microsoft/semantic-kernel · critical · Exception

Missing required configuration. ALLOWED_CALLERS must be set.

Error message

Missing required configuration. ALLOWED_CALLERS must be set.

What it means

Raised by the copilot_studio_skill sample's Config.validate() at module import time (config = Config(); config.validate() runs unconditionally). ALLOWED_CALLERS is the Bot Framework / Copilot Studio setting that whitelists which parent bots/skills may invoke this bot for skill-to-skill calls. When it is unset, the skill refuses to start because it cannot enforce caller authorization.

Source

Thrown at python/samples/demos/copilot_studio_skill/src/api/config.py:41

    # Required for Copilot Skill
    # Can be a list of allowed agent Ids,
    # or "*" to allow any agent
    ALLOWED_CALLERS = os.getenv("ALLOWED_CALLERS", ["*"])

    # Required for Azure OpenAI
    AZURE_OPENAI_CHAT_DEPLOYMENT_NAME = os.getenv("AZURE_OPENAI_CHAT_DEPLOYMENT_NAME")
    AZURE_OPENAI_ENDPOINT = os.getenv("AZURE_OPENAI_ENDPOINT")
    AZURE_OPENAI_API_VERSION = os.getenv("AZURE_OPENAI_API_VERSION")

    def validate(self):
        if not self.HOST or not self.PORT:
            raise Exception("Missing required configuration. HOST and PORT must be set.")
        if not self.APP_ID or not self.APP_PASSWORD or not self.APP_TENANTID:
            raise Exception("Missing required configuration. APP_ID, APP_PASSWORD, and APP_TENANT_ID must be set.")

        if not self.ALLOWED_CALLERS:
            raise Exception("Missing required configuration. ALLOWED_CALLERS must be set.")


config = Config()
config.validate()

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Set ALLOWED_CALLERS in your environment / .env file (the value is typically the MicrosoftAppId of the parent bot or a comma-separated list of allowed caller App IDs, often '*' for the sample).
2. Copy the sample's .env.example / env template into a local .env and fill in HOST, PORT, APP_ID, APP_PASSWORD, APP_TENANTID, and ALLOWED_CALLERS together.
3. If running the sample locally for experimentation, set ALLOWED_CALLERS=* to permit any caller.
4. Verify the value is actually loaded by Config.__init__ (os.getenv) before validate() runs.

Example fix

// before
# .env
HOST=localhost
PORT=3978
APP_ID=...
APP_PASSWORD=...
APP_TENANTID=...

// after
# .env
HOST=localhost
PORT=3978
APP_ID=...
APP_PASSWORD=...
APP_TENANTID=...
ALLOWED_CALLERS=*

import os
allowed = os.getenv('ALLOWED_CALLERS')
required = {'HOST','PORT','APP_ID','APP_PASSWORD','APP_TENANTID','ALLOWED_CALLERS'}
missing = [k for k in required if not os.getenv(k)]
if missing:
    raise SystemExit(f'Set env vars before starting: {missing}')

When it happens

Trigger: Running the copilot_studio_skill API (importing python/samples/demos/copilot_studio_skill/src/api/config.py or starting the app) without the ALLOWED_CALLERS environment variable defined. validate() is invoked at import, so any process that loads this module triggers it.

Common situations: Copying the sample without copying its .env template; deploying to a new environment and forgetting to set ALLOWED_CALLERS; using a unique caller app ID per deployment but never adding it to the allowlist; running tests that import config.py directly.

Related errors

• AllowedCallersClaimsValidator: config object cannot be None.
• "{self.config_key}" not found in configuration.
• Received a request from a bot with an app ID of "{app_id}".
• AZURE_OPENAI_ENDPOINT is not set.
• AZURE_OPENAI_ENDPOINT is not set.

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/b94125bc4476137e. Report an issue: GitHub.