OpenAB MS Teams Bundle

One-click OpenAB deployment for Microsoft Teams — bot agent + Bot Framework gateway bundled together. Register a bot in Azure, paste the messaging endpoint, you're done.

MS Teams ──Bot Framework──▶ ┌──────────────────┐ ◀──WebSocket── ┌────────────┐
                            │  openab-gateway  │                │   openab   │
                            │  (teams only)    │                │  (Kiro CLI) │
                            └──────────────────┘                └────────────┘
                               public HTTPS                       internal only

Prerequisites: Azure account with permission to register Bot Service / App Registrations, and a Microsoft 365 tenant where you can sideload or publish a Teams app. Personal Microsoft accounts (Hotmail / Live) typically cannot register Azure Bot Service resources — use an Azure AD work/school account.

What's deployed

Service	Purpose	Public
openab	OAB agent running Kiro CLI	No
openab-gateway	Teams Bot Framework → WebSocket bridge	Yes (auto HTTPS)

No PVC sharing, no manual config.toml edits. The agent's config.toml is generated on first boot with the gateway URL pre-wired to ws://openab-gateway:8080/ws and platform = "teams".

Setup

1. Create a Bot in Azure

1. Go to Azure Portal → Create a resource → search for Azure Bot → Create.
2. Bot handle: pick a unique name. Subscription / Resource group: your choice. Pricing tier: F0 (free) is fine for dev.
3. Microsoft App ID: choose Type → Multi Tenant (or single tenant if you only need one org) → Creation type → Create new Microsoft App ID.
4. Click Review + create → Create. Wait for deployment.
5. Open the new Azure Bot resource → Configuration:
   • Microsoft App ID → copy → paste into Teams App ID
   • Messaging endpoint → leave blank for now (you'll fill after deploy)
6. From the same Configuration page → click Manage Password (or Manage under app credentials) → opens App Registration → Certificates & secrets → New client secret → copy the Value (not the ID) → paste into Teams App Secret.

2. (Optional) Get a Kiro API Key

If you have a paid Kiro subscription, go to kiro.dev → Settings → API Keys → create a key and paste it into KIRO_API_KEY. Free tier users skip this and authenticate post-deploy in step 5.

3. Deploy

Click deploy with the App ID + App Secret filled in. A public HTTPS domain is auto-assigned to the gateway service.

4. Set the Messaging Endpoint

Bot Framework has no setEndpoint API — paste the URL in Azure Portal.

1. Open the openab-gateway service page in Zeabur Dashboard → look at the auto-assigned domain (e.g. https://your-gateway.zeabur.app).
2. The full messaging endpoint is: https://<YOUR_GATEWAY_DOMAIN>/webhook/teams
3. Back in Azure Portal → your Azure Bot resource → Configuration → Messaging endpoint → paste → Apply.

The openab-gateway service Instructions section shows the exact messaging endpoint pre-filled.

5. Authenticate Kiro via Device Flow (free tier only)

Skip if you set KIRO_API_KEY in step 2.

After the openab service is running, open its terminal in Zeabur Dashboard and run:

runuser -u agent -- kiro-cli login --use-device-flow

Follow the URL and code to authorize in your browser.

6. Add the Bot to a Teams Channel

1. In Azure Bot resource → Channels → Microsoft Teams → Apply standard channel terms.
2. Open Teams admin / Teams Developer Portal → Apps → + New app → fill basic info → under App features → Bot → select the bot you just created.
3. Set scope (Personal / Team / Group chat) and download / publish the app manifest. For dev: Preview in Teams → install in a chat / channel.

Detailed guide: docs/msteams-selfhosted.md.

7. Test

Open Teams → DM the bot or @mention it in a channel where the app is installed. Gateway receives the activity, forwards to OAB, OAB replies via Bot Framework reply API.

Customization

• /home/agent/.config/openab/config.toml — OAB config (sessions, reactions, etc.). Created on first boot from a built-in template with the [gateway] block pre-wired. To regenerate, delete and restart.
• Image tags — bot tracks the floating stable channel (ghcr.io/openabdev/openab:stable) and auto-updates with each OpenAB stable release. Gateway is pinned at ghcr.io/openabdev/openab-gateway:0.5.1 (no :stable tag yet). To pin or bump, change the tag in Zeabur Dashboard → Service → Settings. Available tags: OpenAB / Gateway.
• Tenant restriction — set TEAMS_ALLOWED_TENANTS=<tenant-id-1>,<tenant-id-2> on openab-gateway to only accept activities from specific Microsoft 365 tenants (defense-in-depth on top of multi-tenant App ID).

Why no automatic endpoint registration?

Bot Framework requires the messaging endpoint to be set in the Azure portal manually — there's no programmatic API to update it. The bundle pre-fills the URL in the gateway's Instructions section; you paste it once.

Want a different agent backend?

This bundle uses Kiro as the default agent. For Claude / Codex / Cursor / Gemini / OpenCode / Hermes / Grok, deploy the corresponding bot template separately together with the standalone OpenAB Gateway.

Want a different platform?

See OpenAB Telegram Bundle / Feishu Bundle / LINE Bundle / WeCom Bundle or the standalone OpenAB Gateway for Google Chat.

Links

• OpenAB GitHub
• MS Teams Setup Guide
• Azure Bot Service Docs
• Standalone OpenAB Gateway Template