Connect Microsoft Teams with your own bot

Some organizations want kanman to reach Microsoft Teams through a bot they own. The bot then lives in your own Microsoft tenant, under your policies, and only people of your organization can talk to it. This page is written for the IT admin who sets it up. It takes about 15 minutes.

You need:

• an admin role in Microsoft Entra that may create app registrations,
• an Azure subscription in which you may create an Azure Bot (the Free tier is enough),
• a Teams admin who may upload custom apps,
• a kanman owner or admin who adds the connection in kanman (this can be you).

Microsoft Teams with your own bot is part of the Team plan, like Microsoft Teams with kanman’s bot.

1. Create the app registration

1. In the Microsoft Entra admin center, open App registrations and choose New registration.
2. Give it a name, for example kanman, and choose the account type Accounts in this organizational directory only (single tenant). No redirect address is needed.
3. On the registration’s overview, note the Application (client) ID and the Directory (tenant) ID.
4. Open Certificates & secrets, create a New client secret and copy its value right away. Microsoft shows it only once. Note when it expires; see Renew the client secret.

2. Add the connection in kanman

1. In kanman, open Workspace settings > Connections > Microsoft Teams (/<workspace>/settings/connections/microsoft_teams).
2. Choose Add Microsoft Teams and select Our own bot (single-tenant). The panel lists the same steps as this page.
3. Enter the Directory (tenant) ID, the Application (client) ID and the Client secret, and save.

kanman keeps the client secret as a workspace secret: nobody can read it back, not even admins. It is used only to sign your bot’s messages.

After saving, kanman tests the connection: it asks your tenant for a sign-in for the bot. If something is wrong, the connection says what:

The Microsoft Teams page now shows your own bot, with the messaging endpoint: an address that ends with /msteams-bot/bot/ and the connection’s ID. Copy address puts it on your clipboard. You need it in step 4.

3. Create the Azure Bot

1. In the Azure portal, create a resource of the type Azure Bot.
2. Choose a bot handle, your subscription and resource group, the pricing tier Free (F0), the type of app Single Tenant, and the creation type Use existing app registration with the application ID from step 1.

4. Set the messaging endpoint and turn on Teams

1. In the bot’s Configuration, paste kanman’s address into Messaging endpoint and save.
2. In the bot’s Channels, add Microsoft Teams, accept the terms and save.

5. Upload the Teams app

1. On kanman’s Microsoft Teams page, choose Download Teams app. You get kanman-teams-app.zip, the app package for your bot: it already contains your bot’s ID and kanman’s icons.
2. In the Teams admin center, open Teams apps > Manage apps and choose Upload new app. Pick the file.
3. Allow the app in your app permission policy (or in the policy for the people who should use kanman), and let it be installed where your teams work.

6. Say hello

In Microsoft Teams, add kanman to a team, a group chat or a direct message and send it a message. kanman answers in the chat. From then on, kanman remembers every team, channel, group chat and direct message it is added to, and team admins choose the places each team talks in, as described in Work with kanman in Slack and Microsoft Teams.

You do not need a link code with your own bot: your bot belongs to your workspace from the start.

Who kanman listens to

Your own bot changes how messages reach kanman, not what kanman does with them:

• kanman acts only for members of your kanman workspace, matched by their work email address. Anyone else gets a short note that kanman can only act for members.
• Text in Teams is read as information, never as instructions to kanman’s own rules. Who may draft stories or answer decisions from chat follows your team’s settings, as in the app.
• Your bot answers only people of your own tenant. Messages from other organizations do not reach kanman.

Runner-only workspaces

If your workspace runs everything on its own runners, Microsoft Teams is the one connection that does not go through the runner: Microsoft delivers your bot’s messages to a public address, so Teams messages pass through kanman’s cloud. The Microsoft Teams page says so. Everything else still runs on your runners. See Run everything on your runners.

Renew the client secret

Client secrets expire (after 6, 12 or 24 months, as chosen in step 1). Before yours does, create a new client secret in the app registration, open the connection in kanman with Edit, paste the new value and save. kanman tests the connection again right away.

Switch from kanman’s bot

If your organization used kanman’s bot before, add the connection with your own bot as described above. As soon as its test passes, your Microsoft 365 organization belongs to your own bot, and the earlier link stops. Remove the old kanman app from your Teams admin center afterwards.

Related pages

• Work with kanman in Slack and Microsoft Teams
• Channel modes and guardrails
• Connections
• Run everything on your runners