The Microsoft Teams integration enables users to interact with the AIW application through a Teams chatbot. This integration allows both Analysts and End Users to perform the same actions available in the web interface directly within Teams. The setup is performed by a Teams Admin, while usage is available to all supported personas.
AIW for Microsoft Teams
How the AIW Teams app connects your users to your Apex instance, what you register in your own Microsoft tenant, and how the credentials you share with us are limited and protected.
You own the bot | The credentials have narrow scope | The credentials are protected |
|---|---|---|
It is registered in your Microsoft tenant. Your administrators decide who can use it and can switch it off at any time, without involving us. | They allow delivering chat messages and reading the name and email of the person chatting. They give no access to mail, files, or other conversations. | They are encrypted at rest and masked once entered. Only an internal AIW component can retrieve them, and they are never sent to AI models. |
Architecture and Message Flow
Three trust boundaries are involved: your Microsoft tenant, Microsoft's Bot Framework service, and the AIW platform. Nothing is installed in your network, and no connection is ever opened into your environment.
Your bot's credentials are used only toward Microsoft services: your own Entra ID tenant, Microsoft Graph, and the Bot Connector. They are never used toward your network or any third party. The numbers match the steps below.
Step | What Happens | Security Control |
|---|---|---|
1 | A user sends a message to the AIW app in a personal (1:1) Teams chat. | Your Teams admin controls installation. Group chats and channels are declined. |
2 | Microsoft's Bot Connector forwards the message over HTTPS to the messaging endpoint you configured on your Azure Bot. | TLS in transit. Each request carries a Microsoft-signed token (RS256), and the gateway rejects any request whose signature or audience (your bot's client ID) does not match. |
3 | The gateway identifies which bot received the message and loads that bot's configuration. | Each bot maps to exactly one Apex instance. Credentials are decrypted only in memory. |
4 | Using your bot's credentials, the gateway gets a token from your Entra tenant and reads the sender's display name and email from Microsoft Graph. | Read-only. It reads one user (the sender) and three fields: |
5 | The sender's email is matched to their account in your Apex instance. | AIW works in that user's Apex context and permissions, the same as in Apex itself. |
6 | The question, plus any files the user attached in the chat, goes to the AIW AI service, and the answer streams back. | Internal platform network only, with no internet exposure. Bot credentials are not included. |
7 | The gateway posts the reply to the Bot Connector, which delivers it to the user in Teams. | Authenticated with a short-lived token issued to your bot. |
More details into Security Concerns
Your users chat with the AIW app in a one-to-one chat in Teams, and Microsoft's Bot Framework passes each message over HTTPS to the AIW Channel Gateway.
The gateway is the only part of AIW that can be reached from the internet, and it checks that every request is signed by Microsoft and addressed to your bot before handling it. It then gets the sender's name and email from Microsoft Graph, matches them to their account in your Apex instance, and passes the question to the AIW AI service. The answer goes back to the user in Teams through the same Microsoft service.
You get a bot dedicated to your Apex instance, so your messages are only ever processed for your instance. Nothing is installed in your network, and no connections are opened into your environment.
From a security perspective, you register the bot in your own Microsoft tenant, so your organization owns it and stays in control. Your admins decide who can use the app, and can pause, remove, or rotate its credentials at any time without involving service provider. The bot can only do what your admin approves: send and receive messages in its own chat, download files users attach there, and read user names and emails. It has no access to email, files, calendars, other Teams chats, or your Azure resources, and Microsoft's permission model enforces that. The credentials once entered gets masked and stored with encryption. Only an internal AIW component can retrieve them, and they are used only with Microsoft's sign-in service to get short-lived tokens. They are never sent to AI models or written to logs.
What you share with us
After creating the bot, you share three values from the Azure portal. Only one of them is a secret.
Value | Where to find it | Sensitivity |
|---|---|---|
Directory (tenant) ID | Entra ID → App registration → Overview |
|
Application (client) ID | Entra ID → App registration → Overview |
|
Client secret | App registration → Certificates & secrets |
|
Note
Send the client secret through a secure channel agreed with your AIW contact, not in plain email. We recommend an expiry of 12 months or less. See rotation below.
Rotate the secret
Create a new client secret under Certificates & secrets.
Share it with us securely. We confirm once it is active.
Delete the old secret. It stops working at once.
Because both secrets are valid during the overlap, rotation causes no downtime for your users.
How credentials are protected?
The following table provides insights into credential protection:
Action | Details |
|---|---|
Encrypted at rest | The secret is encrypted with Fernet (AES-128-CBC with HMAC-SHA256 authentication) before it is stored. The encryption key is kept separately as a platform secret. |
Masked after Entry | Once saved, the secret is never shown in full again in admin screens or configuration APIs. |
Internal Retrieval Only | Only the AIW Channel Gateway retrieves the decrypted secret, over the platform's internal network. The configuration service has no internet-facing route. |
Single Purpose | The secret is sent only to Microsoft's sign-in service ( |
Per-customer isolation | Each bot's credentials are used only for that bot's traffic and its one Apex instance. |
Setup and User Interaction
This section includes the below:
Setup and Configuration
The Setup and Configuration process enables administrators to integrate the AIW chatbot with Microsoft Teams, making it accessible to all organizational users. This process ensures that the chatbot is properly installed within Teams and ready for use by analysts and end users.
Administrators enable the AIW Teams chatbot for organizational users by installing and configuring the application.
Prerequisites
Teams Admin access (IT Admin / DevOps / Cloud team)
AIW Teams bot package (ZIP file provided by the application team)
Azure Bot Setup
Configuration
The Configuration step involves installing the AIW chatbot in Microsoft Teams by uploading the application package. This step ensures that the chatbot is successfully added to the organization’s Teams environment and becomes available for user interaction. During configuration, the administrator logs into Microsoft Teams, navigates to the app management section, and uploads the provided ZIP file.
To configure AIW to teams, perform the following steps:
Log in as an Administrator and open Microsoft Teams.
Navigate to Apps > Manage your Apps.
Click Upload an App.
Upload the provided .ZIP file.
Complete the installation.
Note
Only Teams Admins can upload the app; normal users do not have permission.
Key Notes for Admin
The app is not published to the Teams App Store; it is distributed as a ZIP file.
Only two actions required:
Upload app
Azure Bot Service Setup
Azure Bot Setup
The Azure Bot setup is a mandatory prerequisite for enabling communication between Microsoft Teams and the AIW platform. This process is performed by the customer’s Azure/IT Admin, who creates and configures the bot within their Azure environment.
Prerequisites
Before proceeding, ensure the following:
User must have Azure Portal access with administrator privileges
Permission to create Azure Bot Service and App Registration
Messaging Endpoint URL (provided by SymphonyAI)
Configuration Steps
To create and configure an Azure Bot resource in order to establish the integration endpoint, perform the following steps:
Log in to the Azure Portal.
Search for and select Azure Bot Service.
Click Create and provide the following details:
Bot Name: Enter a name for the Bot service.
Description: Describe about the bot service (for example: AIW Bot).
Navigate to Configuration and perform the following:
Set Bot Type to Single Tenant.
Create a new App Registration.
Enter the Messaging Endpoint URL (provided by SymphonyAI) .
Click Channels and perform the following:
Select Microsoft Teams.
Enable and save the configuration.
Note
Other fields such as OAuth settings, schema versions, and additional configurations can be left as default.
Figure: Azure
Generate a client secret for secure authentication between the bot and backend services.
Navigate to the App Registration created in Step 1.
Go to Certificates & Secrets.
Click New Client Secret.
Provide:
Description
Expiration duration
Click Add.
Important:
Copy the secret value immediately and store it securely.
Figure: Client Secret
Grant required Microsoft Graph permissions to enable user-level access.
Go to App Registration > API Permissions.
Click Add Permission.
Select Microsoft Graph.
Select User.Read.All and click Add Permissions.
Click Grant Admin Consent to finalize.
Figure: API Permission
After completing the setup, share the following details with the SymphonyAI team:
Application (Client) ID
Client Secret
Tenant ID
These credentials are required to connect the Azure Bot with the AIW backend services.
Notes
The customer fully owns the Azure configuration, removing the need for external approval workflows.
Only the following configurations are required:
Azure Bot setup
Client secret creation
API permission configuration
No additional Azure settings (authentication, token config, OAuth connections) are required.
Outcome
Once the above steps are completed:
The Azure Bot is successfully connected to Microsoft Teams
Secure communication is established with AIW backend services
Users can interact with the AIW chatbot directly within Teams
User Interaction
The Microsoft Teams integration enables analysts to seamlessly interact with the AIW application through a chatbot interface within Teams. Once the integration is set up by the admin, analysts can access the AIW bot directly from Teams and use it for their daily operations without needing to switch to the web application.
To interact with AIW through teams chat, perform the following steps:
Log in and open Microsoft Teams.
Locate the installed AIW chatbot.
Open the chat window and enter the required prompt.
Note
Live Agent Transfer (LAT) will not be supported for MS Teams Integration.