> ## Documentation Index > Fetch the complete documentation index at: https://docs.devin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Teams > Connect Devin to Microsoft Teams to start sessions by tagging @Devin AI in a channel or chat, get replies in context, and control sessions with inline keywords. Tag **@Devin AI** in Microsoft Teams as soon as bugs, feature requests, and questions come in. Devin responds with updates and questions when it's tagged. ## Get started ### Installation Setting up Microsoft Teams has two parts: connecting your Microsoft 365 tenant to Devin, then installing the Devin app in the teams where you want to use it. #### 1. Connect your tenant 1. Go to [Settings > Connections](https://app.devin.ai/settings/connections) and select **Microsoft Teams** 2. Click **Connect** and sign in with a Microsoft account that has the **Teams Administrator** or **Global Administrator** role in the tenant that owns your teams. Other accounts are rejected; see the [FAQ](#faq) for who can connect and which account to pick. 3. Complete the Microsoft prompts. You're returned to the Microsoft Teams settings page, and your own Microsoft Teams user is linked to your Devin user. Your tenant must allow the Devin AI app to receive an application token so Devin can read messages where it's installed (access is scoped per team or chat through resource-specific consent, granted when the app is installed). If Microsoft Entra ID blocks it, ask a Cloud Application Administrator (or higher) to allow the app, then connect again. #### 2. Install Devin in a team 1. On the Microsoft Teams settings page, find the **Connected teams** section 2. Click **Install in team** to open the Devin app in Microsoft Teams, then add it to the team or chat you want. Team owners can also add Devin directly from the Teams store. 3. Once installed, the team appears under **Connected teams** #### 3. Link each user and start using Devin 1. Every user who wants to use Devin from Teams must link their own Microsoft Teams identity. Go to your personal [Connections](https://app.devin.ai/account/connections) page, click **Link** next to **Microsoft Teams**, and sign in with Microsoft. 2. To message Devin in a 1:1 chat (DM), each user must also install the Devin AI app for themselves: in Microsoft Teams, open **Apps**, search for **Devin AI**, and click **Add**. Installing Devin in a team or group chat does not add it to anyone's personal chats. Teams admins can pre-install it for users with an app setup policy in the Teams admin center. 3. Mention `@Devin AI` in a Team channel or group chat, or message Devin AI in a 1:1 chat, to start a session > Note: For Devin to work for each user, every individual must link their own account from their personal [Connections](https://app.devin.ai/account/connections) page (**Microsoft Teams** > **Link**). This lets Devin associate their Microsoft Teams identity with their Devin user. ### How to use Devin from Microsoft Teams Once you’ve installed the Microsoft Teams integration, simply trigger Devin with `@Devin AI` in any Team channel or group chat, or message Devin AI directly in a 1:1 chat. In Team channels, Devin replies in the thread of your message. In 1:1 and group chats, which don't have threads, Devin replies directly in the chat. You can communicate back and forth just like in the regular Devin chat interface. In shared channels, the Devin AI app must also be enabled for the channel (installing it in the host Team is not enough), and Devin only replies in the thread when it's @mentioned. Private channels are not supported.

Which organization a session runs in

Devin's first reply in a 1:1 chat or channel thread says which organization the session started in. * **One organization:** your sessions always run there, so there is no default to choose. * **Several organizations:** the first time you message Devin, it asks which one to use and saves your answer as your default for Teams. New sessions you start from Teams, in chats and channels, run there. To change your default, send `org` (`@Devin AI org` in group chats and channels) or update it in your profile settings in the Devin web app. Changing it only affects new sessions: a session that is already running stays in the organization it started in.

Sessions in group chats

A group chat is linked to one Devin session, shared by everyone in the chat, and it stays in the organization it started in. To start your own session there, send `@Devin AI new `: the chat switches to your session, and the previous one stays available in the Devin web app. See the [FAQ](#faq) for more. *Note that Devin may make mistakes. Please double-check responses.* ### Inline Teams Keywords & Functions | Keyword | Function | | - | - | | `!ask` | Begin your message with !ask to get a quick codebase answer without starting a full agent | | `!deep` | Get a deeper research answer using advanced search | | `mute` | Prevents Devin from seeing further messages in the thread or chat | | `unmute` | Reverses the above | | `(aside)`, `!aside` | Causes Devin to ignore the message (useful for commentary on Devin's run in the conversation) | | `sleep` | Puts Devin to sleep; to wake Devin up, send any message in the thread or chat | | `!fast`, `!lite`, `!ultra`, `!fusion` | Starts the session in Fast, Lite, Ultra, or Fusion Mode | | `!swe`, `!swe2` | Starts the session on the newest SWE model enabled for your organization (both keywords behave the same) | | `!normal` | Switches an active session back to the default Devin mode | | `new [prompt]` | Starts a new Devin session, optionally with an initial prompt. Only available in 1:1 and group chats, not in channels | | `org` | Chooses the default organization for new sessions. In group chats and channels, tag Devin: `@Devin AI org` | | `help` | Shows help message with available keywords and functions | Mode keywords (`!fast`, `!lite`, `!ultra`, `!fusion`, `!swe`, `!swe2`, `!normal`) are recognized anywhere in your message and are stripped from the prompt Devin receives. A keyword inside an inline or fenced code span is treated as literal text. Sending a mode keyword in an active Devin thread or chat switches that session's mode mid-session. ### Pricing If you don't yet have a Devin account, you can learn more about pricing and plans [here](https://devin.ai/pricing). ### Privacy Our privacy policy is available [here](https://cognition.com/privacy-policy). ### Support If you run into issues with the Microsoft Teams integration, have questions, or come across any objectionable AI-generated content, contact us and we'll open a support ticket for you: * **Email:** [support@cognition.ai](mailto:support@cognition.ai) — include your organization name, the Teams tenant, and a description or screenshot of the problem. * **Enterprise customers:** you can also reach out to your Cognition account team. ### Authentication Flow The diagram below illustrates the high-level authentication architecture for the Microsoft Teams integration, showing how authentication flows from Teams through various layers to create authenticated Devin sessions. ```mermaid theme={null} graph TB subgraph MSTeams ["Microsoft Teams"] A[Teams User] --> B[Teams Channel] B --> C[Teams Bot Framework] C --> D[Microsoft Graph API] end subgraph AuthLayer ["Authentication Layer"] E[Certificate-Based Auth] --> F[JWT Token Validation] F --> G[Tenant ID Verification] G --> H[User Identity Claims] end subgraph DevinPlat ["Devin Platform"] I[Chat Manager] --> J[Identity Mapping Service] J --> K[Organization Resolver] K --> L[RBAC Authorization] L --> M[Session Creation] end subgraph IdProviders ["Identity Providers"] N[Microsoft Entra ID] --> O[SAML/SSO Provider] O --> P[Devin Identity Store] end A --> E D --> F H --> J N --> J P --> L M --> Q[Devin Session] ``` ### Permissions Details Below is a summary of the Microsoft Teams and Microsoft Graph permissions our integration requires—what each grants, why we need it, and where it's used. > At a glance > > * Microsoft sign-in (delegated `User.Read`): connecting your tenant (Teams Administrator or Global Administrator) and linking individual users. > * Post as yourself (delegated `ChannelMessage.Send`, `ChatMessage.Send`, `offline_access`): requested when a user links their profile, so Devin can post that user's web app messages to Teams under their own name. Users can choose **Link without posting as you** to link with only `User.Read`. > * Teams bot RSC (per Team/Chat): scoped access to messages/members/settings only where the bot is installed or present. > * No tenant-wide Microsoft Graph application permissions: Devin never requires tenant-wide admin consent in Microsoft Entra ID. #### Teams Bot Resource-Specific Consent (RSC) Permissions These are granted per Team/Chat at install time (do not apply tenant-wide). ##### Team-scoped (Team/Channel) | Permission | What it allows | Why we need it | | - | - | - | | `ChannelMessage.Read.Group` | Read channel messages where the app is installed | Process channel conversations (summaries, triggers, syncing) | | `ChannelMessage.Send.Group` | Send messages in channels (new posts and threaded replies) where the app is installed | Respond to messages in channel threads and proactively post updates to channels | | `Member.Read.Group` | Read team membership | Map identities, permission checks, mention routing | | `TeamSettings.Read.Group` | Read Team settings | Respect Team-level policies and tailor behavior | ##### Chat-scoped (1:1 and group chats) | Permission | What it allows | Why we need it | | - | - | - | | `ChatMember.Read.Chat` | Read chat participants | Address/respond correctly and support audit trails | | `ChatMessage.Read.Chat` | Read messages in chats where the bot participates | Process prompts, context, and follow-ups | | `ChatMessage.Send.Chat` | Send messages in 1:1 and group chats (DMs) where the bot participates; not for channels | Respond to users in DMs and group chats, post notifications, and interactive replies in chats | | `ChatSettings.Read.Chat` | Read chat settings (e.g., moderation) | Align behavior with chat policies (rate limits, who can post, etc.) | > RSC guardrails: Access is limited to the specific Team/Chat where the app is installed or participates. Removing the app from a Team/Chat revokes that access. #### Delegated Permissions (post as yourself) These are granted by each user for themselves when they link their user profile. They're optional: choosing **Link without posting as you** links the profile with only `User.Read`, and messages from the Devin web app are then posted as "User Name by Devin". Devin uses them only to post that user's messages from the Devin web app into the Teams thread or chat of a session started from Teams. | Permission | What it allows | Why we need it | | - | - | - | | `ChannelMessage.Send` | Send channel messages as the signed-in user | Post the user's web app replies in channel threads under their own name | | `ChatMessage.Send` | Send chat messages as the signed-in user | Post the user's web app replies in 1:1 and group chats under their own name | | `offline_access` | Keep access after the sign-in expires (refresh token) | Post as the user later in the session without asking them to sign in again | > These permissions don't require admin consent by default. If your tenant's user consent settings in Microsoft Entra ID don't allow users to consent to them, users see an admin approval prompt when they link their profile; they can still link with **Link without posting as you**. #### Example: Certificate-Based Authentication for Microsoft Graph The diagram below illustrates our app-only, certificate-based authentication with Microsoft Graph. Using an X.509 client certificate, the service acquires an access token for your tenant and then calls Graph for a resource where the Devin app is installed, for example reading a team's details (GET /v1.0/teams/{team-id}). Access is granted by the resource-specific consent (RSC) permissions in the app manifest, so the token only works for Teams and chats where the app is installed. ```mermaid theme={null} sequenceDiagram participant S as Cognition participant M as MSAL client participant K as Certificate private key participant A as Entra ID token endpoint participant G as Microsoft Graph S->>M: Acquire token for Graph (.default scope) M->>M: Check token cache (tenant, scope, client) M->>K: Build client_assertion JWT (sign with cert) K-->M: client_assertion (signed JWT) M->>A: POST /oauth2/v2.0/token A-->A: Validate signature & cert thumbprint A-->M: 200 access_token (aud=graph) M-->S: Return access_token (store in cache) S->>G: GET /v1.0/teams/{team-id} with Authorization: Bearer access_token G-->G: Check RSC grant for this team (TeamSettings.Read.Group) G-->S: 200 team details ``` > Credential note: We use an X.509 certificate (client assertion) rather than a client secret for service-to-service authentication. This applies to the RSC-scoped Microsoft Graph calls, bot communications with the Bot Framework adapter, and any app-only API calls from the integration. #### Complete Message Processing Flow (Teams → Cognition) The diagram below shows the complete end-to-end flow when a user sends a message to Devin in Microsoft Teams, including token validation and bot processing. ```mermaid theme={null} sequenceDiagram participant U as Teams client participant T as Teams service participant W as Bot webhook adapter participant J as Jwt validator participant O as OpenID metadata & keys participant C as Credential provider participant B as Bot logic U->>T: @Devin user message T->>W: HTTP POST activity + Authorization Bearer token note over W: Extract Authorization header and token W->>J: Validate token J->>O: Fetch OpenID config and signing keys O-->J: Return JWKS keys J->>J: Verify RS256 signature
and parse claims J-->W: Validated claims W->>C: Check appId against credentials C-->W: AppId recognized W->>W: Add serviceUrl to trusted list W->>B: Create TurnContext and call bot handler B->>B: Execute business logic B-->W: Outgoing activity W->>T: Send reply via connector service T->>U: Deliver message to user ``` > Credential note: We use an X.509 certificate (client assertion) rather than a client secret for service-to-service authentication. This applies to the RSC-scoped Microsoft Graph calls, bot communications with the Bot Framework adapter, and any app-only API calls from the integration. #### Consent & Installation Flow 1. **Tenant connection** * A Teams Administrator or Global Administrator signs in with delegated `User.Read`. No tenant-wide admin consent is granted. 2. **Targeted Installation** * From **Connected teams** > **Install in team**, you open the Devin AI app in Microsoft Teams and add it to a specific Team or chat. Team owners can also add it from the Teams store. * During installation, the RSC scopes are granted only to that Team (or to the specific Chat when invoked in a chat). 3. **User linking** * Each user signs in with delegated `User.Read`, and consents for themselves to `ChannelMessage.Send`, `ChatMessage.Send`, and `offline_access` so Devin can post as them. With **Link without posting as you**, only `User.Read` is requested. 4. **Operation** * Reading/sending messages and reading members/settings rely on RSC within installed surfaces. * Messages a user sends from the Devin web app are posted with that user's delegated token when they granted it; otherwise they are posted by the bot as "User Name by Devin". #### Least-Privilege Notes * Connecting Devin to Teams only requires delegated `User.Read` and the RSC permissions above; no tenant-wide Graph permission is needed. * Posting as a user relies on that user's own delegated consent and only sends messages; it doesn't read messages, files, or other data. * Message content is accessed exclusively via RSC and only where the bot is installed/present. * No mailbox, files, or calendar permissions are requested. #### Revocation & Uninstallation * Uninstall from Teams: Remove the Devin app from a Team/Chat in Microsoft Teams to revoke RSC for that resource; the team disappears from **Connected teams** in the Devin dashboard. * Post as yourself: disconnecting Microsoft Teams from your [Settings > Connections](https://app.devin.ai/account/connections) deletes the stored user token. If a user or admin revokes the delegated permissions in Microsoft Entra ID, Devin falls back to posting as "User Name by Devin". * Previously granted admin consent: if your tenant granted tenant-wide admin consent to Devin in the past, a tenant admin can remove the app’s enterprise application permissions in Entra ID. Devin no longer uses them. * Data Handling: On uninstall, our integration stops processing events for that Team/Chat and cleans up related subscriptions/links. ### Extend Devin with Microsoft 365 The Teams integration lets you talk to Devin from Teams. To let Devin also work with your Microsoft 365 content during a session, install the Microsoft 365 plugins from the marketplace. For example, you can ask Devin to read a spec from SharePoint, summarize an email thread, or schedule a follow-up meeting. | Plugin | What Devin can do | | - | - | | **OneDrive & SharePoint** | Browse, read, upload, and delete files | | **Mail & Contacts** | Read, organize, and send Outlook mail, and manage personal contacts | | **Calendar** | List, create, update, and delete events and meetings | | **To Do** | List, create, update, complete, and delete tasks | | **Teams** | List teams, channels, and chats, and send messages | | **Directory** | Search and read Microsoft Entra users and managers | Each plugin signs in with your Microsoft account and uses delegated Microsoft Graph permissions, so Devin can only access what the signed-in account can access. Depending on your tenant's settings, an admin may need to grant consent for those permissions. You can install only the plugins you need. See [MCP servers and marketplace](/work-with-devin/mcp) to install and configure them. ### FAQ Yes. Connecting a Microsoft 365 tenant to Devin (the **Connect** button on the Microsoft Teams settings page) requires signing in with a Microsoft account that holds the **Teams Administrator** or **Global Administrator** role in that tenant. Devin checks the directory roles on the account you sign in with and rejects the connection for anyone else, including team owners and regular members. If you aren't an admin, ask a Teams admin in your tenant to click **Connect** (they need the *Manage chat integrations* permission in your Devin organization). Once the tenant is connected, any team owner can install Devin in a team, and everyone links their own account from their personal [Connections](https://app.devin.ai/account/connections) page; neither of those steps needs an admin. Pick an account in the tenant that owns the team you want to use Devin from. A tenant is the Microsoft 365 directory your organization's teams live in (for example `yourcompany.onmicrosoft.com`). If you're a guest in another organization's teams, or you have accounts in several tenants, make sure the one you choose is both an admin *and* in the tenant that owns the team. Signing in with the wrong tenant's account is the most common reason the connection fails. A Microsoft 365 tenant can be connected to one Devin organization (or enterprise) at a time, and a Devin organization can be connected to one tenant. If the connection is rejected because the tenant is already connected, another Devin organization already owns the connection: use Devin from that organization, or have an admin disconnect Microsoft Teams there first. Devin reads Teams messages with an application token scoped to your tenant. If Microsoft Entra ID refuses to issue one (usually because the tenant blocks third-party apps), the connection is rejected so you don't end up with a connection that never sees messages. Ask a Cloud Application Administrator (or higher) in Microsoft Entra ID to allow the **Devin AI** app, then click **Connect** again. Yes. Every user must link their own Microsoft Teams identity from their personal [Connections](https://app.devin.ai/account/connections) page (**Microsoft Teams** > **Link**) so Devin can attribute sessions to their Devin user. This step doesn't require any admin role. If linking is rejected because the Microsoft account is already connected to another Devin user, disconnect Microsoft Teams from that Devin user first. Microsoft Teams 1:1 and group chats don't have threads, so Devin links each chat to a single session: the one started by the first person who mentions `@Devin AI` in the chat. Later messages in that chat go to that same session, and that session belongs to the person who started it. Usually, yes. When someone else started the chat's session, you need the **Manage sessions** permission to message it. The default Member role includes it, so this only comes up if your organization uses a custom role without it. If you don't have it, Devin replies that it didn't send your message. Ask an admin to add **Manage sessions** to your role, or start your own session in the chat (see below). Send `@Devin AI new `. Anyone in the chat can do this, whoever started the current session. The chat switches to a new session that belongs to you, and later messages in the chat go to it. The previous session isn't deleted: its owner can still open it from the Devin web app, but it no longer receives messages from this chat. In group chats and channels, select **Devin AI** from the `@` suggestions so it appears as a mention. If you type `@Devin AI` as plain text, Teams doesn't send it as a mention, so Devin treats your message as regular text instead of a command. ### Common issues #### Messages in a 1:1 chat with Devin AI show "Failed to send." This happens when an older version of the Devin AI app is still installed. Microsoft Teams chat with Devin AI showing a "Failed to send." error **How to fix it** Update the Devin AI app to the latest version everywhere it's installed: your personal app, and every Team and group chat where it was added. #### Some group chat members can't see or @mention Devin AI When someone adds an app to a group chat, every other member needs permission to use that app in order to see it in the chat roster or in the @mention picker. If the tenant's app permission policy in the Teams admin center blocks third-party apps (globally or for specific users/groups), only users who are allowed to use the app will see it. For everyone else, the bot is effectively invisible and can't be tagged, even though it's technically in the chat. **How to fix it** 1. **Allow Devin AI in the Teams admin center.** A Teams admin goes to **Teams apps** > **Manage apps** and makes sure Devin AI is allowed. 2. **Check the app permission policies.** The admin checks the app permission policies assigned to the affected users so the app is permitted for them. 3. **Refresh Teams.** Once that's done, the other members may need to refresh their Teams client for the bot to show up in the @mention picker.

Resource-specific consent (RSC) blocked or not granted

Devin reads and posts Teams messages only through the [RSC permissions](#teams-bot-resource-specific-consent-rsc-permissions) listed above. Microsoft Teams grants them to one team or chat at a time, when the Devin AI app is added there. If a team never granted RSC, Devin can't read its channels, even when your tenant is connected to Devin. Without RSC in a team, Devin can't run automations triggered by that team's channel messages, read thread and channel context, see messages that don't @mention it, or read the team's members. **How to fix it** 1. **Add Devin AI to the team.** A team owner adds the Devin AI app to the team that contains the channel, from **Connected teams** > **Install in team** in Devin or from Microsoft Teams. Teams shows the requested permissions during installation and grants them to that team. If Devin AI is already there, update it to the latest version. 2. **Check that Devin AI is allowed in the Teams admin center.** If Devin AI can't be added, a Teams admin goes to **Teams apps** > **Manage apps**, makes sure Devin AI is allowed, and checks that the app permission policies assigned to the team owners allow it. 3. **Ask your Microsoft 365 admin to check the tenant RSC setting.** If Devin AI is installed and Devin still can't read the team, your tenant may block RSC consent. Your admin can check and change this setting by following Microsoft's [Configure consent settings](https://learn.microsoft.com/microsoftteams/platform/graph-api/rsc/grant-resource-specific-consent#configure-consent-settings) guide. After the setting changes, remove Devin AI from the team and add it again. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.