Slack and Microsoft Teams channels

A channel connects one published agent to Slack or Microsoft Teams, so people can talk to it where they already work. People write to the bot in a direct message or @mention it in a channel, and the answer comes back in the same place. Behind the scenes the agent runs as the Console user the person is matched to, so the agent's access rules, budgets and approvals all still apply.

Enterprise module

Channels are part of the enterprise edition. The Channels section is hidden in the community build, and the /api/channels/* routes answer 402 with module: "channels" until the tenant has an active enterprise license. See Licensing.

What a channel is

One channel is one Slack app or one Azure bot, bound to one published agent. The agent is fixed when you create the channel. To use another agent, create another channel (and another Slack app or Azure bot) for it.

Where it lives	Build → Agents → the agent → Ship tab → Channels. There is no separate Channels page. Connected (remote) agents do not show the section.
Who can manage it	Workspace owners and admins only. The role is read again on every request.
Which version runs	The agent's published version, never the draft. The agent must be published before you can create a channel, and publish again for a change to reach the channel.
Licence	Enterprise.
Service switch	channels, which needs agents. When it is off, the Channels section refuses changes ("Channels are turned off on this installation"), the Teams endpoint answers 404 and Slack connections are not opened. See Service switches.

Each channel is listed with its platform, workspace, state and where it answers. Press a row to open the channel: its sections are Where and who, People matching and Connection, with the actions Setup guide, Disable / Enable, Edit details and Delete.

State	Meaning
Setup not finished	Created, but the credentials have not passed their checks yet.
Connected	Credentials verified and the channel is answering.
Waiting for the first message	Teams only: the connection is set up, but Microsoft has not sent a message yet.
Error	A check or the live connection failed. The channel shows the reason.
Disabled	Switched off by an admin. Messages are ignored.

Add a channel

Open the agent's Ship tab and press Add channel. A full-screen wizard walks through the steps. The agent is already chosen; you pick Slack or Microsoft Teams.

Once a channel has left the draft state, its Slack workspace (or Teams tenant and app ID) cannot change. Create a new channel instead. A Teams client secret can be renewed at any time.

Slack setup

Slack runs in Socket Mode: Console opens the connection to Slack, so you need no public address, request URL or signing secret. The steps are the same on SaaS and on-premises. Allow about 10 minutes, and you need permission to install apps in the Slack workspace.

1. Create the app from a manifest. The wizard generates a manifest for this channel. Copy it (or download slack-manifest.json), then in api.slack.com/apps choose Create New App → From a manifest, pick the workspace and paste it on the JSON tab.
2. Create the app-level token. In the app, open Basic Information → App-Level Tokens → Generate Token and Scopes, add the scope connections:write and copy the token that starts with xapp-.
3. Install the app. Choose Install App → Install to Workspace → Allow. If your workspace requires approval, an admin has to approve it first. Then copy the Bot User OAuth Token (starts with xoxb-) from OAuth & Permissions.
4. Paste both tokens in the wizard: the bot token (xoxb-) and the app-level token (xapp-). The wizard notices when you swap them. Console checks them as you save.
5. Invite the bot (optional). Run /invite for the bot in each Slack channel where it should answer. The bot only sees @mentions in channels, and the channel picker lists only channels the bot is in.

What the manifest contains

Part	Value
Bot scopes	app_mentions:read, chat:write, im:history, users:read, users:read.email, channels:read, groups:read
Bot events	app_mention, message.im
Mode	Socket Mode on; interactivity off; token rotation off; org-wide deployment off
App Home	Messages tab on, Home tab off

The app name is shortened to 35 characters and the bot handle is lower-cased to letters, digits and . _ -. The app-level token is not part of the manifest. You create it yourself in step 2.

Checks

Console runs these checks when you save the tokens and each time you press Verify.

Check	What a failure means
Bot token	The xoxb- token is rejected (invalid_auth, token_revoked, account_inactive and similar). Copy it again from OAuth & Permissions.
App token	The xapp- token is wrong (not_allowed_token_type means it is not an app-level token), revoked, or lacks connections:write (missing_scope).
Socket	Console could not open the Socket Mode connection. Skipped when the app token failed. invalid_socket_url means Slack returned a host that is not on slack.com.
Scopes	The bot token lacks chat:write (chat_write_missing), which fails the check. A missing users:read.email is only a warning, but then nobody can be matched by email and nobody can use the agent.
Same app	The two tokens belong to different Slack apps (app_mismatch). Create both from the same app.

A failed check still keeps the tokens (their last four characters are shown) and the channel stays in Setup not finished. Temporary problems such as network_error or rate limits do not mark the tokens as bad. Console keeps two connections open per Slack channel so no message is missed, and re-opens them automatically.

Microsoft Teams setup

Teams works the other way round: Microsoft sends each message to a public Console address. Allow about 15 minutes. You need an Azure subscription and permission to upload apps to Teams.

1. Create an Azure Bot. In portal.azure.com choose Create resource → Azure Bot. Set Type of App to Single Tenant and Creation type to Create new Microsoft App ID. Microsoft no longer allows new multi-tenant bots.

2. Set the messaging endpoint. The wizard shows the address for this channel:

   {APP_URL}/api/public/channels/teams/{tenantId}/{connectionId}

   Paste it in the bot's Settings → Configuration → Messaging endpoint and press Apply. APP_URL is the public address of your Console (see Configuration). The wizard warns when it is not HTTPS or points to a local host.

3. Enter the credentials. Paste the Microsoft App ID, the App Tenant ID (both GUIDs) and the client secret Value. Use the secret's Value, not its Secret ID.

4. Turn on the Teams channel. In the bot, open Channels → Microsoft Teams, accept the terms and press Apply.

5. Send the first message. The Check the connection step turns green when Microsoft delivers the first valid message. Until then the state is Waiting for the first message. If it never turns green, check that the endpoint is saved, the Teams channel is on and the app is uploaded.

6. Upload the app package. Download the zip from the wizard (it contains manifest.json and two icons). Install it from the Teams admin center (Teams apps → Manage apps → Upload new app, recommended for the whole organization) or, for a quick test, from Teams (Apps → Manage your apps → Upload a custom app). The App ID must be saved before the package can be built.

The token check calls Microsoft with the secret once. Its results:

Code	What to do
invalid_guid	The App ID or tenant ID is not a GUID.
missing_secret	No client secret was entered.
invalid_secret	The secret is wrong. Paste the Value, not the Secret ID.
secret_expired	Create a new secret in Azure and paste it.
app_not_found / tenant_not_found	The App ID or tenant ID does not exist.
service_principal_missing	Azure reported AADSTS7000229: the app has no service principal in the tenant. In the Microsoft Entra admin center open App registrations, pick your app and, on the Overview page, click Create Service Principal under Managed application in local directory. Then verify again.

Where and who

In Where and who you decide where the agent answers and who may use it. New channels answer in direct messages and in every channel the bot has been added to, for everyone whose email matches a Console user.

Setting	Options
Direct messages (DM)	On or off.
Channels	Every channel the bot was added to, Only selected channels (up to 200), or No channels (direct messages only). In Teams, group chats count as channels.
Who may use it	Everyone whose verified email matches a Console user, or selected users and groups (up to 500). Selected with nobody chosen means nobody.

The list is the agent's built-in access rule on this channel, as with portals. Access is checked on every message by the policy engine under the messaging channel, so deny rules in IAM can still block people on the list. If the engine cannot decide, the person is told that access could not be checked right now.

People matching

Console runs the agent as a real Console user, so it first matches the person in Slack or Teams to an account in the same workspace.

• The match uses the person's verified email address. For Slack the app needs users:read.email; for Teams the email comes from the team roster.
• You can limit matching to a list of email domains (up to 20). Empty means all domains.
• Guests and external users are refused: Slack guests, Slack Connect users and people from another Microsoft tenant. External Console accounts are not matched.
• A match is remembered and checked again on every message, so blocking the Console account stops access at once.
• There is no sign-in or linking step for people. Nobody has to type a code.

People who cannot be served get a private notice (only they see it; in Teams channels it is a short reply that mentions them):

Situation	What they read (in the channel's language, English or Turkish)
No Console account for the email	"I could not find a Console account for your email address. Please ask your administrator to add you to Console."
Account blocked	"Your Console account cannot use this assistant right now…"
Guest	"This assistant is not available to guest accounts."
Other workspace or tenant	"This assistant is only available to members of this workspace."
Not on the access list, or the agent is unpublished	"You do not have access to this assistant…"
Wrong place	"This assistant does not answer here. Try a direct message…"

How conversations work

• One session per thread, per person. In a Slack channel or Teams channel the bot answers in a thread under the @mention, and each person in the thread has their own Console session. Messages appear in Sessions with the source platform and the channel messaging.
• Direct chats roll over. A Slack direct message outside a thread, and Teams personal and group chats, are one continuous session that starts a new one after 8 hours idle, or when the person sends new (or yeni).
• Streaming. In Slack threads the bot shows "Working on it…" and then streams the answer; in top-level direct messages it posts a placeholder and updates it. In Teams personal chats the answer streams; in Teams channels and group chats a placeholder is replaced by the full answer. Long answers continue in follow-up messages.
• Approvals happen in Console, not in chat. A channel run is unattended, so a tool that needs approval follows the agent's unattended policy (deny by default, pause or allow). With pause the bot says an action needs approval in Console, and posts the answer once someone approves it there.
• Text only. File attachments are not read. Slack accepts messages up to 20,000 characters and Teams up to 16,000.
• Limits apply as usual. If a usage limit, session budget or guardrail stops a turn, the person gets a short message saying so. A message sent while the previous one is still being answered gets "I am still answering your previous message…".
• Slow runs are delivered later. If an answer outlives the chat turn, it is posted when it is ready (and dropped if the run ended more than 24 hours ago).

Network requirements

Slack

Slack needs outbound access only, no inbound port.

Direction	Destination
Outbound HTTPS	https://slack.com/api
Outbound WebSocket	wss://*.slack.com

Teams

Direction	Destination
Outbound HTTPS	login.microsoftonline.com (token), login.botframework.com and *.botframework.com (signing keys)
Outbound HTTPS	The Bot Connector host Microsoft names in each message: smba.trafficmanager.net, smba.infra.gcc.teams.microsoft.com, smba.infra.gov.teams.microsoft.us, smba.infra.dod.teams.microsoft.us, or any *.botframework.com. Add others with CHANNELS_TEAMS_EXTRA_SERVICE_HOSTS.
Inbound HTTPS	POST /api/public/channels/teams/{tenantId}/{connectionId} from Microsoft. No other Console path needs to be public.

Console checks the signature of every incoming Teams call, refuses bodies over 256 KB and answers 404 for unknown, disabled or unlicensed channels.

Proxies and the private-network guard

• The Slack socket does not use HTTPS_PROXY. It needs a direct route to *.slack.com.
• All other Slack and Teams calls go through the outbound guard (see Outbound HTTP) and connect directly. They use a configured proxy only when the guard does not apply: the host is listed in OUTBOUND_HTTP_ALLOWED_HOSTS, or OUTBOUND_HTTP_BLOCK_PRIVATE_NETWORK is false.
• The guard also refuses a host whose DNS answer is a private address, which can happen with some corporate DNS setups. Add the host to OUTBOUND_HTTP_ALLOWED_HOSTS in that case.

Networks differ, so test a channel from inside your own network (the Verify button runs the same calls) before you announce it.

Environment variables

Variable	Description	Default
CHANNELS_INBOUND_CONCURRENCY	How many incoming messages each Console node handles at the same time. Whole number from 1 to 64. Restart to change.	8
CHANNELS_TEAMS_EXTRA_SERVICE_HOSTS	Comma-separated extra hostnames Console may send Teams replies to, for Microsoft clouds not in the built-in list. Exact host names only.	(empty)

Related settings: APP_URL (builds the Teams endpoint), CONSOLE_DISABLED_SERVICES / CONSOLE_ENABLED_SERVICES (service switches) and the OUTBOUND_HTTP_* guard. See Configuration.

Data kept

• Thread records (which Console session belongs to which Slack or Teams thread) are deleted 30 days after their last activity.
• Messages themselves are ordinary agent sessions and follow the normal session retention.
• Deleting a channel removes its record, the saved people matches, thread records and connection leases. Session history stays in Console.
• Tokens and the client secret are stored encrypted. Console shows only the last four characters.

Limits

• One agent per channel, and one Slack workspace or Microsoft tenant per channel.
• Slack uses Socket Mode only. There is no HTTP Events API setup. Slack Enterprise Grid and custom Slack hosts are not covered.
• Teams bots cannot post in private channels, and users from other Microsoft tenants are ignored.
• In channels the bot answers @mentions only. There are no interactive buttons.
• No file attachments, in either direction.
• Incoming messages are processed once. Console does not ask the platform to resend a failed message.

Troubleshooting

Symptom	Cause and fix
Create fails with "Publish the agent first"	Channels run the published version. Publish the agent, then create the channel.
The Channels section is missing	Community build, no Enterprise licence, the channels or agents service is off, or you are not an owner or admin.
Setup not finished after saving tokens	A check failed. Read the failing check in the wizard and use the Slack or Teams tables above.
socket_disconnected	Console lost the Slack socket. It reconnects by itself. If it persists, check egress to *.slack.com (the socket ignores HTTPS_PROXY).
link_disabled	Socket Mode is turned off for the Slack app. Turn it on in the app settings.
secrets_unavailable	The stored tokens cannot be read on this server. Enter them again.
network_error	Console cannot reach the platform. See network requirements above.
Slack bot is silent in a channel	The bot is not in the channel (/invite), the message did not @mention it, or Where and who excludes the channel.
Everyone gets "could not find a Console account"	The users:read.email scope is missing, the email domain is not in the allowed list, or the emails differ from the Console accounts.
Teams stays on Waiting for the first message	Messaging endpoint not saved or not reachable over HTTPS, Teams channel not turned on in the bot, or the app package is not uploaded.
Teams token check shows service_principal_missing	Create the service principal for the app in Azure and verify again.
Teams messages from another tenant do nothing	By design: only users of the bot's own tenant are served.
"This conversation is waiting for an approval in Console"	A run is paused on an approval. Approve or deny it in Console.
"You do not have access to this assistant" for a listed person	The agent was unpublished or disabled, or an IAM deny rule applies.
Answers stop after the agent was edited	Publish again. The channel runs the published version.

Where to go next

• Build and publish an agent
• Approvals & questions for the unattended policy
• Sessions
• Service switches