In skills that you target for group chats, you may wish to require authorization for users to send messages. Since multiple users may access the skill in a session, you need to configure the skill to properly handle authorization for each user, not just the user who first encounters the authorization state. You do this by using:

• The Requires Authorization property on states where you want to enforce authorization. This ensures that a user can't enter a message in the chat when it is at such a state until that user is authorized.
• The Authorize User event to direct unauthorized users to the appropriate authorization state when they try to enter a message in the chat at a secured state.
• The skill.system.event.value.authorizeUser.requestedState variable to identify the state at which an unauthorized user enter a message in the chat (and, therefore, the state where they should be redirected after successful authorization).
• The system.message.channelConversation.groupConversation Boolean property, which you can refer to when you need to determine whether the conversation is a group chat.

Here are the general steps for enforcing authorization for each user in a group chat:

1. Assuming that you will want to enforce authentication for the majority of the skill's states, configure the skill as a whole to require authorization by default. To do so:
   1. Click to open the side menu, select Development > Skills, and select your skill.
   2. In the skill’s left navigation, click .
   3. Click the Configuration tab.
   4. Set the Requires Authorization property to true.

   Doing this sets the default value for the Requires Authorization property for all of the states in the dialog flow. This value can be overridden on individual states.

2. For any states that do not require authorization, set the Requires Authorization property to false. For example:
   Note
   
   Alternatively, you can set the skill's Requires Authorization property to false and then set the Requires Authorization property to individual states to true.
3. Add an OAuth Account Link or OAuth 2.0 Account Link component in the dialog flow for user authentication.

   Use user-scoped variables to store the access token and authenticated user ID. Otherwise, the authorization info each user who joins the chat would override the authorization info the preceding user who joined the chat.

   For the pass transition, use the skill.system.event.value.authorizeUser.requestedState system variable to return the user to the state where they tried to enter the conversation.

4. Add the states for authorization failure. For example, you might have separate states for the following cases:
   • Where the failed authorization happens in a group chat. In this case, the user might not be able to authenticate, but the conversation can continue with the other participants.
   • Where the failed authorization happens in an individual chat, in which case the conversation can simply end.
     Note
     
     For this case, you can use the ephemeral custom channel property to display the message only to the user who is triggering that response.

     responseItems:
       - type: "text"
         text: "Sorry ${profile.firstName}, you are not authorized to use this skill"
         channelCustomProperties:
           - channel: "slack"
             properties:
               ephemeral: true

5. In the Event Mappings section of the flow's configuration, map the Authorize User event to the user authentication state.

   This event is triggered when a not-yet-authorized user tries to join the conversation and reaches a state that requires authorization.

It is possible to configure Slack channels to allow messages to be sent to the Slack app without user mentions of the Slack app. This behavior could be particularly useful for Slack channels where there are many users and they don't all know that they would would need a user mention for the Slack app to respond. A user support channel is one such example.

To enable messages without user mention to be passed to the digital assistant in Slack group chats:

• When creating the channel or later modifying the channel's configuration, set the Allow Messages Without App Mention in Group Chat switch to ON.

When you create a skill that is intended to work in a group chat, you should make sure that users of the skill are aware of the following:

• To involve the skill (or digital assistant) in the group chat, you address the corresponding Microsoft Teams bot or Slack app with a user mention (@bot_name).
  Note
  
  For Slack channels, you also have the option to send messages to the Slack app without a user mention. See Enable Messages Without User Mention in Slack Group Chats.
• For every message that you enter that you expect a response from the bot, you need to include the user mention of the bot.
• If your message is intended only for the other human participants, don't include a user mention for the bot. The bot will ignore such messages.
• In Slack group chats, the chats need to be held in the thread where the bot was first introduced in the conversation. If someone responds outside the thread of the conversation, it creates a new conversation that is independent of the previous one.
• When a participant in the group chat makes a request of the bot, the bot is aware of which user made the request. Therefore, where appropriate, the response to the request is based on the requester's identity and credentials. If a different participant then makes a request, the response to that request is based on that second participant's identity and credentials.
• All users that have successfully joined a group chat can see all of the bot's responses. It is the responsibility of the participants in the group chat to not elicit information from the bot that other participants aren't supposed to see.