Microsoft Teams Integration

Orvanta’s Microsoft Teams integration lets a workspace connect to a Teams team and channel, post approval requests there, and send instance critical alerts to a channel. It is an Enterprise-tier capability (teams in the edition matrix) and is built into the single Orvanta enterprise build.

Caution

The Microsoft Graph request shapes used here were written from Microsoft’s API documentation and have not been exercised against a live Teams tenant. Treat a first connection as something to verify in your own tenant.

Instance setup

Teams uses one instance-wide Microsoft Graph token rather than a per-workspace install flow. An instance operator registers an Entra ID application with app-only Graph permissions (Group.Read.All, Team.ReadBasic.All, ChannelMessage.Send) and stores its access token as the f/teams_bot/global_api_token resource in the admins workspace. Every workspace then picks a team from what that token can see.

Connecting a workspace

A workspace admin opens Workspace Settings, the “Slack / Teams” tab, and picks a team and channel from the Graph-backed pickers. The same tab can disconnect the team, edit the /orvanta command script setting, and send a test message.

Orvanta stores the command script setting, but this page does not claim that Teams commands run it: no Teams message-command execution path was found in the backend, so do not build around it.

Approval steps

A flow’s approval step can notify a Teams channel in two ways:

• Link-out message (default). Orvanta posts a message containing the approval link; the approver opens Orvanta’s approval page in a browser. This is also used whenever the approval carries a resume form.
• Interactive Adaptive Card. If an operator has registered an Azure Bot Service application and stored its application id as the f/teams_bot/global_bot_app_id resource in the admins workspace, an approval without a resume form is posted as an Adaptive Card with Approve and Reject buttons. Teams delivers the button press to POST /teams/activities, which validates the Bot Framework token against that application id. Without a registration this endpoint rejects every request, and approvals stay on the link-out path. The round trip against a real Teams client has not been verified.

Critical alerts

Instance settings can send critical alerts (worker and queue health problems the instance itself detects) to a Teams channel, alongside Slack and email. Alerts use the same f/teams_bot/global_api_token resource and the team and channel chosen in the setting. Critical alerting requires the Business tier or higher; the Teams connection itself is Enterprise. If the token resource is missing, the failure is logged and the next channel is tried.

Related

See Slack Integration for the equivalent integration.