> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Teams

> Let an agent search, read, and act in Microsoft Teams on each person's behalf — message a teammate, spin up a meeting, manage channels, plus optional admin actions.

# Microsoft Teams

The Microsoft Teams integration lets an agent **work inside Teams on behalf of the
person it's helping** — read their chats, message a teammate, look up a
colleague's availability, or spin up a meeting — all as that user, all without
them leaving the conversation. A one-time Microsoft admin consent extends this
to **channels** (search, read, post, create, and tidy up channels), and a
separate optional setup enables a small set of governed, organization-level
admin actions.

<Note>
  **This is not the Teams *channel*.** This page is about the agent *using* Teams
  as a tool while it talks to someone (on the web widget, Slack, email, and so
  on). If instead you want employees to **chat with the agent inside Microsoft
  Teams**, that's the [Teams channel](/channels/teams) — a separate setup.
</Note>

## What the agent can do

Capabilities are grouped into modules you turn on per agent. Reads are on by
default; every write is off until you enable it, and write actions ask the user
to confirm before they run.

| Module                                                          | What the agent can do                                                                                                                                                                                                                                                                                                    |
| --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Chats & meetings**                                            | Read the user's 1:1 and group chats; look up a person and their availability (presence). Writes (off by default, always confirmed): post a chat message **as the user**; create an ad-hoc Teams **meeting** and return a join link. No Microsoft admin consent needed — each person grants this access for themselves.   |
| **Channels** (off by default; requires Microsoft admin consent) | Everything channel-side: search channel messages, list the channels of teams the user belongs to, read a channel's history and a post's replies, post to a channel, create a channel, add people to a channel, rename a channel or update its description — all as the user, bounded by what Teams already lets them do. |
| **Admin actions** (optional, off by default)                    | Add or remove a team member, create a team or channel, archive a team, or assign a team policy — performed through your organization's own app registration and bounded by allowlists you control.                                                                                                                       |

Everything the agent does as a user is bounded by **what that person can already
see and do in Teams** — the integration never widens their access.

## What it does *not* do

* **It is not the Teams channel integration.** Holding the conversation inside
  Teams is a different feature — see [Teams channel](/channels/teams).
* **No files.** Teams files live in SharePoint/OneDrive. Use the
  [SharePoint / OneDrive integration](/integrations/sharepoint-onedrive) for documents; Teams
  search here covers **messages**, not files.
* **No calendar events.** `Create a meeting` returns a Teams **join link** only —
  it does not put an event on anyone's calendar. For calendar invitations, use the
  Outlook integration.
* **No editing, deleting, reacting, or scheduling messages** in this version —
  the agent posts new messages (and channel replies). Those richer actions are a
  later addition.
* **No bot impersonation.** The agent posts *as the signed-in user*, never as an
  anonymous system identity.

## Set up chats & meetings

The **Chats & meetings** module takes about a minute and needs nothing in the
Microsoft admin center — Cobalt hosts the Microsoft sign-in, and every
permission it uses is one each person can grant for themselves.

<Steps>
  <Step title="Add the integration">
    From your agent, open **Integrations**, choose **Microsoft Teams**, and select
    **Chats & meetings** — and, if you want them, the post-a-chat-message and
    create-a-meeting actions.
  </Step>

  <Step title="Attest to the access requested">
    Review the Microsoft permissions. Enabling **post a chat message** or
    **create a meeting** adds higher-impact permissions, which are flagged for
    you to confirm. Name the integration and save.
  </Step>

  <Step title="Let users authorize themselves">
    The first time the agent uses a Teams tool for someone, that person signs in
    with Microsoft and approves the access. If your tenant also uses the Outlook
    or SharePoint integration, this is the **same Microsoft sign-in** — people see
    one combined prompt, not three. From then on the agent acts as them.
  </Step>
</Steps>

That's it — no Azure setup for chats & meetings.

## Enable the Channels module

Everything channel-side — searching and reading channel messages, listing a
user's team channels, posting to a channel, and creating or updating channels —
uses Microsoft Graph permissions that **individual users cannot grant for
themselves**. A **Microsoft 365 tenant admin** must grant consent **once** for
your organization; Cobalt walks the admin through Microsoft's consent page when
you enable the module. Until that consent is granted, the channel tools stay
unavailable — a person signing in and approving for themselves is not enough.

After consent, everything still runs **as each user**: the agent can only see
and touch the teams and channels that person already has access to.

## Set up admin actions (optional)

Admin actions (add/remove a member, create a team or channel, archive a team, set
a team policy) act at the **organization** level, so they run through an **app
registration you create in Microsoft Entra ID** — not as any individual user.

### In Microsoft Entra ID

<Steps>
  <Step title="Register an application">
    In the Microsoft Entra admin center, register a new application and note its
    **Directory (tenant) ID** and **Application (client) ID**.
  </Step>

  <Step title="Grant the application permissions and admin consent">
    Add the **application** Microsoft Graph permissions the admin actions need
    (for managing teams, channels, members, and policies), then click **Grant
    admin consent**. Without admin consent, those actions stay unavailable.
  </Step>

  <Step title="Add a client secret or certificate">
    Create a client secret **or** upload a certificate for the app — Cobalt uses
    it to authenticate as the application.
  </Step>
</Steps>

### In Cobalt

<Steps>
  <Step title="Enter the credentials">
    On the Microsoft Teams integration's **Authorization** tab, paste the tenant
    ID, application ID, and either the client secret or the certificate. Secrets
    are encrypted at rest and never shown again.
  </Step>

  <Step title="Verify">
    Run **Verify**. Cobalt makes a live call to confirm the credentials work; the
    admin tools switch from *Awaiting authorization* to active.
  </Step>

  <Step title="Set allowlists and limits">
    List the **teams** each admin action is allowed to touch, and set the
    **team-creation rate limit**. Anything outside the allowlist is denied (and
    recorded). Destructive actions such as removing a member ask for confirmation
    every time.
  </Step>
</Steps>

Once configured, the admin tools appear on the agent, every action runs under
your allowlists, and each one is written to the audit trail.

## Troubleshooting

<Warning>
  **"That action needs additional Microsoft admin consent."** An admin tool is
  trying to use a Graph permission your Entra app hasn't been granted. In the
  Entra admin center, add the application permission and click **Grant admin
  consent**, then retry.
</Warning>

* **The agent keeps asking the user to authorize.** The person hasn't finished the
  Microsoft sign-in, or you recently turned on a write action that needs new
  permissions — they'll be asked to approve the added access once, then it works.
* **Channel tools don't work even after a user signs in.** The **Channels**
  module needs one-time **Microsoft admin consent** for your organization — a
  per-user sign-in can't grant its permissions. Have a Microsoft 365 tenant
  admin complete the consent step on the integration, then retry.
* **"I can't read full channel history — searching instead."** Reading a
  channel's complete message history uses Microsoft's metered export API, which
  many tenants haven't enabled. The agent automatically falls back to **search**
  and tells the user, rather than silently returning nothing. (Chat history and
  search are unaffected.)
* **"That team isn't allowed for this action."** Add the team to the action's
  allowlist on the integration's governance settings.
* **Rate-limited by Microsoft.** Under heavy use Microsoft Graph throttles
  requests; the agent surfaces a short "try again in N seconds" message and stops
  rather than hammering. Retry shortly.
* **A meeting was created but isn't on my calendar.** That's expected — the meeting
  action returns a join link only and never creates a calendar event.
* **Verify fails for admin actions.** Re-check the tenant ID, application ID, and
  that the secret/certificate is current. Rotated secrets must be replaced and
  re-verified.

## FAQs

<AccordionGroup>
  <Accordion title="Is this the same as chatting with the agent in Teams?">
    No. This integration lets the agent *use* Teams as a tool from wherever the
    conversation is happening. Hosting the conversation **inside** Teams is the
    separate [Teams channel](/channels/teams).
  </Accordion>

  <Accordion title="Does the agent act as me or as a bot?">
    For everyday actions (messaging, meetings, channel management) the agent acts
    **as you**, using your Microsoft sign-in, and can only do what you can do.
    Optional admin actions run as your organization's registered app, bounded by
    allowlists.
  </Accordion>

  <Accordion title="Can the agent read other people's private chats?">
    No. It only sees the chats and channels **you** can see. Search and reads are
    scoped by your own Microsoft permissions.
  </Accordion>

  <Accordion title="Will it post without asking?">
    No. Sending a message, creating a meeting, and channel actions all show a
    confirmation first. You can cancel.
  </Accordion>

  <Accordion title="Do I need IT to set anything up?">
    Not for **chats & meetings** — Cobalt hosts the Microsoft sign-in and each
    person grants that access for themselves. The **Channels** module needs a
    one-time Microsoft admin consent for your organization, and the optional
    **admin actions** require an Entra app registration you create.
  </Accordion>

  <Accordion title="What about Teams files and recordings?">
    Files shared in Teams live in SharePoint/OneDrive — use that integration for
    documents. This integration works with **messages**, chats, channels, people,
    and meetings.
  </Accordion>
</AccordionGroup>

## Related

* [Integrations overview](/integrations/overview) — how integrations work in
  general.
* [Teams channel](/channels/teams) — host the conversation *inside* Microsoft
  Teams (a different feature).
* [How Cobalt works](/concepts/how-cobalt-works) — where integrations fit.