Virtual Agent in Microsoft Teams fails with "Mutual authentication failed

[sharmohit]

Virtual Agent in Microsoft Teams fails with "Mutual authentication failed – Failed to find any sys_user matching the end-user certificate" when processing inbound Teams messages.
Steps to Reproduce

• Log in to Microsoft Teams using a Teams user who is correctly configured/mapped with a ServiceNow user.
• Open the configured ServiceNow Virtual Agent application/bot in Microsoft Teams.
• Send a message to the Virtual Agent, for example:

Hi

• The request is received by the ServiceNow VA Teams Inbound Scripted REST API:

API: VA Teams Inbound
Namespace: sn_va_teams
Resource: Teams Post Request
HTTP Method: POST
Relative Path: /events

• The request reaches the ServiceNow VA Teams processing, but the message is not successfully processed by Virtual Agent.
• The following error is observed in the ServiceNow system logs:

Mutual authentication failed.

MutualAuth: Failed to find any sys_user matching the end-user certificate.: no thrown error

VAMicrosoftTeamsUtil :: Error in processing the inbound request from Teams.:
Failed to send message to offglide. Unable to complete request

• The related stack trace contains:

OffglideRequestHandler.sendUserMessage
CustomAdapterRequestHandler.prepareMessageContext
CustomAdapterAsyncRequestHandler.handle
CustomAdapterRequestProxy.enqueueCustomAdapterMessage
BaseTeamsWebhookResource.processTeamsMessageVA
VAProxyTeamsWebhookResource.webhook
Actual Result:
The Microsoft Teams message reaches the ServiceNow VA Teams inbound endpoint, but Virtual Agent processing fails during the downstream Custom Adapter/Offglide processing.
ServiceNow attempts Mutual Authentication and reports:
Failed to find any sys_user matching the end-user certificate
As a result, the Virtual Agent does not successfully respond to the user in Microsoft Teams.

Expected Result:
The inbound message from Microsoft Teams should be successfully authenticated/processed by the standard ServiceNow Virtual Agent Teams integration, mapped to the appropriate ServiceNow user, passed to Virtual Agent, and a response should be returned to Microsoft Teams.
Investigation Performed

• The VA Teams Inbound → Teams Post Request resource is active and has Requires Authentication = false.
• The resource script does not contain custom certificate authentication or certificate-to-user lookup logic.
• The Teams user has a valid ServiceNow user mapping.
• glide.authenticate.mutual.enabled is currently set to true.
• The sys_user_certificate table currently contains 0 records.
• We would like ServiceNow Support to confirm why Mutual Authentication/certificate validation is being invoked during the VA Teams inbound processing and whether this is expected behavior.

Request to ServiceNow Support:
Please investigate the VA Teams authentication flow and advise:

• Why Mutual Authentication is being invoked for the VA Teams inbound request.
• Whether glide.authenticate.mutual.enabled = true is expected to affect /api/sn_va_teams/events.
• Whether a sys_user_certificate record is actually required for standard Virtual Agent + Microsoft Teams integration.
• Whether this is a configuration issue or a known defect in the current ServiceNow release/plugin version.
• The recommended supported configuration/fix to allow Virtual Agent messages from Microsoft Teams to be processed successfully.

[GokulkumarV5812]

This seems to similar cause from your other query in the post. https://www.servicenow.com/community/ms-teams-forum/getting-error-while-clicking-on-quot-employee-po...

Can you review my response in that post, if that fix this issue as well?