Connection modes

There are two ways to connect an agent to Microsoft Teams. They differ in who owns the Teams bot, and that single difference decides how much Azure work you do.

	StandIn Managed Bot	Bring your own Azure bot
Who owns the bot	StandIn	You
Azure app registration	none	you create it
App ID / client secret	none	you manage them
Install	add StandIn from the Teams Store	upload your own app package
Identity in Teams	appears as StandIn	appears as your own bot
Best for	getting working quickly	full identity custody

Both modes connect your own agent: StandIn is the bridge, never the brain. And both need the same one-time admin consent before calling works - chat works without it.

StandIn Managed Bot

StandIn publishes and operates one Teams bot; your Microsoft organization is routed to your agent by a connection you create in the StandIn portal.

In Teams, add StandIn from the Store.
Type signin to the bot and sign in with your StandIn account. That link is how StandIn learns which Microsoft organization to connect - you do not type a tenant id anywhere.
In the StandIn portal, deploy an identity and choose Use the StandIn bot. Paste your agent’s address; the portal gives you back the secrets.
A Microsoft 365 administrator approves calling once for the organization. Chat works before this; calling switches on when the approval lands.

You get one connection secret, covering both calls and chat - paste it once:

# Hermes (config.yaml)
plugins:
  enabled:
    - msteams_bridge
  entries:
    msteams_bridge:
      config:
        secret: ${MSTEAMS_BRIDGE_SECRET}

// OpenClaw (openclaw.json)
{
  "plugins": {
    "entries": {
      "msteams-bridge": {
        "enabled": true,
        "config": {
          // A STRING. The ${VAR} form is resolved from the environment at startup.
          // An object secret reference is rejected here: `secret` is typed string,
          // and OpenClaw validates the config before it resolves any reference.
          "secret": "${MSTEAMS_BRIDGE_SECRET}"
        }
      }
    }
  }
}

Advanced deployments can split the lanes with the per-lane overrides (calling_secret/messages_secret on Hermes) - when set, they win over secret. OpenClaw has no per-lane override: one secret covers both lanes. Prefer not to edit config by hand? Run the one-line installer with --connection managed and that secret: it writes both lanes, mounts /msteams/calling and /msteams/messages on your Tailscale Funnel, and prints the two URLs to paste into the connection - see Quickstart: StandIn Managed Bot.

One agent instance serves one connection. The secrets belong to a single Microsoft organization - run a second instance for a second organization, and never share a secret across tenants.

Bring your own Azure bot

You register a Microsoft Entra app, create an Azure Bot resource, and upload your own Teams app package. The bot carries your name and lives entirely in your tenant. Follow Azure bot setup and App package. This is the right choice when identity custody matters more than setup time, or when you need the bot to be visibly yours.

Endpoints

StandIn dials your agent, so the endpoint you save in the portal has to match the path your agent actually listens on. Give the portal a bare host and it fills in the default below; paste a full URL instead if your bridge serves something else. Calling is the same in both modes. Only chat differs, and that is the line people get wrong:

Lane	Public path	Local target
Calling (media WebSocket), both modes	`wss://host/msteams/calling`	`127.0.0.1:9442`, path `/msteams/calling`, on both runtimes
Chat, bring your own Azure bot	`https://host/api/messages`	`127.0.0.1:3978`, path `/api/messages`, on both runtimes
Chat, StandIn Managed Bot with the plugin’s managed chat lane	`https://host/msteams/messages`	`127.0.0.1:9444`, path `/msteams/messages`, on both runtimes

A bring-your-own-bot identity therefore uses /api/messages, served by your runtime’s own Teams channel (OpenClaw’s msteams channel, the Hermes gateway’s Teams platform) rather than by the voice plugin. That is a different process from voice, which is why it has its own port. The portal suggests the right one of the two when you deploy the identity, so take the value it offers.

Expose your agent

The mount commands that publish these paths, what a healthy probe looks like on each lane, and the --http1.1 gotcha that makes a working voice mount look broken.

Getting Started

Teams setup

Concepts

OpenClaw plugin

Hermes plugin

ElevenLabs bridge

LiveKit bridge

StandIn Managed Bot

Bring your own Azure bot

Endpoints

Expose your agent

​StandIn Managed Bot

​Bring your own Azure bot

​Endpoints

Expose your agent

StandIn Managed Bot

Bring your own Azure bot

Endpoints