Microsoft Teams

Connect Cardinal to Microsoft Teams so the AI agent can resolve users and channels in your tenant and post messages to them on demand. You register an Entra app in your own Microsoft 365 tenant, grant admin consent on it, and paste the resulting credentials into Cardinal — no Cardinal-hosted Microsoft assets, no third-party multi-tenant app to trust.

Overview

With the Microsoft Teams integration, the AI agent can:

• Find a user by display name, given name, surname, UPN, or email
• Find a standard channel by name, optionally narrowed to a specific team
• Send a 1:1 message to a user the agent has resolved
• Send a top-level message to a standard channel the agent has resolved

The agent uses bot delivery — your Entra app installs in a user’s personal scope (for 1:1 sends) or in a team (for channel sends) and proactively posts from there.

What changed for v1

The previous Teams integration relied on a customer-supplied incoming webhook URL (an Office 365 connector). Microsoft has retired that path: connector incoming webhooks roll out of Teams between May 18 and May 22, 2026 (Microsoft retirement announcement ). Cardinal removed connector webhook support along with the rollout.

The replacement is agent (bot) delivery backed by your own Entra app:

• Capability is now Agent, not Notify.
• You register an Entra app in your tenant and paste (tenantId, clientId, clientSecret) into Cardinal.
• Cardinal mints Microsoft Graph tokens against your tenant directly. There is no Cardinal-side Microsoft asset and no Cardinal-controlled trust path — important for airgapped on-prem deployments.

If you previously configured a Teams alerting webhook, that path no longer works — set up the agent app instead.

Capabilities

v1 scope

Supported:

• 1:1 user messages (target identified by Microsoft Entra object id, not UPN)
• Standard-channel messages (top-level thread, no replies)

Out of scope in v1:

• Private channels
• Shared channels
• Group chats
• Threaded replies, message edits, message deletes
• Adaptive Cards / attachments — plain text only
• Reading channel/chat history
• Presence and status lookups

Configuration

Credentials

Either all three are set or all three are absent. A partial triple is rejected at create/update time so a hand-edited row can’t sit in a half-broken state.

Prerequisites

• A Microsoft 365 tenant with Entra admin privileges
• The ability to register an Entra app in that tenant and grant admin consent on it
• Network egress from Maestro to login.microsoftonline.com and graph.microsoft.com (your network team may need to allow these in airgapped or restricted-egress deployments)

Entra app registration

1. Sign in to the Microsoft Entra admin center  as a tenant admin.
2. Go to Identity → Applications → App registrations and click New registration.
3. Name the app something memorable (e.g., Cardinal Teams Agent).
4. Supported account types: choose Accounts in this organizational directory only. The app does not need to be multi-tenant.
5. Leave Redirect URI blank — the integration uses the OAuth client-credentials grant, not a redirect flow.
6. Click Register. Copy the Application (client) ID and Directory (tenant) ID from the Overview page.

Required Graph API permissions

Open the app’s API permissions page and grant these application permissions (not delegated):

Click Grant admin consent for [your tenant]. The status column should turn green for every permission.

Client secret

On the app’s Certificates & secrets page, click New client secret, give it a description and an expiry, and copy the value immediately — Microsoft displays it only once. This is the Client Secret Cardinal stores.

Setup

1. In Cardinal, navigate to Settings → Integrations and click Add Integration.
2. Select Microsoft Teams.
3. Enter a Name and Slug for the integration.
4. Paste your Tenant ID, Client ID, and Client Secret.
5. Click Test Connection to verify Cardinal can mint a Graph token and reach the directory.
6. Click Save.

How send_message addresses targets

For users, the agent must use the Microsoft Entra object id returned by find_user — not the UPN, not the email address. Microsoft’s bot APIs use the object id as the durable proactive-send key.

For channels, the agent uses the (team_id, channel_id) pair returned by find_channel. The same channel name (e.g., general) can exist in many teams; the team id disambiguates.

Errors you might see

The agent surfaces a small, actionable error vocabulary: