Microsoft Teams

Put CADCoPilot in the tool your engineers already have open all day. Teams is the most involved channel to set up — an Entra ID app registration plus an Azure Bot resource — but the least work for end users afterwards.

New to channels? Read Channels & Messaging first for the overall picture. This page is the complete Teams walkthrough.

The connection at a glance

Teams never talks to CADCoPilot directly. Your message goes to the Azure Bot Service, which forwards it to our webhook as a signed activity. The bot's own identity — an Entra application — is what proves the message is genuine and identifies your organization.

Step by step

IT admin Register the app in Microsoft Entra ID

1. In the Microsoft Entra admin center, go to App registrations → New registration. Name it something recognisable, e.g. CADCoPilot Teams Bot.

2. For Supported account types, choose Accounts in this organizational directory only (single tenant) unless you have a specific reason not to. No redirect URI is needed — the bot never performs an interactive sign-in.

3. Register it, then copy the two identifiers from the app's Overview page. Both are GUIDs, and both are identifiers rather than secrets:

   • Application (client) ID — e.g. 7c9e6a41-3f52-4b8d-9a10-5e2f8c4b1d63
   • Directory (tenant) ID — e.g. 2b41d0f7-8c35-4a19-b6e2-9d7f0a3c5182

4. Go to Certificates & secrets → New client secret. Give it a description and the longest expiry your policy permits.

   Copy the Value column, not the Secret ID. The value is shown once and never again — if you navigate away without copying it, delete the secret and create another.

   Put the expiry date in your calendar. When the secret expires, replies stop being delivered.

IT admin Create the Azure Bot and point it at CADCoPilot

1. In the Azure portal, create a resource of type Azure Bot.

2. For Microsoft App ID, choose Use existing app registration and paste the Application (client) ID and, for single-tenant, the Directory (tenant) ID from the previous section. Do not let Azure create a new app — CADCoPilot must hold the secret for the same app the bot runs as.

3. Once created, open the bot resource → Settings → Configuration and set the Messaging endpoint to exactly:

   https://www.cadagent.plmcadutilities.com/api/channels/teams/messages

   Save. Azure will not accept a plain-HTTP endpoint.

4. Open Channels on the bot resource and add the Microsoft Teams channel. Accept the terms; no extra configuration is needed.

5. Make the bot reachable from Teams. Either:

   • use Open in Teams on the Teams channel row for a quick single-user test, or
   • build a Teams app package (a manifest.json with your bot's app id in the bots section, plus a colour and an outline icon), zip it, and upload it in the Teams admin center → Teams apps → Manage apps so everyone in the company can find it.

   A personal-scope bot is enough — CADCoPilot answers in one-to-one chats. Requests from channels and group chats are handled the same way, but the answer is posted back into that conversation, where everyone can read it.

Org admin Save the identifiers in the org portal

1. Sign in to the org portal as an organization admin and open Messaging Channels.

2. Fill in the Microsoft Teams (Entra ID) panel:

   • Enabled — ticked (it is by default).
   • Application (client) ID — the bot app's GUID. This is also how CADCoPilot recognises that an incoming activity belongs to your organization, so it must match the bot exactly.
   • Directory (tenant) ID — your Entra directory GUID.
   • Client secret — the Value you copied from Certificates & secrets.

   

3. Press Save. Teams needs no restart: the webhook reads the saved values on every message, so the channel is live as soon as the save completes.

4. If your users do not sign in to CADCoPilot with their Microsoft work account, leave User self-connect ticked — they will need the one-time code route described below.

End user Start chatting

1. In Teams, find the company's CADCoPilot bot — search for it by name, or open the app your IT admin published, and start a chat.

2. Send a first message, for example hello.

   • If your CADCoPilot account carries your Microsoft work identity, you are linked automatically — no code, no button. Carry on to the test below.
   • If it does not (for example, you signed up with an email address and password rather than a Microsoft account), the bot replies that the account is not linked. Use the code route in the next step. This is normal, not a fault.

3. Code route. Open Settings → Messaging Channels in the CAD add-in or the tray Agent status window, press Connect next to Teams, and copy the one-time code — 32 hexadecimal characters, valid for 30 minutes, single use.

   

4. Paste that code into the Teams chat with the bot, on its own, and send it. The bot replies:

   “Linked! You can now drive your CAD from here.”

End user Your first test message

Make sure the tray Agent is running and connected on the workstation you want to drive, then:

Then something that builds geometry:

And verify the result rather than trusting the wording:

Exact values

Re-saving and rotating the secret

• Blank means keep. Once the client secret is stored, the field shows (stored) and a masked placeholder. Saving with it blank keeps the stored secret — so you can correct the tenant ID without retyping it.
• The two GUIDs are different: they are saved exactly as typed, and clearing one clears it. Do not blank them by accident.
• To rotate before expiry: create a second client secret in Entra alongside the current one, paste the new value into the portal, save, verify a live message round-trips, and only then delete the old secret. Because Entra allows two secrets at once, this is a zero-downtime change.
• An expired secret is silent on the way in. Inbound messages still validate (they are signed by the Bot Framework, not by your secret) and CoPilot will still run the command on the workstation — but the reply cannot be posted back. The symptom is “my message did something, but Teams shows no answer”.
• To take Teams out of service, untick Enabled and save. This takes effect immediately, with no restart.

Troubleshooting

Security

• The client secret is encrypted at rest with a key scoped to your organization and is decrypted only inside the server, when it requests a token to post a reply. It never reaches a workstation.
• The portal never shows it back. After saving, the field shows (stored) and a masked placeholder. The application and directory IDs are identifiers, not secrets, and stay visible to organization admins.
• Every inbound activity is authenticated. CADCoPilot validates the Bot Framework bearer token — issuer https://api.botframework.com, audience equal to your bot's application id, signature checked against Microsoft's published keys — before trusting the sender. Anything else is rejected with 401 and never reaches a workstation.
• Identity comes from Entra, not from a display name. The sender is identified by their directory object id, so a renamed or spoofed display name changes nothing.
• Mind group chats. A reply is posted into the conversation the message came from. Asking the bot something in a channel means the answer — including any model data it quotes — is visible to everyone in that channel. Use a one-to-one chat for anything sensitive.
• To stop new links across the company, untick User self-connect and save; note that automatic work-account matching is unaffected by that switch. To take the channel out of service entirely, untick Enabled and save.
• To revoke one person's link, the reliable route today is to have the correct user re-link that Teams identity to themselves, which overwrites the link. There is no self-service “disconnect” button yet — for a permanent removal (a leaver), ask CADCoPilot support to delete the identity link, and disable the account in Entra as usual.

Related

• Channels & Messaging — the shared architecture and the tray Agent
• Telegram setup · WhatsApp setup
• Verifying Results — always confirm geometry, never trust the wording of a reply