Salambo connects Microsoft Teams through customer-owned Azure Bot registrations. Each Teams bot maps to one Salambo agent and uses its own Microsoft App ID and client secret.
The Teams integration supports direct messages and explicit channel mentions.
Bot-authored messages are ignored by default to prevent bot-to-bot loops.
What you will create
| Item | Owner | Secret? | Salambo behavior |
|---|
| Microsoft App/Bot ID | Azure Bot | No | Saved with the connection |
| Client secret | Azure Bot app registration | Yes | Encrypted and never shown again |
| Agent mapping | Salambo | No | Selects which agent answers |
| Tenant/conversation mapping | Teams events | No | Learned from incoming activities |
Architecture
Important boundaries:
- Bot Framework JWT validation runs before message processing.
- Teams tokens and client secrets are not exposed to agent runtime tools.
ctx.external contains provider metadata and IDs only.- Salambo manages connection state, duplicate-event protection, conversation mapping, and encrypted credentials.
- The Responses runtime owns execution, billing, files, and run lifecycle.
Setup
1. Open Teams integrations
In Salambo, open your workspace and go to:
Settings → Integrations → Microsoft Teams
2. Choose the agent and bot name
Choose the Salambo agent that should answer Teams messages and enter the Teams bot display name.
One Teams bot maps to one Salambo agent.
3. Create an Azure Bot
In Azure or the Teams Developer Portal, create a bot registration and copy:
- Microsoft App ID;
- client secret.
Paste both values into Salambo and click Validate credentials. Salambo checks that the App ID and secret can obtain a Bot Framework token before the integration is saved.
Set the Bot Framework messaging endpoint to the URL shown in Salambo:
https://YOUR_SALAMBO_APP_URL/api/integrations/teams/messages
4. Generate and upload the Teams app package
Click Generate Teams manifest, then Download Teams app package.
The generated ZIP contains:
manifest.json
color.png
outline.png
| Setting | Value |
|---|
| Bot ID | Your Microsoft App/Bot ID |
| Scopes | personal, team |
| Files | Disabled |
| Notification-only mode | Disabled |
5. Save credentials in Salambo
Click Save Teams bot. Salambo encrypts the client secret and marks the connection active.
Tenant metadata is detected after the first Teams activity is received.
6. Test the bot
In Microsoft Teams:
- send a direct message to the bot; or
- mention the bot in a channel.
The bot should create one Salambo run and reply once.
To adapt prompts or tools using Teams tenant, team, channel, and activity metadata, continue with external event context and the Teams recipes.
Managing an existing Teams bot
Rotate credentials
Use Edit on the Microsoft Teams connection.
You can update:
- agent mapping;
- bot display name;
- client secret.
The Microsoft App ID is read-only for an existing connection. Secret fields are intentionally blank and must be pasted fresh.
Remove from Salambo
Use Remove from Salambo to stop routing events for that Teams bot.
This deactivates the Salambo connection so future events are ignored. It does not uninstall the Teams app or revoke the Azure client secret.
To fully remove Microsoft-side access, also uninstall the Teams app and revoke/delete the client secret in Azure.
Loop safety
Salambo verifies the Bot Framework token first, then ignores activities identified as bot-authored.
This means:
| Scenario | Result |
|---|
| Human DMs the bot | Bot can answer |
| Human mentions the bot in a channel | Bot can answer |
| Another bot messages or mentions the bot | Ignored |
| Teams retries the same activity | Deduped per Teams bot |
Not supported
- Adaptive Cards.
- Task modules, buttons, and message extensions.
- Teams file download/upload.
- Proactive messages.
- Ambient channel listening.
- Bot-to-bot workflows.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|
Teams message endpoint returns 401 | Bot Framework bearer token is missing, invalid, or for another App ID | Verify the Azure Bot App ID matches the value saved in Salambo. |
| Bot does not answer | Integration inactive, wrong bot installed, or unsupported activity type | Check the Microsoft Teams connection row and confirm you DM or explicitly mention the bot. |
| Reply fails | Client secret is wrong or expired | Rotate the client secret in Azure and paste the fresh value into Salambo. |
| Bot answers twice | One Teams activity unexpectedly created multiple runs | Preserve the affected run IDs and contact Salambo support. |
| Bot loop appears | Bot-authored activities are unexpectedly creating runs | Deactivate the connection, preserve the affected run IDs, and contact Salambo support. |
Verify the connection
After setup or credential rotation, verify:
- A human direct message creates one Salambo run.
- A channel mention creates one Salambo run.
- Each run completes and the bot replies once.
- The run Activity view shows the channel-triggered response.
- A bot-authored activity does not create a run.
If a check fails, use the connection status and the run’s Activity and Diagnostics views. Those surfaces identify authentication, admission, provider, extension, and reply-delivery failures without requiring access to Salambo service logs. 
