How to integrate Fontana Agents with MS Teams

People talk to a Fontana agent inside Microsoft Teams. You save one Microsoft tenant on AI → Chat Channels (/ai/channels). That tenant holds a creator app. When you turn the Teams ability on for an agent, Fontana uses the creator app to create that agent’s own Teams bot in your directory.

The creator app is not the bot

The Microsoft tenant form saves the app that creates bots. People never chat with that app. Each agent with the Teams ability gets a separate bot, listed on Chat Channels under the agent’s name. You install that bot from your organisation’s Teams app catalog.

What you see on Chat Channels

On the page	What it is
Microsoft Teams	One saved directory for this deployment: tenant id, subscription, resource group, creator app id, and the Teams administrator who signed in. The secret is stored and the page leaves the secret box empty. Admin sign-in needed means the credentials are saved and no administrator has signed in yet. Connected means both are in place. It is not a bot.
A row named after an agent	That agent’s Teams bot. It appears after you turn the Teams ability on. Connected on that row means the bot can accept messages.

An empty bot list means no agent bot has been created yet. The Microsoft Teams setup can still be saved. Open Microsoft Teams to view the saved ids. The form shows those ids because they are already stored.

Where each value comes from

Create these in your own Microsoft directory before you save the form. Fontana does not share a directory across customers.

Directory tenant ID

1. Open the Microsoft Entra admin center.
2. Go to Identity → Overview.
3. Copy Tenant ID.

The same value is Directory (tenant) ID on the creator app’s Overview page.

Azure subscription ID

1. Open the Azure portal and go to Subscriptions.
2. Open the subscription that will hold the bots.
3. Copy Subscription ID.

This subscription is the billing container for the bots Fontana creates. Each bot is an Azure Bot on the free F0 tier, in the Teams channel. Fontana runs the agent. Opening a subscription can ask for a payment method on the Azure account.

On that subscription, open Resource providers, find Microsoft.BotService, and register it.

Resource group

1. In the Azure portal, open Resource groups.
2. Create a group in the subscription above, or choose one that already exists.
3. Copy the group name into Fontana (for example teams-bots).

Fontana creates each agent’s bot inside this group.

Creator app ID

1. In Entra, open Identity → Applications → App registrations → New registration.
2. Name the app for this job, for example Fontana Teams creator.
3. Choose Accounts in this organizational directory only.
4. Register, then copy Application (client) ID.

Then grant what the creator needs:

1. On the app, open API permissions → Add a permission → Microsoft Graph → Application permissions and add Application.ReadWrite.All.
2. Add a permission again, choose Delegated permissions, and add AppCatalog.ReadWrite.All.
3. Choose Grant admin consent.
4. Open Authentication → Add a platform → Web and paste the redirect URI shown under Teams administrator sign-in on the Microsoft Teams tile in Fontana.
5. In the Azure portal, open the resource group → Access control (IAM) → Add role assignment.
6. Assign Contributor to this app’s enterprise application (its service principal).

The application permission creates each agent’s Entra app. The delegated permission is for the organisation catalog, which is covered in the next section.

Creator client secret

This box takes the Value of a client secret on the creator app. It is the password for that app, so Fontana can sign in to Microsoft Graph and Azure and create each agent’s bot.

1. Entra → App registrations → the creator app.
2. Certificates & secrets → Client secrets → New client secret.
3. Add it, then copy the Value column immediately.

Entra shows Value once. The Secret ID column is a different string. Fontana needs Value.

Paste Value into Creator client secret and save. Fontana stores it in your tenant Vault. The next time you open the form, the secret box is empty. Paste a new Value only when you want to replace the stored secret. When the ids are already correct, cancel and leave the stored secret in place.

Directory password policy

Keep Block password addition on for the directory (Entra → Enterprise applications → Application policies). The creator still has to mint secrets, so add two exceptions and leave the directory block on for everyone else:

• An exception on the creator app, so you can create this app’s own secret.
• A caller exception on the creator service principal, using a custom security attribute, so that service principal can add a secret on each agent bot it creates. Those bots do not exist yet at the moment the creator calls Graph.

Teams administrator sign-in

Microsoft Graph publishes an app to the organisation catalog only for a signed-in person. The creator app’s own secret cannot do it, whatever permissions it holds. So after you save the form, a Teams Administrator or Global Administrator signs in once:

1. Open the Microsoft Teams tile on Chat Channels. Until someone signs in, its badge reads Admin sign-in needed.
2. Under Teams administrator sign-in, choose Sign in with Microsoft. A Microsoft window opens for the creator app.
3. Sign in with the administrator account and accept the request.

Fontana keeps that sign-in in your tenant Vault and uses it only to publish and remove agents’ catalog apps. The tile shows who signed in and when. The sign-in lasts while it is used; when Microsoft retires it, turning the Teams ability on fails with a message that names this step, and Sign in again on the tile repairs it. Saving the form with a different creator app or tenant drops the sign-in.

What Fontana does with the tenant

Fontana signs in as the creator app for the directory and Azure calls, and as the Teams administrator for the catalog. When you turn an agent’s Teams ability on, Fontana:

1. Creates an Entra app for that agent.
2. Adds a client secret on that app and stores it in Vault.
3. Creates a single-tenant Azure Bot (F0, location global) in your resource group, with the Teams channel enabled.
4. Publishes a Teams app to your organisation catalog with the administrator sign-in. The app name is the agent’s name.
5. Lists that bot on Chat Channels.

When no administrator has signed in, Fontana stops before step 1 and shows that reason on the agent.

Turning the Teams ability off removes that agent’s Entra app, Azure Bot, catalog app, and Chat Channels row.

If the bot cannot be created, Fontana turns the Teams ability off and shows the reason on the agent. The save confirmation only means the agent file was stored.

Talk to the agent in Teams

1. Wait until Chat Channels lists a row named after the agent. Until that row exists, Teams has no app to find.
2. In Microsoft Teams, open Apps → Built for your org. Do not search for the agent in a new chat’s To box. That box searches people, and the bot is not a person.
3. Add the app named after the agent. Install it in a personal chat or in a team channel.
4. On the agent’s Teams ability, set Channel whitelist. An empty whitelist allows no destination. For a personal chat, add that person’s Entra user id. For a channel, add the channel name or the channel id.
5. In a channel, mention the agent. In the personal chat, send a message.

The reply comes back in that Teams thread. The thread is a Fontana conversation, so the agent’s tools, handoff, and audit match Flow chat. Someone who has not linked a Fontana account receives a sign-in link. After they link, their messages run with their permissions and spending cap.

Post into a channel from Fontana

The Teams ability can post into a channel, the same way the Slack ability posts into Slack.

1. Add the agent’s Teams app to the team (Apps → Built for your org → Add to a team). A personal install does not let the bot speak in a channel.
2. On the agent’s Teams ability, put the channel on Channel whitelist. Use the channel link (copied from the channel menu), the channel name, or the channel id. An empty whitelist allows no post.
3. Ask the agent in Fontana to post, and give it that same channel link.

The message is sent as that agent’s bot. The post waits until the app is in the team and the channel is on the whitelist.

The bot can read earlier messages in the team or chat where you installed it. A mention inside an existing thread copies that thread into one Fontana conversation. Later messages continue from the last point already copied.

On the Teams ability you can also set free-response channels, whether a thread needs another mention to continue, and whether other bots may invoke the agent. Those four settings start from the connection and can be replaced on the agent.

Enabled on the bot row means Fontana may use it. Connected means the bot credentials loaded and Fontana can accept messages from Teams.

Related

• Chat Channels covers Slack and Teams together, including identity linking.
• Slack is a separate connection. The Slack ability posts to Slack. The Teams ability posts to Teams as this agent’s bot.