Hermes Agent Microsoft Teams Setup for Work Accounts

What does Microsoft Teams require that Slack does not?

Teams adds a Microsoft Entra tenant to the picture. You need an app registration, a client secret, and tenant admin consent before the bot can read or post anything in a work account.

Personal Microsoft accounts behave differently from work accounts. A managed Hermes Agent deployment for Teams is designed for organization tenants, where an administrator can consent once for the whole company.

Which permissions should the Teams assistant have?

Start with the ability to receive messages and post replies, then add channel or file reading only when the workflow genuinely needs it. Broad Graph permissions are the most common source of over-privileged assistants.

• Message read and send permissions for the assistant conversation.
• Channel message reading only for channels the assistant summarizes.
• No directory, mailbox, or file scope unless a documented workflow requires it.
• Record every permission in the deployment notes so it can be reviewed later.

Why does the Teams bot install but never answer?

The most common cause is missing tenant admin consent. A second frequent cause is a client secret that expired or was regenerated after the deployment was created.

• Confirm an administrator granted consent for the exact permissions requested.
• Check the client secret expiry date and rotate before it lapses.
• Verify the bot is enabled in the Teams admin center and not blocked by an app policy.
• Confirm the deployment status is running rather than provisioning or failed.

How do you keep a Teams assistant governable?

Keep one assistant per purpose, restrict it to the channels it needs, and require approval for anything that posts outside the assistant conversation.

Teams is a regulated surface in many organizations. Document who owns the app registration, who can rotate the secret, and which channels the assistant may read so that access reviews are straightforward.

How should you roll Teams out across the company?

Start with one team and one channel, keep the bot read-only at first, and widen permissions only after the replies are consistently useful.

A staged rollout keeps the blast radius small. If a reply is wrong in a private chat, nobody notices; if it is wrong in an all-company channel, the cost is immediate.