Example use cases
- “@Releaser time to cut a new release” — triggers your deployment agent directly in a channel
- “@Researcher summarise everything we know about Acme Corp” — kicks off a research agent from Teams
- “@Standup post a daily standup summary to the Engineering channel every morning”
Prerequisites
- Access to the Teams Developer Portal at dev.teams.microsoft.com
- Microsoft Entra admin center access (to copy the app registration’s IDs)
- Microsoft Teams Admin Center access (Teams administrator role)
- The Abundly agent you want to connect
Least-privilege by design. The agent’s access is granted through Resource-Specific Consent (RSC): it can only read the teams and chats where its app has been explicitly added, and that access is granted by the team owner or chat members at install time — and enforced by Microsoft. No tenant-wide Graph permissions are required. (A workspace can optionally grant broader tenant-wide permissions — see Optional: tenant-wide Graph permissions.)
How to connect
The setup takes about 15–20 minutes across the Teams Developer Portal, Microsoft Entra admin center, and Teams Admin Center.1
Create the bot and a client secret
- Go to the Teams Developer Portal at dev.teams.microsoft.com and sign in with your work account
- In the top bar, go to Tools → Bots, click + New Bot, give it the same name as your agent (e.g. “Releaser”), and click Add — you’re taken straight to the bot’s Configure page
- Set the Endpoint address to the messaging endpoint URL shown in Abundly (format:
https://your-domain/api/ms-teams/bot/YOUR-AGENT-ID) and click Save - Go to Client secrets (in the bot’s left-hand menu), click Add a client secret for your bot, and confirm
- Copy the secret value immediately — it will not be shown again. You’ll paste this into Abundly’s Bot client secret field
Creating the bot here automatically creates a matching app registration in Microsoft Entra; the client secret you just made is stored on that registration. You’ll pick up the Bot ID and Tenant ID from that same registration in the next step, with one-click copy buttons.
2
Grab IDs in Microsoft Entra
- Go to entra.microsoft.com and navigate to Entra ID → App registrations
- Find the app registration that was automatically created — it will have the same name as your bot — and click it to open the Overview page
-
From the Overview page, copy:
- Application (client) ID — this is your Bot ID (paste into Abundly’s Bot ID field)
- Directory (tenant) ID — this is your Tenant ID (paste into Abundly’s Tenant ID field)
No API permissions need to be granted here — the agent’s read access comes from the resource-specific consent permissions in the app manifest (next step), granted per team or chat at install time. Microsoft Entra ID is the new name for Azure Active Directory; if you prefer the Azure Portal, the same settings live under Microsoft Entra ID → App registrations at portal.azure.com.
3
Enter credentials in Abundly
In your agent’s settings, open the Microsoft Teams integration panel and enter:
Click Save.
4
Create and publish the Teams app
- Back in the Teams Developer Portal, go to Apps → New app and give it any name (the manifest you paste below will overwrite name, description, bot, and scopes anyway). You’ll land on the new app’s Basic information page; copy the App ID shown at the top — you’ll need it in step 3.
- Go to Branding and upload icons if desired (or skip — Teams shows a generic placeholder). Icons are binary uploads, not part of the JSON manifest, so this is the one thing the manifest paste can’t set for you.
- Go to App package editor and replace the manifest with one of:
- The pre-filled manifest in Abundly’s Microsoft Teams integration panel (after credentials are saved, scroll to App manifest → Copy manifest) — this is already populated with your agent name, description, and Bot ID. Before pasting, replace
REPLACE-WITH-TEAMS-APP-ID-FROM-DEV-PORTALwith the App ID you copied in step 1. Teams locks the appidat creation, so the paste fails if the manifest’siddoesn’t match. - The reference template below, substituting the placeholder values yourself:
- The pre-filled manifest in Abundly’s Microsoft Teams integration panel (after credentials are saved, scroll to App manifest → Copy manifest) — this is already populated with your agent name, description, and Bot ID. Before pasting, replace
Manifest template
manifestVersion to 1.29 and add supportsChannelFeatures, supportsTargetedMessages and the commandLists block by hand, then re-upload the manifest, to get /compact listed under View prompts in 1:1 chats and in the / menu in group chats. Typing /compact works without that update. Teams caches app manifests, so if the entry does not show up after re-uploading, remove the app from the chat and add it again.The three GUIDs play two distinct roles:idis the Teams app’s own identity in your org’s app catalog. It is auto-generated when you create the app shell (step 1) and locked thereafter — pasting a manifest with a differentidtriggers a “Property ‘id’ cannot be changed in the manifest” error. Use the App ID you copied in step 1.bots[0].botIdandwebApplicationInfo.idmust both equal your Application (client) ID from the Entra app registration overview (step 2). Teams ties RSC consent towebApplicationInfo.id, so it has to match the registration that owns the bot.
What the RSC permissions do. These are Resource-Specific Consent (RSC) permissions, granted per team or chat when the app is installed there — this is the entirety of the agent’s read access, scoped to exactly the conversations where someone deliberately added it.
ChannelMessage.Read.Group— read channel messages in teams where the app is installed. Also unlocks webhook delivery of in-thread replies: without it, Teams only delivers @mentions, so follow-up replies in a thread would never reach the agent. Abundly only acts on @mentions or messages that continue a thread the user already opened with the bot.ChatMessage.Read.Chat— read message history in group chats where the app is installed.ChannelSettings.Read.Group— list a team’s channels (names and IDs) so the agent can find the right channel.ChannelMember.Read.Group— read channel membership, needed for member listing and membership events in private and shared channels.
We currently recommend
manifestVersion: "1.29" so the compose box can suggest /compact. From 1.25 upwards Teams requires the top-level supportsChannelFeatures property for apps with team scope; tier1 declares the app can be installed in shared and private channels without depending on channel membership for permissions. RSC requires 1.12 or higher.- Click Save in the App package editor, then click Update app package when prompted (or via the banner that says “Your changes have been saved locally, but not yet updated in the app package.”). Without this step the app still uses the old manifest.
- Go to Publish → Publish to org and click Get Started (the publish action)
The Teams Developer Portal also offers Publish → App validation, but that’s a preflight aimed at apps being submitted to AppSource (the public Microsoft Teams Store). For internal org publishing it’s unnecessary — and it tends to surface scary “Failure” labels that are actually validator-side flake or store-only naming rules (“Short name should not contain ‘Microsoft’”, etc.). Skip it.
Icon requirements are strict. Teams’ validator rejects anything that doesn’t match exactly:
- Color icon: 192×192 PNG, full color
- Outline icon: 32×32 PNG with only pure white (
#FFFFFF) and fully transparent pixels — no anti-aliasing, no near-white. If you see “Outline icon is not transparent. It’s Alpha,R,G,B: …”, your export has soft edges; re-export with no smoothing.
5
Approve the app in Teams Admin Center
- Go to admin.teams.microsoft.com
- Navigate to Teams apps → Manage apps and search for your app name
- If the status shows Blocked (or pending approval), click on the app and click Publish to make it available org-wide
Admin approval changes can take up to 30 minutes to propagate across the Microsoft Teams client.
6
Install the bot in a team
- In Microsoft Teams, click Apps in the left rail
- Look under Built for your org (or Added by your org) and find your bot
- Click the bot, choose Add to a team, pick the team and channel, and confirm
- The team owner must accept the requested RSC permissions when prompted — these are what let the bot read the team’s channels and see follow-up replies in a thread without re-mention
Allow up to 30 minutes after publishing for the app to appear under Built for your org. Try a hard refresh (or sign out / sign in) if it’s slow to surface.
Teams Admin Center’s Manage apps → Install action only manages org-level availability — it does not actually install the bot into a team. Use the in-client Apps → Built for your org flow above to install into a team.
The bot is now live. Users can @mention it in a channel to start a conversation; subsequent replies in that thread continue without needing to @mention again.
How conversations work
Microsoft Teams is a full remote-chat surface — on par with Slack. Every Teams conversation maps to a persistent Abundly chat, giving the agent the same instructions, memory, and capabilities as it has in the portal.- Channel @mentions start a new chat — the agent replies in the thread with full context.
- Follow-up replies in a thread the agent already joined continue the same chat without needing to @mention again.
- Group chats map to persistent chats — every message reaches the agent directly.
- 1:1 personal chats (DMs) also map to persistent chats — the agent replies naturally.
- In 1:1 chats, the agent’s reply streams in as it is written, with short status updates while it works.
- The agent reacts with 👀 to a message while it is working on it and removes the reaction when it has answered.
- Replies carry Teams’ “AI generated” label.
- In 1:1 and group chats, type
/compact(or ask the agent to start fresh) to begin a new chat that starts with a summary of the current one. It takes a minute or two, and messages sent meanwhile are not answered. The previous chat stays readable in the portal. In a 1:1 chat the command is also listed under View prompts above the compose box; in group chats it appears in the/menu once you type/. - You can tell an agent to leave a channel thread — say it’s no longer needed and it steps out, so it stops being woken by every following message. It says so in the thread before going quiet, and an @mention brings it straight back, caught up on what it missed. Agents are told not to leave on their own initiative: if one thinks it’s done, it asks or says so first. Group chats and personal chats can’t be left, so an agent is always reachable there.
Private and shared channels
Private and shared channels are separate security boundaries in Microsoft: they have their own membership and their own message store, so the team-level install does not cover them. Installing the app in a team makes all its standard channels readable; a private or shared channel additionally requires the app to be added to that specific channel:- Make sure the app is installed in the channel’s host team (step 6 above).
- Open the private or shared channel and add the app to it — a channel member does this from the channel’s app management (for example ⋯ → Manage channel → Apps, or by choosing the channel when adding the app).
- The channel-level add grants the app’s RSC permissions for that channel only.
For an incoming shared channel (shared into your team from another team), the app must be added from the channel’s host team — Teams does not allow adding apps from the receiving side.
Optional: tenant-wide Graph permissions
The standard setup above gives the agent read access only where its app is installed, enforced by Microsoft. Some capabilities require broader, tenant-wide Microsoft Graph application permissions instead. Granting them is a workspace decision — most workspaces should not:
To grant: in the bot’s app registration in entra.microsoft.com, go to API permissions → Add a permission → Microsoft Graph → Application permissions, add the permissions you need, and click Grant admin consent.
Updating an existing install
Whenever you change the manifest (bumpedversion, added permissions, etc.), Teams will not automatically apply the change to teams that already have the bot installed — and the team owner is not re-prompted to consent to any new permissions. To apply the update:
- Bump the manifest
versionin the Teams Developer Portal (e.g.1.0.0→1.0.1) and re-publish the app to your org - In each team that has the bot installed: Manage team → Apps → trash icon next to the bot → Remove
- Re-add the bot following step 6 above
ChannelMessage.Read.Group are actually granted.
Things to know
One app per agent — each agent requires its own Microsoft Teams app and bot. There is no way to have multiple bot identities within a single Teams app.
Troubleshooting
Bot isn't responding to @mentions
Bot isn't responding to @mentions
- Add the bot to the channel — registering the bot in Entra is not enough; it must be installed into the Teams roster (step 6)
- Check the endpoint URL — verify the messaging endpoint in the Teams Developer Portal matches the URL shown in Abundly (
https://your-domain/api/ms-teams/bot/YOUR-AGENT-ID) - Verify credentials — confirm the Bot ID, Bot client secret, and Tenant ID are entered correctly in Abundly
Bot replies to the first @mention but ignores follow-up messages in the thread
Bot replies to the first @mention but ignores follow-up messages in the thread
This is the symptom of
ChannelMessage.Read.Group not being granted in the team where the bot is installed. The Bot Framework webhook only fires for @mentions in channels by default — the RSC permission is what unlocks delivery for in-thread replies.Verify and re-grant:- In the team: Manage team → Apps → click the bot row. Look for ChannelMessage.Read.Group (Application, Resource specific consent) under Permissions.
- If it’s missing, the consent never took. The most reliable fix is to bump the manifest
version, re-publish, then remove the bot from the team and re-add it (see Updating an existing install above). The in-place “Update” button often does not re-trigger the consent dialog. - In private and shared channels, the app must be added to the channel itself for messages to be delivered — see Private and shared channels.
- The team must have owner consent — only team owners see the consent prompt during install, and only owners can grant RSC.
- If everything looks granted but messages still don’t arrive, give it 10–30 minutes — Microsoft has documented occasional propagation delays for RSC delivery.
"BotNotInConversationRoster" error
"BotNotInConversationRoster" error
The bot has not been installed into the team. Complete step 6 to add it to the roster.
Agent gets 403 Forbidden when reading a team, channel, or chat
Agent gets 403 Forbidden when reading a team, channel, or chat
The agent can only read conversations where its Teams app is installed (resource-specific consent). Either:
- Add the app to the team or group chat you want the agent to read — a team owner or chat member does this in the Teams client — or
- If the app was installed before the manifest’s RSC permissions were added, remove and re-add it so the new permissions are granted (see Updating an existing install), or
- For access beyond installed conversations, grant tenant-wide Graph permissions.
Can't find the bot under 'Built for your org'
Can't find the bot under 'Built for your org'
- Wait — propagation from publish to visibility in the Teams client typically takes 5–30 minutes
- Confirm the app is approved in the Admin Center (step 5) and its status is Unblocked / Allowed, not Blocked
- Try a hard refresh in the Teams web client, or sign out/sign in on desktop
- Try the Teams web client at teams.microsoft.com — the desktop client caches aggressively
"Permissions needed" warning when adding the bot
"Permissions needed" warning when adding the bot
Go to Microsoft Teams Admin Center → Teams apps → Permission policies → Global (Org-wide default) and ensure custom apps are set to Allow. If you’ve just made this change, try a hard refresh in your browser before retrying.
Manifest validation errors
Manifest validation errors
- Ensure
manifestVersionis"1.29"so/compactcan appear in the compose box - Ensure all fields in
developeranddescriptionare filled in — empty{}objects will fail validation - Ensure the
idfield is a plain GUID with no extra characters or braces Property 'id' cannot be changed in the manifest— Teams locks the Teams appidat app creation. The pasted manifest’sidmust equal the App ID shown on your app’s Basic information page in the Teams Developer Portal. The pre-filled manifest from Abundly leaves aREPLACE-WITH-TEAMS-APP-ID-FROM-DEV-PORTALplaceholder for exactly this reason — replace it with the real App ID before pasting.
/compact isn't listed when I type /
/compact isn't listed when I type /
- In a 1:1 chat, agent commands never appear in the
/menu — that menu is for group conversations. Use View prompts above the compose box instead, or just type/compact. - In a group chat, make sure the manifest is on
1.29withsupportsTargetedMessagesand thecommandListsblock (see the template above), then re-upload it. - Teams caches app manifests. If the command still doesn’t show after re-uploading, remove the app from the chat and add it again.
- Typing
/compactworks in every case, with or without the menu entry. webApplicationInfo.appIdrequired error: this means RSC permissions are declared butwebApplicationInfois missing or itsidis empty. SetwebApplicationInfo.idto your Bot ID (same GUID asbots[0].botId).

