Microsoft Teams

Configure the Microsoft Teams plugin in Settings → Plugins → Microsoft Teams. It connects Elowen to personal chats, group chats, and team channels through an Azure Bot. Install it first from Settings → Plugins → Available.

For shared identity and conversation rules, see Channels.

What the plugin provides

The bot supports Adaptive Cards, live tool activity, images, proactive cron and tick messages, and a downloadable Teams app package. It can message conversations and people it already knows. Optional Microsoft Graph lookup can find a new person by e-mail and open a chat.

Set up the bot

You need a single-tenant Microsoft Entra app registration and an Azure Bot resource using that app's ID.

1. In the Entra admin center, create an app registration for Accounts in this organizational directory only. Copy its Application (client) ID and Directory (tenant) ID, then create a client secret.
2. In the Azure portal, create an Azure Bot of type Single Tenant, using the same application ID.
3. Set its messaging endpoint to https://<domain>/hooks/msteams/messages and enable the Microsoft Teams channel. Your public HTTPS reverse proxy must route /hooks/ to the daemon.
4. In Elowen, open Settings → Access → Microsoft Teams and enter the Microsoft App ID, Client secret, and Tenant ID fields.
5. Open the MS Teams page, select Download app package, upload the file in Teams admin center → Manage apps, then add it to a chat or team.

The plugin connects only after all three bot credentials are set. Normal bot chat uses the Bot Connector and does not need Microsoft Graph permission. Download a fresh app package after changing package settings such as Read every channel message, App name in Teams, Publisher name in Teams, or App icon in Teams.

Choose who can use the bot

Manage the admission policies in the MS Teams page, on the People & access tab. For shared chats, the first matching policy wins; senders that match none receive no response. A policy can match an Entra object ID, a Teams account ID beginning 29:, a UPN or e-mail address such as alex@contoso.com, a whole conversation ID, or * as a final catch-all. Put the catch-all last.

Turn on Administrator access for a policy to allow room-administration commands and trusted-room context. It does not grant an Elowen account, project access, tool permissions, Microsoft access, or instance-operator rights. Those come from the sender's linked Elowen account and grants.

Receive team-channel messages

By default, Teams normally sends the bot channel messages that mention it. To receive every message in a team channel where the app is installed:

1. Turn on Read every channel message.
2. Download and upload the updated app package.
3. Have a team owner approve the ChannelMessage.Read.Group permission when installing or updating the app in each team.

This permission is separate from tenant-admin consent for application permissions. Even with it, turning off Respond without mention filters out messages that do not address the bot. Respond without mention is on by default.

Conversation history backfill defaults to 0 and accepts 0–100. It keeps a rolling transcript of messages the bot witnessed. With team-channel consent, a new channel-thread conversation can also read that thread through Microsoft Graph.

Link Microsoft accounts and use Microsoft 365

There are two separate sign-in options:

• Personal-chat account linking uses an Azure Bot OAuth connection and delegated Microsoft 365 scopes. Create a second, single-tenant Entra app, add the redirect URI https://token.botframework.com/.auth/web/redirect, grant the required delegated scopes, and configure an Azure Bot connection using the Microsoft Entra ID v2 provider. Leave Token Exchange URL empty. Enter its exact name as OAuth connection name and turn on Personal-chat Microsoft sign-in.
• Web sign-in uses the bot app's OIDC flow. Turn on Enable Microsoft sign-in, set Public Elowen URL to Elowen's public HTTPS origin, and register that origin followed by /api/auth/sso/microsoft/callback as a redirect URI on the bot app.

Personal-chat linking and web sign-in are distinct. With Personal-chat Microsoft sign-in enabled, an enabled tenant member can sign in from a personal chat and use their linked account's access. Link existing accounts by e-mail can match exactly one existing Elowen account on first web sign-in; after linking, the Entra object ID is the lasting identity. Administrators can use Link Elowen account in the Teams workspace to associate a known Teams identity with another existing account. Ambiguous or conflicting links are refused.

Set Account provisioning to Entire tenant to create accounts for enabled members of the configured tenant. Elowen tells members from guests by the ID token's optional acct claim; add it under Token configuration of the bot app. Without the claim, Elowen asks Microsoft Graph instead, which needs the bot app's application permission User.Read.All with tenant-admin consent. Guests, disabled accounts, and identities outside the tenant are rejected. Default projects for new accounts and New personal Project for each new account apply only to newly created accounts; existing accounts are not changed.

Microsoft 365 tools use the linked account's delegated identity and permissions wherever that account is used, including shared chats and personal scheduled jobs. Tokens stay in Bot Framework Token Service, not Elowen. Microsoft 365 access defaults to Read only. Read and write still previews each change until the agent explicitly commits it. The delegated app needs only the scopes for the tools you use. A practical set is:

openid profile email offline_access
User.Read User.Read.All People.Read
Files.ReadWrite.All Sites.ReadWrite.All
Mail.ReadWrite Mail.Send Mail.ReadWrite.Shared Mail.Send.Shared
Calendars.ReadWrite Calendars.ReadWrite.Shared
Contacts.ReadWrite Tasks.ReadWrite
Group.ReadWrite.All Notes.ReadWrite.All
Chat.ReadWrite ChatMessage.Send
Team.ReadBasic.All Channel.ReadBasic.All ChannelMessage.Read.All ChannelMessage.Send

Keep offline_access for a connection that survives token expiry. Add GroupMember.Read.All only if directory group-membership calls report it missing. The Teams adapter does not require Chat.Read.All.

Files and proactive messages

File offers work only in personal one-to-one chats, not group chats or team channels. Set Notification conversation to choose where proactive cron and tick messages go. It accepts a known conversation ID or a person identified by e-mail, Entra object ID, 29: account ID, or an unambiguous display name. Leave it empty to disable proactive messages.

Optional Microsoft Graph lookup is for people the bot has never seen. The bot app needs tenant-admin consent for User.ReadBasic.All and TeamsAppInstallation.ReadWriteSelfForUser.All; ProfilePhoto.Read.All is optional. Teams catalog app ID is the ID of the uploaded Teams app in Teams admin center → Manage apps, not the bot app ID. Leave it empty only if an app policy already deploys the Teams app to users.

Commands

Teams shows model, reasoning, display, and context controls as Adaptive Cards. Available commands come from the running daemon.

/model, /reasoning, /display, /context, /plan, /build, and /workflow require an admin role policy. /stop, /stats, /compact, and /restart are also admin-only. Microsoft 365 tools are available through account linking and delegated access, not as chat commands.

Next: WhatsApp