Skip to main content

​
Microsoft Teams

The Microsoft Teams integration lets an agent work inside Teams on behalf of the person it’s helping — read their chats, message a teammate, look up a colleague’s availability, or spin up a meeting — all as that user, all without them leaving the conversation. A one-time Microsoft admin consent extends this to channels (search, read, post, create, and tidy up channels), and a separate optional setup enables a small set of governed, organization-level admin actions.
This is not the Teams channel. This page is about the agent using Teams as a tool while it talks to someone (on the web widget, Slack, email, and so on). If instead you want employees to chat with the agent inside Microsoft Teams, that’s the Teams channel — a separate setup.

​
What the agent can do

Capabilities are grouped into modules you turn on per agent. Reads are on by default; every write is off until you enable it, and write actions ask the user to confirm before they run. Everything the agent does as a user is bounded by what that person can already see and do in Teams — the integration never widens their access.

​
What it does not do

  • It is not the Teams channel integration. Holding the conversation inside Teams is a different feature — see Teams channel.
  • No files. Teams files live in SharePoint/OneDrive. Use the SharePoint / OneDrive integration for documents; Teams search here covers messages, not files.
  • No calendar events. Create a meeting returns a Teams join link only — it does not put an event on anyone’s calendar. For calendar invitations, use the Outlook integration.
  • No editing, deleting, reacting, or scheduling messages in this version — the agent posts new messages (and channel replies). Those richer actions are a later addition.
  • No bot impersonation. The agent posts as the signed-in user, never as an anonymous system identity.

​
Set up chats & meetings

The Chats & meetings module takes about a minute and needs nothing in the Microsoft admin center — Cobalt hosts the Microsoft sign-in, and every permission it uses is one each person can grant for themselves.
1

Add the integration

From your agent, open Integrations, choose Microsoft Teams, and select Chats & meetings — and, if you want them, the post-a-chat-message and create-a-meeting actions.
2

Attest to the access requested

Review the Microsoft permissions. Enabling post a chat message or create a meeting adds higher-impact permissions, which are flagged for you to confirm. Name the integration and save.
3

Let users authorize themselves

The first time the agent uses a Teams tool for someone, that person signs in with Microsoft and approves the access. If your tenant also uses the Outlook or SharePoint integration, this is the same Microsoft sign-in — people see one combined prompt, not three. From then on the agent acts as them.
That’s it — no Azure setup for chats & meetings.

​
Enable the Channels module

Everything channel-side — searching and reading channel messages, listing a user’s team channels, posting to a channel, and creating or updating channels — uses Microsoft Graph permissions that individual users cannot grant for themselves. A Microsoft 365 tenant admin must grant consent once for your organization; Cobalt walks the admin through Microsoft’s consent page when you enable the module. Until that consent is granted, the channel tools stay unavailable — a person signing in and approving for themselves is not enough. After consent, everything still runs as each user: the agent can only see and touch the teams and channels that person already has access to.

​
Set up admin actions (optional)

Admin actions (add/remove a member, create a team or channel, archive a team, set a team policy) act at the organization level, so they run through an app registration you create in Microsoft Entra ID — not as any individual user.

​
In Microsoft Entra ID

1

Register an application

In the Microsoft Entra admin center, register a new application and note its Directory (tenant) ID and Application (client) ID.
2

Grant the application permissions and admin consent

Add the application Microsoft Graph permissions the admin actions need (for managing teams, channels, members, and policies), then click Grant admin consent. Without admin consent, those actions stay unavailable.
3

Add a client secret or certificate

Create a client secret or upload a certificate for the app — Cobalt uses it to authenticate as the application.

​
In Cobalt

1

Enter the credentials

On the Microsoft Teams integration’s Authorization tab, paste the tenant ID, application ID, and either the client secret or the certificate. Secrets are encrypted at rest and never shown again.
2

Verify

Run Verify. Cobalt makes a live call to confirm the credentials work; the admin tools switch from Awaiting authorization to active.
3

Set allowlists and limits

List the teams each admin action is allowed to touch, and set the team-creation rate limit. Anything outside the allowlist is denied (and recorded). Destructive actions such as removing a member ask for confirmation every time.
Once configured, the admin tools appear on the agent, every action runs under your allowlists, and each one is written to the audit trail.

​
Troubleshooting

“That action needs additional Microsoft admin consent.” An admin tool is trying to use a Graph permission your Entra app hasn’t been granted. In the Entra admin center, add the application permission and click Grant admin consent, then retry.
  • The agent keeps asking the user to authorize. The person hasn’t finished the Microsoft sign-in, or you recently turned on a write action that needs new permissions — they’ll be asked to approve the added access once, then it works.
  • Channel tools don’t work even after a user signs in. The Channels module needs one-time Microsoft admin consent for your organization — a per-user sign-in can’t grant its permissions. Have a Microsoft 365 tenant admin complete the consent step on the integration, then retry.
  • “I can’t read full channel history — searching instead.” Reading a channel’s complete message history uses Microsoft’s metered export API, which many tenants haven’t enabled. The agent automatically falls back to search and tells the user, rather than silently returning nothing. (Chat history and search are unaffected.)
  • “That team isn’t allowed for this action.” Add the team to the action’s allowlist on the integration’s governance settings.
  • Rate-limited by Microsoft. Under heavy use Microsoft Graph throttles requests; the agent surfaces a short “try again in N seconds” message and stops rather than hammering. Retry shortly.
  • A meeting was created but isn’t on my calendar. That’s expected — the meeting action returns a join link only and never creates a calendar event.
  • Verify fails for admin actions. Re-check the tenant ID, application ID, and that the secret/certificate is current. Rotated secrets must be replaced and re-verified.

​
FAQs

No. This integration lets the agent use Teams as a tool from wherever the conversation is happening. Hosting the conversation inside Teams is the separate Teams channel.
For everyday actions (messaging, meetings, channel management) the agent acts as you, using your Microsoft sign-in, and can only do what you can do. Optional admin actions run as your organization’s registered app, bounded by allowlists.
No. It only sees the chats and channels you can see. Search and reads are scoped by your own Microsoft permissions.
No. Sending a message, creating a meeting, and channel actions all show a confirmation first. You can cancel.
Not for chats & meetings — Cobalt hosts the Microsoft sign-in and each person grants that access for themselves. The Channels module needs a one-time Microsoft admin consent for your organization, and the optional admin actions require an Entra app registration you create.
Files shared in Teams live in SharePoint/OneDrive — use that integration for documents. This integration works with messages, chats, channels, people, and meetings.