How to Build a Microsoft Teams AI Agent for the Enterprise

Microsoft Teams is where employees already ask how something works, request access, and look for the right document. A Teams AI agent meets them there, answering from your sources with citations, fulfilling standard requests through governed tools, and routing the rest, under the tenant's identity model so it never knows or does more than the person asking. This playbook builds it. It applies the platform view in Power Automate vs AI agents and the retrieval architecture in the enterprise RAG reference architecture; the collaboration-surface pattern mirrors how to build a Slack AI assistant.

Step 1: Which roles will the agent play?

Teams is a surface. Before building the bot, list the roles it will play and write each as a job description with the Digital FTE job description template: an IT helpdesk role, an HR inquiry role, an engineering knowledge role. Each has its own scope, tools, permissions, and evaluation set; the bot routes to the right role by channel and intent.

Role	Typical channel	First capabilities
IT helpdesk	IT support channel, direct chat	Knowledge answers; access requests through the catalog
HR inquiries	HR channel, direct chat	Policy answers from own record; onboarding reminders
Engineering knowledge	Team channels	Codebase and runbook questions with citations
Status lookup	Operations channels	Order, ticket, or deployment status from connected systems

Step 2: How is identity handled?

Register the agent as an application with the minimum permissions. Each incoming message carries the user's tenant identity; the agent exchanges it for a token to act on that user's behalf and carries the delegated context on every retrieval and tool call. Channel answers use only sources every member may read; direct-chat answers use the individual's entitlements. The model is in the agent identity and access control whitepaper.

Step 3: How are answers grounded?

Index the sources each role needs: policy documents, knowledge articles, runbooks, decision records, with versions and permissions preserved. Retrieval filters by the user's access; every answer cites its source; ungrounded answers are prohibited. Sensitive-topic triggers for the HR role route immediately rather than answering, as described in how to build a Workday AI agent.

Step 4: Which actions are exposed, and how?

Actions go through the gateway as classified tools from the relevant MCP servers: catalog requests through the ITSM server, status lookups through the order or ticketing servers, and so on. Reads flow; reversible writes are sampled; consequential writes pause for approval, which can be delivered as an approval card to the approver inside Teams. Nothing is granted to the agent beyond the intersection of its role and the user's entitlements. The server pattern is in how to build an MCP server for ServiceNow.

Step 5: How is untrusted content handled?

Channel messages, shared files, and meeting transcripts are inputs written by many people and sometimes by external guests. The agent treats them as data; instructions inside them trigger no action. Summarization of threads is read-only and cited. Injection cases are part of the evaluation set; see what is indirect prompt injection.

Step 6: What is the evaluation set?

Real questions and requests from the target channels, with verified answers, sources, and correct actions or refusals, by role. Score retrieval, grounding, correctness, action end state, routing correctness, and injection resistance. Gate every change; sample live answers weekly; feed thumbs-down responses into the set.

Step 7: Rollout channel by channel

1. One role in one channel, answers only, with a feedback control on every reply.
2. Add the first reversible action for that role.
3. Add the second role in its channel.
4. Add direct chat with individual scoping.
5. Add approval cards for gated actions.
6. Expand channel by channel with the owning team's agreement.

What does the agent look like in daily operation?

In the IT support channel, an employee asks how to connect to the VPN from a personal device. The agent answers from the current article with a citation and a link, and a colleague who had the same question sees the answer too. A second employee asks for access to the finance reporting tool; the agent recognizes a catalog request, confirms the details, creates it through the ITSM server, and posts that the owner has been asked to approve. The approver sees a card in Teams, approves, and the agent confirms provisioning.

In a direct chat, an engineer asks which service owns a particular API and how it is deployed; the agent answers from the code-owner file and the runbook, both cited, scoped to repositories the engineer may read. A guest user in a shared channel posts a message telling the bot to export the channel's files; the bot does nothing, because message content is data and the guest has no such entitlement. Every action is logged with the agent's identity and the user it acted for.

What is measured?

Metric	Why
Resolution without human touch, per role	Automation
Citation click-through and answer ratings	Trust and quality
Escalations and their causes	Coverage gaps
Request fulfillment time	Outcome
Hours saved per role, from ticket and question deflection into resolution	Economics

How does this fit the wider platform?

The Teams agent is a surface over the same foundation every other agent uses: gateway, MCP servers, identity, retrieval, and evaluation. A role first delivered in Teams can later be exposed in a portal or by email without rebuilding, and the ITSM and HR roles it hosts are the same Digital FTEs described in the agentic ITSM whitepaper and Digital FTE for HR operations.

What are the common mistakes?

1. A bot with broad application permissions acting as itself rather than the user.
2. Answers from general knowledge rather than cited sources.
3. Channel answers drawing on restricted content.
4. Actions before grounded answers are trusted.
5. Guests and shared files treated as instructions.

How does FISTA Solutions help?

FISTA Solutions builds Teams agents as governed AI agents under the tenant's identity model, through forward deployed engineers working with IT, HR, and the platform team, on the foundation its AI enablement practice establishes. FISTA has delivered 150+ projects for 50+ companies across 12+ countries.

To build a Teams agent for one channel, message FISTA on WhatsApp, or read how to build a Google Workspace AI agent for the other productivity suite.