Set up Microsoft Teams and Copilot

Back to messaging or digital channels Connect your agent to Microsoft Teams chats and channels through a single-tenant Azure Bot and a Teams app. You register the bot in Azure, create the Artemis connection, point the bot’s messaging endpoint at Artemis, then package and install the Teams app. The setup requires:

Prepare the Azure Bot and collect its credentials.
Artemis channel configuration: create the connection, then copy its messaging endpoint.
Configure the messaging endpoint and the Teams channel in Azure.
Create and install the Teams app.
Verify the connection in a real Teams conversation.

After setup, Teams sends each activity to Artemis. Artemis validates the Bot Framework token, runs the agent, and replies in the same conversation. Important considerations

Use the same Microsoft App ID everywhere: The Bot App ID, the App ID credential, the Azure Bot Microsoft App ID, and the Teams manifest botId must all be the same GUID. Artemis selects the connection by that ID and checks that the Bot Framework JWT audience matches it.
Use a single-tenant bot: Microsoft ended support for creating new multi-tenant Azure Bot registrations after July 31, 2025. Existing multi-tenant bots keep running, but this setup uses a single-tenant identity and the exact App Tenant ID.
The client secret Value appears once: Copy the Value, not the Secret ID. The Secret ID can’t authenticate.
Manifest changes need a reinstall: Endpoint and runtime changes apply immediately. Scope, supportsFiles, icon, and command changes need an updated package and a reinstall.

Prerequisites

Confirm these before you start.

Access to the Microsoft Entra tenant where you’ll install the Teams app, with permission to manage app registrations and Azure Bot resources.
A Teams policy that permits custom app upload, or an administrator who can publish the app.
Artemis project access with permission to open Deployments -> Channels, and a deployed agent in the environment you intend to bind.

Prepare the Azure Bot

Do this in Azure before you open Artemis. Select Open Azure portal in the setup guide to jump straight there.

Create or select an Azure Bot resource

In the Azure portal, create an Azure Bot or open the existing one dedicated to this agent. Keep development and production on separate bot registrations.

Use a single-tenant identity

For a new bot, choose Single Tenant, and create or select the Microsoft Entra app registration that represents the bot. Artemis uses an App ID, client secret, and tenant ID, so don’t select a managed-identity-only setup.

Copy the Microsoft App ID and App Tenant ID

Go to Azure Bot -> Configuration.
Copy the Microsoft App ID, a GUID.
Copy the App Tenant ID, the Microsoft Entra Directory (tenant) ID.

Don’t copy the Teams app package ID, the Azure resource ID, an object ID, or a value beginning with 28:.

Create a client secret

Select Manage beside Microsoft App ID to open the linked app registration.
Go to Certificates & secrets and create a client secret with an approved expiration.
Copy the Value immediately and store it in your secret manager.

Artemis channel configuration

Create the connection before Teams sends an activity. Artemis needs the saved App ID and credentials to resolve the URL, validate inbound JWTs, get Bot Framework tokens, and send replies.

Open Artemis and select the project.
Go to Deployments -> Channels -> Microsoft Teams -> + New. The New Microsoft Teams Connection dialog opens, with the setup guide on the left and the fields on the right.

Configure the fields:

Artemis field	Source / Notes	What it controls
Display Name	You choose it	The label operators see. Name it for the Teams app and environment.
Bot App ID	Azure Bot -> Configuration -> Microsoft App ID	The routing identifier in the messaging endpoint URL.
App ID	The same Microsoft App ID	The encrypted credential for Bot Framework calls.
Client Secret	The client secret Value	Authorizes outbound Bot Framework calls and member lookup.
Azure Tenant ID	Azure Bot -> Configuration -> App Tenant ID	The tenant for the client-credentials token request.
Environment	Your published environments	The environment whose active deployment answers Teams. Leave the working copy default only while you develop.
Initial Status	Defaults to Active	Keep it Active.

Artemis asks for the Microsoft App ID twice, once as the routing identifier and once as an encrypted credential. Paste the same GUID into both fields.

Select Create.
Copy the Webhook URL from the connection’s summary panel. It ends with the encoded Microsoft App ID.

Configure the messaging endpoint

Point the Azure Bot at Artemis and turn on the Teams channel.

Confirm the Artemis connection is Active, and that Bot App ID and App ID match.
In Azure Bot -> Configuration, paste the full Artemis URL into Messaging endpoint. Turn on Enable Streaming Endpoint, and select Apply.
Reopen Configuration and confirm Azure kept the complete endpoint.
In the Azure Bot resource, open Channels, add Microsoft Teams, accept the terms, and save. The bot receives no Teams activity until you configure this channel.

Use the full URL that ends with the Microsoft App ID. Don’t replace it with the generic endpoint, the Teams app package ID, a tenant ID, an object ID, or the Azure resource name.

A successful save doesn’t prove authentication. Continue through installation and a real message test.

Create and install the Teams app

Package the bot as a Teams app. Select Open Teams Developer Portal in the setup guide to jump straight there.

Create or import the app

In the Teams Developer Portal, create an app for this bot, and add the name, descriptions, icons, developer details, and privacy and terms URLs your organization requires.

Add the bot capability and scopes

Under App features, add Bot, select Enter a bot ID, and paste the Microsoft App ID.
Enable only the scopes you’ll test and support: personal, team, and groupChat. Each is a separate install context.

Enable files only when needed

Set supportsFiles to true when users send attachments. Artemis ingests file and inline-image attachments only from personal chats, and skips file-only activities in teams and group chats.

{
  "bots": [
    {
      "botId": "<Microsoft App ID>",
      "scopes": ["personal", "team", "groupChat"],
      "supportsFiles": true,
      "isNotificationOnly": false
    }
  ]
}

For Microsoft 365 Copilot, also set webApplicationInfo.id and copilotAgents.customEngineAgents.id to the Microsoft App ID.

Validate and download the package

Resolve every Developer Portal validation error, then download the app package. If you edit the manifest directly, keep botId equal to the Microsoft App ID and include valid color and outline icons.

Upload or publish the app

For development, go to Apps -> Manage your apps -> Upload a custom app, if tenant policy allows it. For a controlled rollout, have a Teams administrator publish the app and assign app permission and setup policies.

Verify the connection

Artemis doesn’t synthesize Teams activities, so a real conversation is the only end-to-end proof.

Install the app for yourself, open its personal chat, and send a unique message.
Confirm a typing indicator where applicable, and one reply from this bot rather than an older installation or another environment.
If the agent renders actions or forms, submit an Adaptive Card Action.Execute, and confirm the values reach the same session.
Install the bot in a test team and group chat only if the manifest includes those scopes. Confirm @mentions and routing in each context, because a personal-chat pass doesn’t prove team or group behavior.
With supportsFiles on, send an approved file and an inline image in personal chat, and confirm the agent processes them.
To test in Copilot, open the app in Teams and select Open with Copilot.

Capability	Where it works
`text`, typing, streaming	Every enabled scope
Adaptive Cards with `Action.Execute`	Every enabled scope
File and inline-image attachments	Personal chat only

Security and identity boundaries

Inbound traffic and outbound replies each have their own protection.

Inbound JWT: Every activity must carry a Microsoft Bot Framework bearer JWT. Artemis validates the signing key, issuer, App ID audience, and the service URL claim when present.
Client secret: It authorizes outbound Bot Framework calls and member lookup. Store it only in Artemis, never in the manifest, browser code, screenshots, or tickets.
Secret rotation: Client secrets expire. Create a replacement before expiration, update Artemis, verify a reply, and only then remove the old secret.
Reply targets: Artemis replies only to the serviceUrl from the authenticated activity, and checks allowed attachment hosts before it forwards a bot token.
Environments: Use separate App IDs, secrets, Azure Bot resources, Teams app packages, and connections for development and production.

Manage the channel connection

Open a connection from Deployments -> Channels -> Microsoft Teams to manage it. The page has a header, three tabs, and a summary panel on the right. Header. Shows the connection name, its environment badge, its status, and when it last changed. The … overflow menu holds the connection-level actions. Summary panel. Stays visible on every tab.

Field	Description
Channel and Connection Type	Read Microsoft Teams and Channel Connection.
Identifier	The Microsoft App ID this connection routes on.
Credentials	Reads Configured once credentials save.
Webhook URL	The messaging endpoint for Azure, with a copy control.
Created and Updated	Date and time of creation and of the last change.

Credentials
Configuration
Deployment

Artemis encrypts credentials after you save them. Leave a field blank to keep its current value, or enter a new value to replace it.

Field	Description
Use Auth Profile	Turn it on, then select a saved auth profile in place of the fields below.
App ID	The Microsoft App ID credential.
Client Secret	Replace it here when you rotate the secret in Azure.
Azure Tenant ID	The App Tenant ID.

Select Save Credentials to apply your changes.

Update how the connection behaves. Microsoft Teams Settings holds the provider-specific fields.

Setting	Description
Bot App ID	Read-only, with a copy control. To serve another bot, create a new connection.
Enable Streaming	Under Response Streaming. Streams responses to Teams as the agent generates them.
Message template	The authorization message the connection sends when a tool needs the user to authorize. Insert variables from the chips, select Show more for the full list, and select Show preview to check it.
Require verified Teams identity	Under Stronger identity verification. Requires a Microsoft-resolved Teams profile identity before the connection starts or resumes a session. Leave it off for baseline Teams conversations.
Webhook URL	The messaging endpoint, with a copy control.

When you turn on Require verified Teams identity:

Artemis calls the Bot Connector member endpoint, /v3/conversations/{conversationId}/members/{userId}, to resolve the sender’s profile email or UPN before it allows the turn.
It uses the app_id, client_secret, and tenant_id on this connection or its auth profile.
The bot must stay installed and reachable, with the Azure Bot Messaging endpoint pointing at this connection.
It doesn’t use Microsoft Graph consent, OBO settings, or https://graph.microsoft.com/.default scopes.

Select Save Changes to apply your changes.

Choose which deployed version answers Teams.

Setting	Description
Environment	Under Environment Binding. Selects which deployed version handles incoming messages.
Active Deployment	Shows the bound version and when someone deployed it.

Select Save Changes after you switch the environment.

Troubleshoot connection issues

Most failures trace to a mismatched App ID or a stale manifest.

Symptom	Likely cause	Recommended action
Connection not found or `404`	Wrong endpoint or identifier	Confirm the endpoint ends with the exact Microsoft App ID, and that the Bot App ID has no `28:` prefix.
`401` or JWT validation failure	App ID mismatch	Confirm the App ID matches the token audience, the Azure Bot and Teams app reference the same registration, and requests reach Artemis unchanged over HTTPS.
Inbound message arrives but no reply	Outbound credential or deployment issue	Confirm the client secret Value is current, the Azure Tenant ID is correct, the environment has a runnable deployment, and your network allows outbound token requests.
Teams won’t install the app	Validation or policy block	Resolve Developer Portal validation errors, confirm tenant policy allows custom app upload, or ask a Teams administrator to publish and permit the app.
Personal chat works but team or group chat doesn’t	Scope missing or not reinstalled	Add the scope to the manifest, reinstall the updated package, add the app to the target context, and test the required @mention behavior.
Text works but files don’t	Files not enabled or outside policy	Set `supportsFiles` to `true`, reinstall, test in personal chat, stay within the size limit, and confirm Artemis trusts the download host.
Adaptive Card buttons don’t submit	Unsupported card or stale app	Use a supported Adaptive Card with `Action.Execute`, confirm the app is current, and check whether the invoke activity reaches the same connection.

Microsoft reference

Use these pages when you need detail beyond what this article covers. Artemis field names and the runtime endpoint shown in the connection stay the source of truth for this integration.

Resource	Use it for
Connect a bot to Teams	Adding the Microsoft Teams channel to an Azure Bot.
Upload a custom Teams app	Sideloading the app package for testing.
Teams Developer Portal	Creating, validating, and downloading the app package.
Teams Admin Center	Publishing the app and assigning policies.

Related articles:

Get started

Build

Test and evaluate

Deploy

Analytics and insights

References

Set up Microsoft Teams and Copilot

Prerequisites

Prepare the Azure Bot

Artemis channel configuration

Configure the messaging endpoint

Create and install the Teams app

Verify the connection

Security and identity boundaries

Manage the channel connection

Troubleshoot connection issues

Microsoft reference

​Prerequisites

​Prepare the Azure Bot

​Artemis channel configuration

​Configure the messaging endpoint

​Create and install the Teams app

​Verify the connection

​Security and identity boundaries

​Manage the channel connection

​Troubleshoot connection issues

​Microsoft reference

Prerequisites

Prepare the Azure Bot

Artemis channel configuration

Configure the messaging endpoint

Create and install the Teams app

Verify the connection

Security and identity boundaries

Manage the channel connection

Troubleshoot connection issues

Microsoft reference