Install the Microsoft Teams bot channel (teams-bot) for your environment with Builder CLI. Remaining Microsoft work is tenant policy only — custom app upload or org publish when your tenant restricts sideloading.
Users state a business goal in Teams. AI Fabrix Role Assistants return a governed result, question, or completed outcome. The Teams bot does not execute enterprise work or grant authority. See Conversation-first work.
Prerequisites
- Deliver assistant channels hub read
aifabrix loginand developer workstation ready- Teams Developer CLI (
@microsoft/teams.cli) andteams login - Environment already deployed on the controller (Azure subscription and resource group)
- Microsoft 365 / Entra tenant admin available if custom app upload is restricted
Where it lives
| Artifact | Location |
|---|---|
| Local scaffold | integration/teams-bot/ after channel add teams-bot |
| Published system | Connected System after upload (included in channel add) |
| Channel branding | --name on channel add |
| Secrets | kv://teams-bot/botAppId and kv://teams-bot/botAppSecret — never in generated files |
Teams bot channels use Bot Framework inbound JWT validation. The target key is always teams-bot — not teams. One install per environment exposes the full Assistant catalog to Teams users under Operational Trust. AI Fabrix already hosts the messaging endpoint; Builder does not scaffold a Teams SDK bot.
How to set
aifabrix channel add teams-bot --name "Elsa" --probe
channel addscaffolds and uploadsteams-botwhen needed, then runsteams app create --azureagainst the existing AI Fabrix messages URL.- Azure subscription, resource group, and Entra tenant come from the controller environment — the same source as Copilot Entra SSO. Do not pass them as CLI flags.
- Bot App ID and client secret are stored in AI Fabrix. Do not paste them into INSTALL files.
- Open Teams and install the generated package if sideloading is allowed.
- Approve custom app upload / org publish if tenant policy requires it.
- Re-run
channel add … --probeafter the app is available in Teams.
If the Teams CLI is not installed, remaining steps tell you to install @microsoft/teams.cli, run teams login, and re-run — not Azure Portal click-through.
If configuration drifts, run aifabrix repair teams-bot before re-upload.
Defaults and examples
| Setting | Typical value |
|---|---|
| Target key | teams-bot |
| Bot location | Azure-managed (--azure) |
| Inbound auth | oidc (Bot Framework JWT) |
--name |
Customer-visible brand (for example Elsa) |
One Teams channel install per environment; many Assistants behind it. --force reuses the Azure-managed bot for the same environment and tenant.
Validate
aifabrix channel add teams-bot --name "Elsa" --probe
Confirm: expected issuer/audience configured; callbacks reachable; Assistant catalog reachable; no plaintext secrets. Admin completes Connect assistant channels.
Common mistakes
| Mistake | Fix |
|---|---|
Target teams |
Use teams-bot |
teams project new / Teams SDK scaffold |
Use channel add teams-bot around the existing messages URL |
| Teams-managed bot | Azure-managed is required for OAuth/SSO |
| Azure Portal App registration as remaining work | Remaining steps are tenant policy only |
| Passing Azure subscription / resource group flags | Those values come from the controller environment |
Limits
Tenant policy may require human approval even when CLI provision succeeds. Meeting join and voice are not Teams channel-install features. Confirm messaging vs meeting scopes with your M365 administrator before production.
Document Entra app registration IDs, approved scopes, and probe timestamps in your change record — the same evidence pattern as other Connected System go-live checks.