Single Tenant Microsoft Teams Moveworks Setup Guide

This guide explains how to set up a single Microsoft Teams chatbot in Moveworks. It covers connector creation, identity ingestion, service account configuration, chatbot setup, roster validation, and notification routing.

Implementation Steps

Step 1: Create MS Teams Connector

1. Navigate to Moveworks Setup Portal. Go to Core Platform > Connectors > Built-in Connectors and select Microsoft Teams.

   

2. Click on NEXT: ADD CREDS

   

3. Name the connector “msteams” and for the Authentication Type select Microsoft Bot App Store Auth if you are leveraging the Microsoft Teams App Store, then Click Save.

   

   If you are configuring a Non-App Store based installation for a Moveworks sandbox, EU, GovCloud, AU, or CAC based installation you should use OAuth2 Client Credentials Grant.

   

   Certificate-based authentication (Microsoft Entra ID) is also supported. To use it, select OAuth2.0 with JWT Client Assertion as the Authentication Type and provide:

   • Application (client) ID — from your Microsoft Entra app registration’s Overview page.
   • X.509 Certificate SHA-256 Thumbprint (x5t) — the SHA-256 thumbprint of the certificate uploaded to Microsoft Entra.
   • Private Key — the PEM private key that corresponds to that certificate.
   • Tenant ID — your Microsoft Teams tenant ID.

   For steps to generate the certificate, private key, and x5t thumbprint, see Generating a self-signed certificate, private key, and x5t thumbprint below.

Step 2: Create MS Graph Connector

Similarly, add an MS Graph connector named msgraph. This connector handles identity/user data ingestion from your Microsoft / Entra tenant.

For the Authentication Type, select Microsoft App store Auth if you are leveraging the Microsoft Teams App Store. For the Tenant ID, use the Primary domain of your Entra/Azure tenant (in the format company.com).

Finding your Tenant ID and Primary domain

To find a tenant ID and a primary domain name, use the following steps:

1. Sign in to the Azure portal.
2. Select Microsoft Entra ID from the hamburger menu in the top left.
3. The Microsoft Entra ID Overview page appears. To find the Microsoft Entra tenant ID or primary domain name, look for Tenant ID and Primary domain in the Basic information section.

You can also find a tenant ID in the Azure portal in other ways:

• Select Microsoft Entra ID from the menu. Then, locate the Manage section on the menu and select Properties. The Properties page also displays a user’s associated Tenant ID.

Generating a self-signed certificate, private key, and x5t thumbprint

If you selected OAuth2.0 with JWT Client Assertion for either connector above, use the steps below to generate the credentials. You need:

• Public certificate (certificate.cer) — uploaded to your Microsoft Entra app registration.
• Private key (privateKey.pem) — uploaded later in the Moveworks connector.

1. Generate the certificate and private key

macOS/Linux (OpenSSL)

$
openssl req -x509 -newkey rsa:2048 -nodes \
>
  -keyout privateKey.pem -out certificate.cer \
>
  -days 730 -subj "/CN=Moveworks"

Windows (PowerShell)

1
# Create a 2048-bit RSA, SHA-256 self-signed cert (2-year validity)
2
$cert = New-SelfSignedCertificate `
3
  -Subject "CN=Moveworks" `
4
  -CertStoreLocation "Cert:\CurrentUser\My" `
5
  -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 `
6
  -KeyExportPolicy Exportable -KeySpec Signature `
7
  -NotAfter (Get-Date).AddYears(2)
8
9
# Export the .pfx (choose a password) and .cer
10
$pwd = Read-Host -AsSecureString "Enter PFX password"
11
Export-PfxCertificate -Cert "Cert:\CurrentUser\My\$($cert.Thumbprint)" -FilePath ".\Moveworks.pfx" -Password $pwd
12
Export-Certificate  -Cert "Cert:\CurrentUser\My\$($cert.Thumbprint)" -FilePath ".\certificate.cer"
13
14
# Export the private key (PEM) from the .pfx
15
openssl pkcs12 -in ".\Moveworks.pfx" -nocerts -nodes -out ".\privateKey.pem"

Verify the file formats before continuing:

• The certificate must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.
• The private key must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----. It must not include RSA in the headers, and must not be encrypted.

2. Bind the certificate to your app

In your Microsoft Entra app registration, go to Certificates & secrets → Certificates → Upload certificate and upload the certificate.cer file.

3. Compute the x5t (SHA-256) thumbprint

macOS/Linux (OpenSSL)

$
openssl x509 -in certificate.cer -outform der \
>
  | openssl dgst -sha256 -binary \
>
  | openssl base64 -A \
>
  | tr '+/' '-_' | tr -d '='

Windows (PowerShell)

1
$certPath = "path\to\your\certificate.cer"
2
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certPath)
3
$sha256 = [System.Security.Cryptography.HashAlgorithm]::Create("SHA256")
4
$hash = $sha256.ComputeHash($cert.RawData)
5
$x5t = [Convert]::ToBase64String($hash) -replace '\+','-' -replace '/','_' -replace '='
6
Write-Output $x5t

Note down the resulting x5t value — enter it in the connector’s X.509 Certificate SHA-256 Thumbprint (x5t) field.

Step 3: Add MS Graph Connector to Identity Configuration

Navigate to Core Platform → User Identity → Import Users, click Add Identity Source, and select the msgraph connector as the source. Add the user_id_info.channel_id_info for the msteams connector so Moveworks identity user records carry the Teams Channel ID.

Note: If your Moveworks org was created after May 2026, you will need to navigate to Core Platform → User Identity → Identity Configuration to add ms_graph as a connector leveraged in Identity Ingestion.

Note: MS Graph does not need to be added as the primary source connector.

Step 4: Create Chatbot Config

Navigate to Setup → Manage Chatbots → Chatbots, click Add New Chatbot, configure it for the Teams tenant, and select the msteams connector created in Step 1. Note the integration_id for use in later steps.

Navigate to Chat Platforms > Manage Chatbots and configure your Chatbot with the following settings. Be sure to replace:

1. Bot Name
2. Bot Friendly Name
3. Microsoft Teams Tenant ID

NOTE: For a Microsoft Teams App Store Installation, all other configurations should match the screenshot above exactly.

Step 5: Validate User Identity

Once 4 hours have passed, and Moveworks User Import has ran successfuly, navigate to Setup → User Identity → View Users and search for test users. Verify that expected users have a valid channel_id for the msteams integration and that the integration_id appears in user records.

Step 6: Configure Notification Routes

Navigate to Setup → AI Assistant → Notification Routes and confirm msteams is set as the bot channel for outbound notifications.