Microsoft 365 and Teams

The Microsoft 365 package uses separate identities for Teams Bot Framework traffic and delegated Microsoft Graph tools. This separation keeps automatic Teams replies independent from Outlook, calendar, OneDrive, SharePoint, and explicit Teams Graph actions.

Decide what to enable

Select tools before connecting. The setup derives only the permission tiers required by those tools:

• personal read for profile, mail, calendar, and OneDrive reads;
• personal write for mail, calendar, and OneDrive changes;
• organization read for SharePoint and Teams organization data;
• organization write for organization-scoped changes.

Personal tools are not available inside group chats or Team channels. Users must repeat personal mail, calendar, profile, or OneDrive requests in a direct message.

Recommended guided setup

Use Guided Azure Cloud Shell setup under Connect.

1. Review the selected tools and derived permission changes.
2. Copy the generated one-hour script into Azure Cloud Shell.
3. Review the additions and removals printed before mutation.
4. Confirm DEPLOY when the proposed resources are correct.
5. Use the separate reconciliation choice when permissions must be reduced.
6. Copy the final PNEUM-M365-SETUP:... receipt back to the connector.
7. Complete Sign in with Microsoft for the owner identity.

The script can create or repair the required Entra applications, OAuth connections, and Azure Bot resources. It declares permissions but does not grant tenant-wide admin consent automatically.

Teams app and conversation access

Build or obtain the Pneum.ai Teams app package for the configured transport application, then upload it through Teams → Apps → Manage your apps → Upload an app or your tenant catalog. Install it in each relevant Team or group chat.

Allowlist direct-message users by immutable Entra object ID. For group chats and channels, paste the complete Copy link URL into the connector so Pneum.ai can extract the stable conversation or groupId/channelId route.

Mention requirements, rate limits, write controls, roles, and approval policy still apply after a conversation is admitted.

Network endpoint

An internet Cloud agent exposes the isolated Bot Framework route on its documented HTTPS endpoint. A Tailscale agent can use Microsoft Teams Funnel, which publishes only the Activity port while keeping the owner UI and internal transport private.

Never expose the internal automatic-outbound listener. Use the exact Azure Bot endpoint shown by the connector after launch.

Graph scope examples

Typical selected tools can request Mail.Read, Mail.Send, Calendars.ReadBasic, Calendars.ReadWrite, Files.Read, Files.ReadWrite, Sites.Read.All, or Teams chat scopes. Only the scopes derived from selected tools should be present.

Troubleshoot

• Missing ambient Team or group messages: verify the app installation, resource-specific consent, mention setting, and allowlist.
• Microsoft sign-in repeats: reconnect the affected permission tier; changed scope fingerprints intentionally invalidate that tier.
• Bot receives nothing: confirm the Azure Bot messaging endpoint and authenticated Activity path.
• Owner UI works but Teams does not: verify port 8443 or Funnel independently from private port 443.