank counter handles simple questions quickly. When a customer needs a loan decision, the assistant says, “Let me bring in my manager,” and briefs the manager first, so the customer does not need to explain everything again.
Trapping users in an endless loop of “I did not understand, please try again”. After a few failures, offer a human or another contact method. A trapped customer is an angry customer.
19Understanding the Cost
A bot’s bill is made of several small parts, and the biggest are usually hosting and AI services.
The Azure Bot resource offers a free tier and a standard tier, and the charges for the bot resource itself are usually small compared with the other parts. Pricing details, including how premium channels are charged, change over time, so always check the official pricing page. In practice, your total cost comes from these parts.
| Cost Part | What It Covers | How to Reduce It |
|---|---|---|
| Bot hosting | The service that runs your bot code | Right-size, and use scaling or pay-per-use options |
| Bot Service resource | Registration and channel connections | Use the free tier for development and testing |
| Language and AI services | Understanding language and generating answers | Route simple questions to cheaper methods, limit message size |
| Search and storage | Knowledge search, state and transcripts | Keep indexes tidy and delete old data |
| Monitoring | Logs and analytics | Set sensible retention and sampling |
Use the cheapest method that works
Answer common questions with buttons or FAQ matching, and use the language model only when needed.
Limit generative usage
Set limits on the length of questions, answers and the amount of retrieved text sent to the model.
Separate test and production
Use small, cheap resources for testing and switch them off when not needed.
Tag and set budgets
Tag resources by project and set budget alerts so usage surprises are caught early.
20Choosing the Right Approach
Azure offers several ways to build assistants, from low-code tools to full code.
Azure Bot Service with the Bot Framework SDK gives developers full control. But it is not the only route. Microsoft offers other options for different skills and goals, and the lineup changes often, so check what is current.
| Approach | Best For | Skill Needed |
|---|---|---|
| Azure Bot Service with SDK code | Custom bots that need full control over logic and integrations | Programming |
| Microsoft Copilot Studio | Low-code assistants built by business teams | Low |
| Microsoft 365 Agents SDK | Code-first agents that work across Microsoft 365 and other channels | Programming |
| Azure AI Foundry agent tools | Agents built around models, tools and your data | Programming or low-code |
flowchart TD
S["Need an assistant"] --> Q1{"Business team, little coding?"}
Q1 -- Yes --> CS["Consider Copilot Studio"]
Q1 -- No --> Q2{"Need full control of logic and hosting?"}
Q2 -- Yes --> BS["Azure Bot Service with SDK code"]
Q2 -- No --> Q3{"Mainly model-driven answers on your data?"}
Q3 -- Yes --> AF["Consider Azure AI Foundry tools"]
Q3 -- No --> BS
Microsoft has been moving its bot and agent tools toward newer products, and has announced changes to older tools. Before starting a long project, read the current documentation and announcements so that you build on a path with a future.
21Best Practices and Mistakes to Avoid
Habits that experienced teams follow, and traps that beginners often fall into.
Start with a narrow, clear purpose
Choose a handful of common tasks that the bot does very well, then grow from real usage.
Be honest that it is a bot
Say clearly that users are talking to an automated assistant and explain what it can do.
Keep identity and secrets safe
Use managed identity, Key Vault and short-lived tokens, and follow least privilege.
Use durable state and safe deployment
Store state in durable storage, use separate environments and automate releases.
Measure and improve continuously
Review transcripts and measures regularly, retrain language models and update knowledge sources.
Problem
A team tries to build a bot that can answer every possible question about the whole company from the first day.
Why It’s Harmful
The bot answers many things badly, users lose trust quickly, and the team cannot tell which parts work and which do not.
Correct Approach
Begin with a few high-value tasks, measure success, and widen the scope step by step based on real conversations.
Problem
A bot keeps conversation progress only in the program’s memory and runs on several hosting instances.
Why It’s Harmful
Each message may reach a different instance that knows nothing about the earlier steps, so users are asked the same questions again and again.
Correct Approach
Save conversation and user state in durable shared storage such as Blob Storage or Cosmos DB.
Problem
A generative bot is connected directly to a language model with no grounding, filters or limits, and released to the public.
Why It’s Harmful
It may invent facts, give unsafe advice, discuss off-topic subjects or expose private information, damaging trust and creating legal risk.
Correct Approach
Ground answers in approved documents, apply content safety filters, restrict the topics, add citations and a human handoff, and test with difficult questions before launch.
22Real-World Examples
Seeing how organizations use bots makes the ideas easier to remember.
An internal IT helpdesk in Teams
A company builds a bot inside Microsoft Teams that helps employees reset passwords, check the status of laptop requests and find software installation guides. Employees sign in through single sign-on, simple requests are solved instantly, and complicated ones create a ticket with the conversation attached.
A retailer’s website assistant
An online shop adds a web chat bot that tracks orders, explains return rules and suggests products. The bot uses buttons for common questions, calls the order system with the customer’s permission, and hands over to a human agent for complaints.
A bank’s FAQ and appointment bot
A bank uses custom question answering to answer questions on opening hours and account types, and a booking dialog to arrange branch appointments. Sensitive account actions are not done in chat but passed to secure, authenticated channels.
A university helping new students
A university runs a bot on its website and messaging apps that answers questions about admissions, fees and deadlines in several languages using translation. Generative answers are grounded in official documents and show which page they came from.
A city service for residents
A local government offers a bot where residents report problems such as broken streetlights and ask about waste collection days. Reports are collected through a guided dialog with location and photo, and staff receive them in their work system.
23Frequently Asked Questions
No. Azure Bot Service registers your bot, gives it an identity and connects it to channels. The logic of the conversation lives in your own code, hosted on a service such as App Service or Container Apps, or in a low-code tool that you choose.
A channel is a connection between your bot and a place where users chat, such as Microsoft Teams, a website chat window or a messaging app. One bot can be connected to several channels at once.
For bots using the Bot Framework SDK, yes, you need programming skills in a language such as C# or JavaScript. If you prefer low-code, tools such as Microsoft Copilot Studio let business users build assistants with less coding.
Because the bot’s code runs only for each turn, it saves information in state storage, such as Blob Storage or Cosmos DB. On the next turn, it loads that saved information and continues the conversation.
Yes. A bot can call language models, for example through Azure OpenAI. For reliable answers, it is best to ground the model with your own documents using search, add safety filters and keep clear limits on what the bot may do.
Use the Bot Framework Emulator on your computer, the Test in Web Chat tool in the Azure portal, and each real channel you plan to support. Also write automated tests and try unusual, misspelled and unexpected inputs.
The older LUIS service has been retired, and conversational language understanding in Azure AI Language is its recommended replacement. Always check the current documentation, because Azure services change over time.
Microsoft has announced changes to its bot tools and introduced newer options such as the Microsoft 365 Agents SDK and Copilot Studio. The ideas in this guide still apply, but read the latest official guidance before choosing a toolkit for a new, long-lived project.
24Summary and Key Takeaways
Azure Bot Service is the connection layer that lets conversational assistants reach users wherever they chat. It registers your bot with an identity, relays messages between channels and your code, and works together with hosting, storage and language services. You have learned the different kinds of bots, how a message travels as an activity during a turn, how the SDK’s adapter, handler and middleware work, and why state must be saved in durable storage. You have also seen how dialogs, cards, language understanding, generative AI with grounding, sign-in, testing, deployment, security, monitoring, handoff and cost fit together.
The best bots start small, do a few things very well, speak honestly about being a bot, protect user data, and keep improving based on real conversations. Because Microsoft’s bot and agent tools are evolving, review the current documentation before you commit to a long project, and design your conversation, data and security carefully so they remain valuable whichever toolkit you use.
Key Takeaways
- Bot Service connects, your code thinks — Azure Bot Service handles identity and channels, while your own code on Azure hosting supplies the conversation logic.
- Messages travel as activities — each user message and bot reply is one turn, and the bot’s code must save state in durable storage to remember across turns.
- Pick the right style of bot — rule-based, FAQ, intent-based or generative, depending on the problem, cost and risk.
- Design the conversation carefully — use dialogs, short messages, buttons and cards, handle mistakes kindly and always offer a path to a human.
- Ground generative answers — use retrieval from your own documents, safety filters and clear limits so replies stay accurate and safe.
- Secure and respect privacy — use managed identities, Key Vault, short-lived tokens, least privilege and careful handling of transcripts.
- Measure, improve and watch the roadmap — review conversations, retrain, control cost and check current Microsoft guidance as bot tools evolve.