Install one communication channel per environment (Slack, Microsoft Teams, Microsoft Copilot, ChatGPT, Claude, or a developer MCP client), then expose many role-based Assistants behind it. Channels are tenant assets; Assistants are business assets.
Prerequisites
- Tenant ACTIVE; Developer workstation setup complete
aifabrix loginsucceeds (aifabrix auth status)- Business roles identified for AI activation (admin owns portal activation)
- Provider tenant or workspace admin available for app approval
Where it lives
| Artifact | Purpose |
|---|---|
| Communication external system | Local integration/<target>/ after channel add; published Connected System |
| Channel config | Display name, endpoints, scopes after channel add |
| Credentials | Template on the Connected System; secrets only via Authentication tab / kv:// |
| Authentication UI | Connected Systems → Authentication (?tab=authentication) |
| Assistant catalog | Role-based Assistants after admin activation |
Secrets must never appear in generated artifacts. Allowed references: credentialKey, kv://, public app IDs, callback URLs, manifest metadata.
How to set
One command covers scaffold, upload, and install. Confirm with aifabrix channel add -h:
aifabrix channel add slack --name "Elsa" --probe
Omit the target in a terminal to choose name and channel interactively. --name is required when the target is specified (scripts and CI).
channel add scaffolds integration/<target>/ when missing or incomplete, uploads when the system is not on the dataplane, then configures the install. --force refreshes local files from the channel template and re-uploads (it does not rotate secrets). --dry-run generates artifacts only.
| Target | Channel |
|---|---|
slack |
Slack workspace |
teams-bot |
Microsoft Teams bot |
microsoft-copilot |
Microsoft Copilot |
chatgpt |
ChatGPT connector |
claude |
Claude custom connector |
mcp-client |
Developer MCP client (Cursor, VS Code, GitHub Copilot) |
--name is channel branding (for example Elsa) — not one install per Assistant. The CLI may append the environment label (for example Elsa (dev)).
| Channel | Extra flags when needed |
|---|---|
| Slack | --command-prefix; --onboard-users / --no-onboard-users |
| ChatGPT | --callback-url, or later channel configure chatgpt --callback-url |
| Claude | --callback-url, or later channel configure claude --callback-url |
| MCP client | --target cursor / vscode / github-copilot (optional --profile alias) |
| Microsoft Copilot | --oauth-plugin-vault-reference-id only when Agents Toolkit cannot create the Teams Entra SSO id |
| Teams bot | Remaining steps are tenant policy only |
Per-channel how-tos
| Channel | Guide |
|---|---|
| Slack | Install Slack channel |
| Microsoft Teams | Install Microsoft Teams channel |
| Microsoft Copilot | Install Microsoft Copilot channel |
| Copilot Studio | Connect Copilot Studio with Runtime MCP |
| ChatGPT | Install ChatGPT channel |
| Claude | Install Claude channel |
| Developer MCP client | Install developer MCP client |
Credentials
Communication systems use the same Authentication tab as other Connected Systems. Prefill non-secret settings in the manifest; enter secrets only in the UI or vault:
| Pattern | Typical method | Enter in Authentication tab |
|---|---|---|
| Messaging (events, slash commands) | hmac |
Signing secret, bot token |
| Bot framework (inbound JWT) | oidc |
Client ID (and client secret when required) |
See Configure authentication and the authentication methods catalog.
Approval lifecycle
Expect an install path similar to: generated → approval required → approved → installed → validated. Persist approval evidence (who, when, provider tenant/workspace, scopes) for audit — not only CLI stdout.
Defaults and examples
Product law: one Slack / Teams / Copilot / ChatGPT / Claude / MCP client channel install per environment → many Assistants.
Inbound layers
| Layer | Purpose |
|---|---|
| Installation auth | Provider OAuth / admin approval |
| Inbound validation | Prove events came from the provider |
| End-user identity | Map channel user → enterprise identity before business data |
Tenant boundary — reject requests when provider tenant/workspace ID does not match configuration.
Channel how-tos use CLI, tables, and provider remaining steps — not connector JSON. Secrets stay in Authentication / kv://. Use values from your channel add output. Never paste signing secrets or bot tokens into manifests or chat.
channel add → provider remaining steps → probe → go-live
Validate
aifabrix channel add <target> --name "Elsa" --probe
Probe should confirm: external system exists; channel config present; credential references exist; callbacks reachable; inbound validation configured; Assistant catalog reachable; tenant/workspace boundary set; no plaintext secrets in artifacts.
Also confirm admin Connect assistant channels steps for role activation and provider approval.
Common mistakes
| Mistake | Fix |
|---|---|
aifabrix app add-channel, deploy slack, or a separate scaffold/upload ladder |
Use aifabrix channel add <target> --name "Elsa" |
Target teams |
Use teams-bot |
| One Slack/Teams app per Assistant | One channel; many Assistants |
| Secrets in generated JSON | kv:// / Authentication tab only |
| Skipping inbound signature / JWT validation | Complete hmac or oidc credentials before probe |
Limits
web-embedis experimental — pass--allow-experimental; not a full production how-to in this band.- Meeting, voice, and transcript ingestion are not channel-install features.
- Low-level
channel scaffoldanduploadstill exist. The product path ischannel add. Confirm withaifabrix channel add -h.