Microsoft Teams Connector for Contro1: AI Agent Approvals and Governance Workflows

Key takeaways

• Receive AI agent approval requests, escalation alerts, and governance workflow notifications directly in Microsoft Teams.
• Approve or reject actions from Teams while Contro1 validates the decision and records the audit trail.
• Use Microsoft Entra to link tenant and operator identity before Teams messages are delivered.
• Direct messages are recommended for accountability; channel delivery can be used as an optional shared fallback.

Microsoft Teams integration for AI agent approvals

Connect Microsoft Teams to Contro1 so operators can receive AI agent approval requests, escalation alerts, and governance workflows directly inside Teams.

Teams is the operator-facing approval channel. Contro1 remains the system of record for routing, reviewer identity, SLA handling, signed callbacks, and audit evidence.

• Receive approval requests from AI agents.
• Approve or reject actions directly from Teams.
• Receive escalation and SLA notifications.
• Keep a complete audit trail in Contro1.
• Link operator identity through Microsoft Entra.

Common use cases

Security and identity model

The Teams connector is designed as a communication channel for governed decisions, not as a replacement for Contro1 controls.

• Microsoft Entra provides tenant and operator identity.
• Teams is used only as the communication and approval channel.
• Approval decisions are validated and recorded by Contro1.
• Audit records remain stored in Contro1.
• Teams messages do not replace Contro1 governance controls.

1. Connect Microsoft Entra in Contro1

Open Contro1 Settings, go to Integrations, and connect Microsoft Entra before installing or testing the Teams bot. This lets Contro1 identify the tenant and map operators to Microsoft identities.

After the connection succeeds, the Microsoft Entra + Teams card shows the tenant, connected admin, Graph directory status, and Teams bot readiness.

2. Install the Contro1 Teams app

Open Microsoft Teams, go to Apps, search for Contro1 Bot or Contro1 Approvals Bot, and choose Add. If your organization restricts app installation, a Teams admin may need to allow or approve the app first.

You can also open the install dialog directly with the Teams app link below.

Open Teams installation

3. Open the bot once

Each operator should open the Contro1 bot in Teams and send a short first message, such as hi. That first message allows Contro1 to associate the Teams conversation with the operator identity from Microsoft Entra.

Once this link exists, Contro1 can send direct approval messages to that operator.

4. Send a Teams approval test in Contro1

Return to Settings -> Integrations and use Teams approval test to send a real test approval request to your own linked Teams chat. The request appears in Teams with Approve and Reject actions, just like a production approval.

After you answer in Teams, Contro1 polls the test request and shows Answer received in Teams with the decision. This confirms that the bot can deliver the request, Teams can send the answer back, and Contro1 can record the response.

In Operator Teams Status, verify that each operator shows Entra linked and Teams active. Pending bot chat means the operator has not opened the bot yet. No Entra ID means the operator needs to be invited or linked from Microsoft Entra.

5. Invite operators from Microsoft Entra

Use Invite from Microsoft Entra to search the connected tenant and invite selected users as Contro1 operators. This keeps operator identity aligned with the Microsoft tenant.

After users are invited, they still need to open the Contro1 Teams bot once so direct messages can be delivered.

6. Optional: receive requests in a channel

Direct messages are recommended for operator accountability and auditability. If your team also wants shared visibility, add the Contro1 bot to a Teams channel and mention it once so Contro1 can capture the channel conversation.

Use the shared channel fallback for notifications and visibility, not as a replacement for named reviewer accountability.

7. Send the first approval request

Create a normal Contro1 approval request from your agent, SDK, workflow, or API integration. Contro1 routes the request to the correct operator and delivers the Teams message when that operator has an active Teams chat.

The operator can approve or reject in Teams. Contro1 records the decision, updates the request, and returns the result through the normal signed callback or polling flow your agent already uses.

Troubleshooting

Get started

Connect Microsoft Entra, install the Contro1 Teams app, then send a test approval request. Once the first message works, expand routing, escalation, and governance workflows across the agents that need human accountability.

• Connect Microsoft Entra.
• Install the Contro1 Teams app.
• Send a test approval request.

Open Teams installation · Read the quickstart

Send full agent traceability

Beyond the approval call, attach identity, a run trace, the tools you invoked, and the context you retrieved. Each field is optional — add what you have. The verified identity always comes from your API key; a caller-supplied actor.agent_id is recorded as a claimed sub-agent until an admin verifies it.

• trace_id / parent_trace_id — link one run (and sub-agent runs) into a single trace.
• tool_calls[] — what the agent tried to do, so reviewers see the actions.
• retrieved_context[] — the data the decision was based on (RAG provenance).
• Then export a signed evidence packet from GET /requests/:id/evidence.

// POST /api/centcom/v1/requests — add these fields to the body you already send.
{
  "request_type": "approval",
  "title": "Refund $4,200 to customer 8831",
  "source": { "integration": "microsoft-teams" },
  "actor": { "agent_id": "billing-agent", "agent_name": "Billing Agent" },
  "trace_id": "trc_<run id>",
  "tool_calls": [{ "name": "lookup_order", "outcome": "success" }],
  "retrieved_context": [{ "source": "policy:refunds", "uri": "kb://policy/refunds" }],
  "continuation": { "mode": "decision" }
}

Agent identity, traceability & signed evidence

Frequently asked questions

Why do I need to open the bot once?

The first message allows Contro1 to associate the Teams conversation with the operator identity from Microsoft Entra.

Why am I seeing "Pending bot chat"?

The operator has not opened the Contro1 bot yet. Ask the operator to open the bot in Teams and send a short first message.

Can approvals be routed to channels?

Yes, but direct messages are recommended for operator accountability and auditability. Channels are best used as a shared notification fallback.

Does Teams store the approval audit trail?

No. Teams is the communication channel. Contro1 validates the decision and stores the request, reviewer, decision, callback state, and audit evidence.

Can this be used for AI governance workflows?

Yes. The Teams connector is designed for AI agent approval, escalation, and governance workflows where human accountability and evidence matter.