> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genesiscomputing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Teams

> Configure the Microsoft Teams connection so Genesis can send Teams messages, list Teams and channels, and look up users through Microsoft Graph.

## Overview

Genesis ships two distinct Microsoft Teams integration paths:

| Path | Connection / surface | Message attribution | Typical use |
| - | - | - | - |
| **Microsoft Graph (this page)** | `microsoft_teams` connection | Connected human user | Channel or 1:1 chat as a person, list teams/channels/chats, user lookup |
| **Bot Framework** | Per-bot credentials on **Agents → \[bot] → Teams**; SPCS egress on **Config → Microsoft Teams** | Genesis bot principal | Two-way `@`-mention and DM conversation, Adaptive Card callbacks, proactive bot sends via `teams_bot_tools` |

The `microsoft_teams` connection lets Genesis use Microsoft Graph for Teams
messaging and lookup workflows. It powers `teams_tools` actions such as listing
Teams, listing channels, listing chats, sending channel messages, sending 1:1
chat messages, and looking up users by email.

<Note>
  This page documents the Microsoft Graph connection used by `teams_tools`. For
  Bot Framework setup (Azure Bot, messaging endpoint, Teams app package, SPCS
  inbound relay), see
  [Activate Eve in Teams (Bot Framework)](/docs/Workspaces/Microsoft-Teams/Activate-Bot-Framework-Eve-in-Teams)
  and, on Snowpark Container Services,
  [Activate Genesis Data Agents On Teams](/docs/Workspaces/Microsoft-Teams/Activate-Genbots-On-Teams).
</Note>

Messages sent through delegated OAuth appear as the connected Microsoft user,
not as a bot. Teams channel messages cannot be deleted by the API, so choose
`default_team_id` and `default_channel_id` carefully.

If you only need incoming webhook notifications, use `teams_webhook_tools`
instead. That webhook path does not require Azure App Registration or delegated
OAuth, supports `SEND_ALERT`, `SEND_SCHEDULED_REPORT`,
`SEND_APPROVAL_HANDOFF`, raw `SEND_ADAPTIVE_CARD`, and
`teams_webhook_recent_deliveries`, and accepts HTTPS webhook hosts matching
`*.logic.azure.com`, `*.api.powerplatform.com`, or legacy
`*.webhook.office.com` URLs. Prefer Microsoft 365 Workflows / Power Automate
webhooks over the deprecated Office 365 connector family.

## Setup workflow

1. If multiple Teams connections will share one Azure OAuth app, optionally
   configure **Config -> Advanced Settings -> OAuth Providers -> Microsoft
   Teams** first. Otherwise, enter the OAuth client values directly on the
   connection.
2. In Azure Portal -> Microsoft Entra ID -> App registrations -> New
   registration, create a **single-tenant** app for Genesis.
3. Add the redirect URI that Genesis shows for your connection. The UI format
   is
   `https://<genesis-host>/api/connections/microsoft_teams/<connection-name>/oauth/callback/ui`.
4. Add delegated Microsoft Graph permissions and grant admin consent:
   * `ChannelMessage.Send`
   * `ChatMessage.Send`
   * `Chat.ReadWrite`
   * `Team.ReadBasic.All`
   * `Channel.ReadBasic.All`
   * `User.Read.All`
   * `offline_access`
5. Create a client secret and copy the value immediately.
6. In **Config -> Connections**, create a **Microsoft Teams** connection,
   choose the desired mode, fill in the fields below, save, and complete the
   **Authorize** popup when using **User OAuth**.
7. Click **Test Connection**. Genesis calls Microsoft Graph `GET /me` for
   `user_oauth` or `GET /organization` for `client_credentials`.

## Bot Framework egress (Snowflake / SPCS)

The **Config -> Microsoft Teams** page configures outbound access for the
Microsoft Bot Framework integration. This is separate from the Microsoft Graph
**Connections** workflow above.

On Snowpark Container Services:

1. Open **Config -> Microsoft Teams**.
2. Click **Approve External Access**. This opens Snowsight's **Configurations**
   page for the Genesis app — not the Streamlit in-app configuration page.
3. Under **External connections**, find **Teams Bot Framework**, click
   **Review** to approve it, and confirm it shows as **Connected**.
4. Return to the Genesis tab and click **Assign to Genesis**. Assigning briefly
   restarts the Genesis service to apply the change.

Until both steps complete, the page warns that inbound Teams messages cannot be
validated. Genesis refreshes the assignment status when you return to the
Genesis browser tab after approving in Snowsight.

For Azure Bot registration, per-bot credentials, and the SPCS inbound relay,
see
[Activate Eve in Teams (Bot Framework)](/docs/Workspaces/Microsoft-Teams/Activate-Bot-Framework-Eve-in-Teams)
and
[Activate Genesis Data Agents On Teams](/docs/Workspaces/Microsoft-Teams/Activate-Genbots-On-Teams).

## Connection modes

| Mode label | Stored `auth_type` | Fields |
| - | - | - |
| **Client Credentials** | `client_credentials` | `tenant_id` (`string`, required), `client_id` (`string`, required), `client_secret` (`string`, required, secret) |
| **User OAuth** | `user_oauth` | `tenant_id` (`string`, required), `client_id` (`string`, required), `client_secret` (`string`, required, secret), `authorization_url` (`string`, optional, default `https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize`), `token_url` (`string`, optional, default `https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token`), `token_endpoint_auth_method` (`string`, optional, default `client_secret_post`), `scopes` (`string`, optional, default `ChannelMessage.Send ChatMessage.Send Chat.ReadWrite Team.ReadBasic.All Channel.ReadBasic.All User.Read.All offline_access`), `default_team_id` (`string`, optional), `default_channel_id` (`string`, optional) |

Use **User OAuth** for `teams_tools` actions that send messages, list Teams,
list channels, list chats, or look up users. Those actions run as the connected
Microsoft user, not as a bot.

<Warning>
  `default_team_id` and `default_channel_id` are optional routine destinations
  for `SEND_CHANNEL_MESSAGE`. Avoid pointing `default_channel_id` at a broad or
  company-wide channel. Leave these fields blank when you want every send to
  name the target explicitly.
</Warning>

<Note>
  App-only `client_credentials` connections are valid for credential testing
  and future admin scenarios, but v1 Teams messaging, listing, and lookup
  actions require delegated **User OAuth**.
</Note>

## Connection defaults

When `connection_name` is omitted on `teams` tool calls, Genesis resolves the effective default `microsoft_teams` connection for the current user (**My default**, then **Role default**). See [Default connection layers](/docs/Setup/Connections#default-connection-layers).

## What it enables

After setup, Genesis can:

* list Teams joined by the connected user,
* list channels in a Team,
* list chats visible to the connected user,
* send channel messages and 1:1 chat messages as the connected user, creating or reusing the 1:1 chat automatically when you target a recipient email or UPN,
* look up a Microsoft user by email address.

## Related pages

* [Connections](/docs/Setup/Connections)
* [OAuth Providers](/docs/Setup/OAuth-Providers)
* [Additional Tool Groups](/docs/Genbot-Toolkit/Additional-Tool-Groups#teams-tools)
* [Teams Bot Framework tools](/docs/Genbot-Toolkit/Additional-Tool-Groups#teams-bot-tools)
* [Teams webhook tools](/docs/Genbot-Toolkit/Additional-Tool-Groups#teams-webhook-tools)
* [Activate Eve in Teams (Bot Framework)](/docs/Workspaces/Microsoft-Teams/Activate-Bot-Framework-Eve-in-Teams)