Microsoft Teams Connector for Contro1: Approval Requests in Teams

Key takeaways

• Receive AI agent approval requests from Contro1 directly in Microsoft Teams.
• Approve or reject actions from Teams while Contro1 validates the decision and records the audit trail.
• Use Microsoft Entra to link tenant and operator identity before Teams messages are delivered.
• The Teams app does not generate or modify AI content; it presents approval requests created by the customer organization's own agents and automation workflows.

Microsoft Teams integration for AI agent approvals

Connect Microsoft Teams to Contro1 so operators can receive AI agent approval requests directly inside Teams.

Teams is the operator-facing approval channel. Contro1 creates the approval request, sends it to the right reviewer in Teams, and records the final decision.

• Receive approval requests from Contro1 in Microsoft Teams.
• Approve or reject actions directly from Teams.
• Keep a complete audit trail in Contro1.
• Link operator identity through Microsoft Entra.

Prerequisites and account requirements

The Microsoft Teams app requires an active Contro1 account. A workspace admin must connect Microsoft Entra in Contro1 before operators can receive approval cards in Teams.

Each reviewer must exist as a Contro1 operator, be invited or linked from Microsoft Entra, install or open the Contro1 Teams app, and send one first message to the bot so Contro1 can capture the Teams conversation for direct messages.

The Teams app is an approval surface. It does not create or modify AI-generated content in Teams. It presents approval requests created by the customer organization's own agents and automation workflows; the decision record is stored in Contro1.

What happens after approval or rejection

When the reviewer selects Approve or Reject in Teams, Contro1 validates that the Microsoft Teams user maps to an eligible Contro1 operator. The request is then marked answered in the Contro1 web app, the Teams card is updated to show the final decision, and the reviewer identity is written to the audit trail.

The Contro1 web app shows the same result so admins can verify that the Teams answer was received and recorded.

• Approve: record the decision and update the Teams card.
• Reject: record the denial and update the Teams card.
• Comment or text response: store the response with the request and include it in the audit evidence.

Common use cases

Security and identity model

The Teams connector is designed as a communication channel for approval decisions. The request record and audit trail remain in Contro1.

• Microsoft Entra provides tenant and operator identity.
• Teams is used only as the communication and approval channel.
• Approval decisions are validated and recorded by Contro1.
• Audit records remain stored in Contro1.
• Teams messages do not replace Contro1 approval records or routing rules.

1. Connect Microsoft Entra in Contro1

Open Contro1 Settings > Single sign-on > Microsoft Entra ID and connect Microsoft with a Microsoft administrator account before installing or testing the Teams bot. This lets Contro1 identify the tenant and map operators to Microsoft identities. The Teams card under Settings > Notifications uses the same connection and has the same Connect button.

After the connection succeeds, the Microsoft Entra ID card shows the tenant, who connected it and the Graph directory status; the Microsoft Teams card under Notifications shows the tenant and Teams bot readiness.

2. Install the Contro1 Teams app

Open Microsoft Teams, go to Apps, search for Contro1 Bot or Contro1 Approvals Bot, and choose Add. If your organization restricts app installation, a Teams admin may need to allow or approve the app first.

You can also open the install dialog directly with the Teams app link below.

Open Teams installation

3. Open the bot once

Each operator should open the Contro1 bot in Teams and send a short first message, such as hi. That first message allows Contro1 to associate the Teams conversation with the operator identity from Microsoft Entra.

Once this link exists, Contro1 can send direct approval messages to that operator.

4. Send a Teams approval test in Contro1

Return to Settings -> Integrations and use Teams approval test to send a real test approval request to your own linked Teams chat. The request appears in Teams with Approve and Reject actions, just like a production approval.

After you answer in Teams, Contro1 polls the test request and shows Answer received in Teams with the decision. This confirms that the bot can deliver the request, Teams can send the answer back, and Contro1 can record the response.

In Operator Teams Status, verify that each operator shows Entra linked and Teams active. Pending bot chat means the operator has not opened the bot yet. No Entra ID means the operator needs to be invited or linked from Microsoft Entra.

5. Invite operators from Microsoft Entra

Under Settings > Single sign-on > Microsoft Entra ID, use Invite from Microsoft Entra to search the connected tenant and invite selected users as Contro1 operators. This keeps operator identity aligned with the Microsoft tenant.

After users are invited, they still need to open the Contro1 Teams bot once so direct messages can be delivered.

6. Send the first approval request

Create a normal Contro1 approval request from your agent, SDK, workflow, or API integration. Contro1 routes the request to the correct operator and delivers the Teams message when that operator has an active Teams chat.

The operator can approve or reject in Teams. Contro1 records the decision and updates the request in the web app.

Troubleshooting

Get started

Connect Microsoft Entra, install the Contro1 Teams app, then send a test approval request. Once the test works, operators can receive Contro1 approval requests inside Teams.

• Connect Microsoft Entra.
• Install the Contro1 Teams app.
• Send a test approval request.

Open Teams installation · Read the quickstart

Send full agent traceability

Beyond the approval call, attach a run trace, the tools you invoked, and the context you retrieved. Each field is optional; add what you have. Identity always comes from your credential. When a named part of a multi-agent system made the call, say which with the Contro1-Sub-Agent header (as_sub_agent in the SDKs): Contro1 registers it under this agent, and it never has more authority than this agent.

• trace_id / parent_trace_id - link one run (and sub-agent runs) into a single trace.
• tool_calls[] - what the agent tried to do, so reviewers see the actions. A hook can report every tool call for you.
• retrieved_context[] - the data the decision was based on (RAG provenance).
• Then export a signed evidence packet from GET /requests/:id/evidence.

// POST /api/centcom/v1/requests - add these fields to the body you already send.
// Optional header for a named part of this agent: Contro1-Sub-Agent: billing
{
  "request_type": "approval",
  "title": "Refund $4,200 to customer 8831",
  "source": { "integration": "microsoft-teams" },
  "trace_id": "trc_<run id>",
  "tool_calls": [{ "name": "lookup_order", "outcome": "success" }],
  "retrieved_context": [{ "source": "policy:refunds", "uri": "kb://policy/refunds" }],
  "continuation": { "mode": "decision" }
}

Agent identity, traceability & signed evidence

Frequently asked questions

Why do I need to open the bot once?

The first message allows Contro1 to associate the Teams conversation with the operator identity from Microsoft Entra.

Why am I seeing "Pending bot chat"?

The operator has not opened the Contro1 bot yet. Ask the operator to open the bot in Teams and send a short first message.

Does Teams store the approval audit trail?

No. Teams is the communication channel. Contro1 validates the decision and stores the request, reviewer, decision, and audit evidence.

Does the Teams app include internal workflow controls?

No. The Teams app is the personal approval channel. Routing, SLA handling, manager review, and other workflow rules are managed inside Contro1 and are not separate Teams app actions.

Related resources