Microsoft Teams Authentication
Send authenticated Microsoft Teams bots that sign in as a Microsoft 365 user with stored credentials, enter sign-in-restricted meetings, and get admitted past the lobby
Authenticated Microsoft Teams Bots
By default, Meeting BaaS bots join Microsoft Teams as anonymous guests. That works for open meetings, but it falls short when a meeting is restricted to signed-in users, restricted to the organizer's organization, or sends guests to a lobby.
Authenticated Teams bots solve this. Each bot signs in as a real Microsoft 365 user from a tenant you control, using stored credentials (email + password), before it joins the call. To Teams, the bot looks like any other signed-in participant.
Teams authentication uses a username + password sign-in on login.microsoftonline.com — not SAML SSO like Google Meet. That means no identity provider, no certificate, and no keypair to configure. The one requirement is that the account is provisioned MFA-free (see Setup). Leave teams_config null for anonymous Teams joins.
Why authenticate
| Scenario | Anonymous bot | Authenticated bot |
|---|---|---|
| Open meeting, anyone with link | ✅ Joins | ✅ Joins |
| "Only people in my org can bypass the lobby" | ⏳ Waits in lobby | ✅ Admitted as an org user |
| Meeting restricted to signed-in users | ❌ TEAMS_LOGIN_REQUIRED | ✅ Joins as a signed-in user |
| Recording as a named, consistent identity | ❌ Anonymous guest | ✅ Joins under the account's display name |
How it works
Authentication is built on three resources. You configure the first two once, then reference them per bot.
Teams Workspace — the parent resource representing one Microsoft 365 tenant. It groups the logins under a single tenant domain. Unlike a Meet workspace, it holds no certificate or keypair — Teams sign-in is credential-based. You create one per Microsoft 365 tenant. See Setup.
Teams Logins — one per Microsoft 365 account the bots sign in as, storing the account's email and password (the password is encrypted at rest and never returned). Many logins can share a single workspace, and can be grouped into round-robin pools by email_group.
teams_config on the bot — when you create a bot, you tell it which login (or pool) to use. The dispatcher resolves the credentials, the bot types them into login.microsoftonline.com, and then joins the meeting as the signed-in user.
Teams Workspace (Microsoft 365 tenant domain)
│
├── Teams Login bot1@acme.onmicrosoft.com ┐
├── Teams Login bot2@acme.onmicrosoft.com ├─ email_group: bots@acme.onmicrosoft.com (round-robin pool)
└── Teams Login bot3@acme.onmicrosoft.com ┘
│
POST /v2/bots { teams_config: { email_group: "bots@acme.onmicrosoft.com" } }
│
least-loaded active login is assigned → bot signs in → joins TeamsThe teams_config object
All Teams authentication options are passed in a single teams_config object on POST /v2/bots:
{
"bot_name": "Recording Bot",
"meeting_url": "https://teams.microsoft.com/meet/1234567890?p=AbCdEfGhIj",
"teams_config": {
"email_group": "bots@acme.onmicrosoft.com",
"fallback": "fail"
}
}| Parameter | Description |
|---|---|
email_group | Round-robin pool selector. The bot is assigned the least-loaded active login in this pool. Preferred for most use cases — takes priority over credential_id. Pass "" to round-robin across all of the team's active logins. |
credential_id | Pin one specific login (UUID) for this bot. |
fallback | What to do when no login slot is available: fail (default) fails bot creation with TEAMS_LOGIN_UNAVAILABLE; anonymous silently falls back to an anonymous join. |
Leave teams_config null for anonymous Teams joins, Zoom, or Google Meet.
Key concepts
Getting past the lobby
Signing in is what gets the bot admitted. When the account belongs to the organizer's organization (or the meeting's lobby policy admits people in the org), the authenticated bot is let in automatically instead of waiting in the lobby as an anonymous guest. For meetings restricted to signed-in users, an authenticated bot is the only way in — an anonymous bot fails with TEAMS_LOGIN_REQUIRED.
MFA must be off
The bot types the account's password on login.microsoftonline.com. If the tenant forces multi-factor authentication or security-info registration, sign-in stalls on the "Let's keep your account secure" page and the login fails. The bot accounts must therefore be provisioned MFA-free — turn off Security Defaults or exclude the bot accounts from your MFA Conditional Access policy. This is the single most important part of Setup.
Round-robin pools and concurrency
Each login supports up to 20 concurrent sessions. When you dispatch bots with an email_group, the assigner picks the least-loaded active login and skips any login at capacity. If every login in a pool is saturated, bot creation fails with TEAMS_LOGIN_UNAVAILABLE (or falls back to anonymous, per your fallback setting). Create more logins to raise the ceiling, and configure a utilization alert to stay ahead of saturation (the utilization endpoint gives an on-demand view).
States
Both workspaces and logins track health with a state field:
active— healthy and usable.invalid— the system auto-disabled the resource after a failure (a bad-credentials rejection, an MFA/security-info prompt, or a login timeout). Re-enable manually viaPATCHafter fixing the underlying issue.
When a resource flips to invalid, last_error_message and last_error_at explain why.
Security
Account passwords are encrypted at rest using AES-256-GCM. The password is write-only — never returned in any API response, on create or on subsequent reads. To change it, send a new password via PATCH /v2/teams-logins/{credential_id}.
Pages in this section
Setup
Provision an MFA-free Microsoft 365 account, create a teams workspace, and register teams logins.
Sending Authenticated Bots
Use teams_config to send authenticated bots, manage pools, configure fallback, and monitor utilization.
FAQ
Related resources
- Teams Workspaces API — manage the Microsoft 365 tenant grouping
- Teams Logins API — manage the Microsoft 365 identities bots sign in as
- Error Codes —
TEAMS_LOGIN_*failure reasons - Alerts — monitor pool utilization and saturation