Configure Microsoft Teams Bot

App Store for Intune can send personal Teams notifications to approvers, requestors and administrators. Each person gets their own message, an Adaptive Card, in a chat with the App Store for Intune bot.

Setting it up has three parts:

1. The bot. This is an Azure Bot resource. If you set enableTeamsBot=true when you ran Deploy to Azure, the deploy template already created it and turned on its Microsoft Teams channel.
2. The Teams app. A small package that tells Teams about the bot. You build it from three files, upload it in the Teams admin center, and install it for the people who should get notifications.
3. The App Store for Intune settings. You turn notifications on in Communications and send a test.

If You Deployed with the Teams Bot

The bot is registered and its Teams channel is on. Keep the Bot App ID handy: it is the teamsBotAppId deployment output, the client ID of the bot’s user-assigned managed identity. Continue with Build the Teams App Package.

Register the Bot Manually

Use this only if you deployed with the bot turned off and want to add it later, or if your organization requires the bot to live in a separate resource group.

1. Create a user-assigned managed identity in your App Store resource group (Azure portal > Create a resource > User Assigned Managed Identity). Name it something like uami-bot-apprequest. Note its Client ID and Resource ID from the Overview page.
2. Attach the managed identity to your App Service: App Service > Identity > User assigned > Add, and select the identity you created in step 1.
3. Add an app setting on the App Service named Bot__UamiClientId, set to the managed identity’s client ID, and restart the App Service.
4. In the Azure portal, select Create a resource, and search for Azure Bot.
5. Select Create and fill in:
   • Bot handle: a unique name, for example AppRequestPortalBot
   • Subscription and Resource group: your App Store resource group is fine
   • Pricing tier: Free (F0) is enough
   • Type of App: User-Assigned Managed Identity
   • App Service Microsoft App ID: the managed identity’s client ID
   • Tenant ID: your Microsoft Entra tenant ID
   • User-Assigned Managed Identity: the identity you created in step 1
6. After the bot is created, open it and select Configuration.
7. Set Messaging endpoint to https://<your-app-service-url>/api/messages.
8. Select Channels > Microsoft Teams > Apply.

The Bot App ID is the managed identity’s client ID.

Why a Managed Identity, Not the API App Registration

Releases before v1.30.0 used the backend API’s app registration and a client secret for the bot. The bot now uses a dedicated user-assigned managed identity, with no client secret. The deploy template sets this up when enableTeamsBot=true.

Build the Teams App Package

Download the Files

Create an empty folder, and save these three files in it. To save a file, select and hold (or right-click) its link, and then select Save link as.

• manifest.json, the app’s description for Teams
• color.png, the 192 x 192 color icon
• outline.png, the 32 x 32 outline icon

You can replace the two icons with your own, at the same sizes.

Edit the Manifest

Open manifest.json in a text editor such as Notepad, replace the placeholders, and save the file.

Find	Replace With	Places
{{BOT_APP_ID}}	Your Bot App ID	2 (id and botId)
your-portal-url.azurewebsites.net	Your App Store for Intune address without https://, for example appstore.contoso.com	4 (websiteUrl, privacyUrl, termsOfUseUrl and validDomains)
Your Organization	Your organization’s name	1 (developer)

Then search the file for {{. Nothing should be found.

Create the Zip File

1. In File Explorer, open the folder and select the three files. Select the files, not the folder: Teams refuses a package whose files sit inside a folder.
2. Select and hold (or right-click) one of the selected files, and then select Compress to > ZIP File. On Windows 10, select Send to > Compressed (zipped) folder.

Upload the App to Teams

1. Go to the Teams admin center, and sign in as a Teams Administrator or Global Administrator.
2. Select Teams apps > Manage apps.
3. Select Upload new app, and then select Upload. If the page has no Upload new app button, select Actions > Upload new app.
4. Select your zip file.

When the upload finishes, App Store for Intune is in the list of apps.

Install the App for Your Users

The bot can only message people who have the app installed in Teams. Install it for everyone who should get notifications: approvers, requestors and the App Store administrators.

How you install it depends on whether Microsoft has moved your tenant to unified app management. If it has, the Manage apps page says “Your organization was moved to unified app management”, and setup policies can no longer install apps.

Tenants on Unified App Management

1. In Teams apps > Manage apps, select App Store for Intune.
2. Select Users and groups, and then select Install app. If the app is already installed for some people, select Edit installs.
3. In Install to, select Everyone, or select Specific users or groups and add the users and groups who should get notifications.
4. Select Apply.

Tenants That Use App Setup Policies

1. Select Teams apps > Setup policies, and edit Global (Org-wide default), or create a policy for the people who should get notifications.
2. Under Installed apps, select Add apps, search for App Store for Intune, and select Add.
3. Select Save.

It Can Take a While

Microsoft notes that app installs can take up to 24 hours to reach people. Until the app is installed for someone, their notifications and Test report that the bot could not start a chat with them. People can install the app sooner themselves: in Teams, select Apps, search for App Store for Intune, and select Add.

Turn On Notifications in App Store for Intune

1. In App Store for Intune, select Admin. In the left menu, under Store Administration, select Communications.
2. Under Microsoft Teams Bot Notifications, select Enable Teams bot notifications.
3. In Bot App ID, enter the same Bot App ID you put in the manifest.
4. Select Test. App Store for Intune saves your settings and sends a test card to you in Teams. If the card can’t be delivered, the message says why. See Troubleshooting.
5. Under Notification Events, select the events that send a Teams notification.
6. Select Save Settings.

What Gets Notified

Notification	Who Gets It	When
Approval Required	The approvers of the request’s current stage	A request needs their decision
Request Approved	The requestor	Their request is approved
Request Rejected	The requestor	Their request is rejected, with the reason
App Installed	The requestor	Intune reports the app installed
App Published	The administrator who published the app	A catalog app is created in Intune
Group Automation	The App Store administrators and the administrator who created the automation	As selected under Group Automation Notifications: membership changes, a run that fails or is skipped, or an automation that is created, changed or deleted
Test Notification	You	You select Test

The first five can be turned on and off under Notification Events. Times on the cards are in UTC.

Troubleshooting

• “The test notification was not delivered. The bot could not start a chat with this user.” The App Store for Intune app is not installed for that person in Teams yet, or the install hasn’t reached them. Check Installed for on the app’s page in the Teams admin center, wait for the install to apply, or have the person add the app in Teams.
• “The Bot App ID on this page (…) is not the bot this App Store sends as (…)” Enter the ID the message names, which is your teamsBotAppId deployment output, and make sure the Teams app package uses the same ID. To fix a package, correct manifest.json, increase its version (for example from 1.11.0 to 1.11.1), zip it again, and upload it as a new version: on the app’s page in the Teams admin center, under New version, select Upload file.
• 401 Unauthorized on /api/messages. The Azure Bot’s Microsoft App ID doesn’t match the client ID of the managed identity attached to the App Service. Check that the bot’s app ID matches the identity’s client ID, and that the same identity is attached under App Service > Identity > User assigned.
• Some people get notifications and others don’t. The app isn’t installed for them yet, or they’re outside the users and groups you installed it for.

For the settings themselves, see the Communications admin guide page.

Next Step

Continue to Configure Application Insights (optional).