Introduction

M42 Assist is a native Microsoft Teams application that integrates your organization’s communication environment with the Matrix42 platform. It enables users to:

• Interact with the AI Assistant based on organizational knowledge
• Create and manage ITSM/Help Desk tickets
• Receive real-time ticket notifications
• Fill out forms and upload files
• Communicate with support agents using Live Chat

The application operates fully inside Microsoft Teams without the need to open external systems.

Architecture & Security

High-Level Architecture

The bot operates in a multi-layer architecture:

Layer 1 – Microsoft Teams (Client Front-End)

The user sends a message to the bot inside Microsoft Teams.

Layer 2 – Microsoft Bot Framework (Transport & Routing)

Microsoft automatically:

• Receives the message.
• Signs it using a Teams authentication token.
• Forwards it to the Matrix42 bot backend.

This layer is fully hosted and managed by Microsoft.

Layer 3 – Matrix42 Bot Backend

The backend (Node.js/TypeScript) handles:

• Message processing.
• User session management in Azure CosmosDB.
• User identity mapping (Teams user → Matrix42 user).
• Integration with Matrix42 Chat API.
• Sending messages back to Teams.

Layer 4 – Matrix42 Chat API

Matrix42 provides:

• AI Knowledge Base (RAG).
• IT ticketing system.
• Live Chat communication with human agents.

Ticket Notification System

The bot can send proactive notifications to three types of recipients:

1. Customer (Ticket Reporter)
   1. Identified by email in Matrix42.
   2. Receives status changes, agent comments, etc.
2. Assignee (Responsible Agent)
   1. Identified by the assigned agent’s email.
   2. Receives new assignments and updates.
3. Support Group (Teams Channel)
   1. Notifications sent directly to a Teams channel.
   2. Entire support team sees updates in one place

Notification Levels

• NONE - No notifications.
• BASIC - Only new tickets.
• FULL - New tickets + all updates.

How the Bot Resolves Recipients

The bot stores mapping between:

• User email → personal chat conversation.
• Teams channel ID → group conversation.
• Tenant ID → organization’s configuration.

Process

1. Matrix42 ESM sends an XML notification.
2. Backend parses key fields:
   1. customer email
   2. assignee email
   3. support group channel ID
3. Bot searches for matching conversations in CosmosDB.
4. Notification is delivered as an Adaptive Card to Teams.

Architecture for Service Providers (MSPs)

Managed Service Providers (MSPs) can offer Knowledge discovery and agentic use cases to their customers via the M42 Assist MS Teams app. Below is a reference architecture:

Data Security

Encryption

• All data in transit: TLS 1.2+.
• All data in CosmosDB: Encryption at Rest.

Isolation

• Each tenant has a separate configuration.
• User sessions are fully isolated.
• Bot only accesses conversations it participates in.

Data Stored (minimal required)

• Teams conversation IDs.
• Tenant ID.
• User email (only for personal chats).
• Matrix42 channel/session ID.
• Form data during an active process.
• Conversation references for notification delivery.

Data NOT stored

• Access tokens.
• Passwords.
• Full chat history.
• Uploaded files (sent directly to Matrix42 APIs).
   

Data retention

• Sessions expire after inactivity.
• Expired sessions are automatically deleted.
• Chat history retention is controlled by Matrix42 policies.

Permissions & Requirements

Why the Bot Does NOT Require Entra ID Permissions?

Teams applications typically fall into two models:

A. Using Bot Framework API (no Entra ID permissions required)

The M42 Assist app uses only this model.

This provides access only to:

• Messages sent directly to the bot.
• Basic user info (email, name).
• Conversation context.

B. Using Microsoft Graph API (requires Entra ID permissions)

Our M42 Assist does not use any functionality that requires Entra ID permissions such as:

• Microsoft Graph API.
• Single Sign-On (SSO) via OAuth.
• Delegated or application-level access to Microsoft 365 data.

What the Bot Actually Does (Code Example)

async handleMessage(context) {
	const text = context.activity.text; 
	// Basic user profile from Bot Framework API 
	const user = await TeamsInfo.getMember(context, context.activity.from.id); 
	const email = user.email;
	// Sending query to Matrix42 Chat API 
	await chatApiWrapper.talk(text, channelUid); 
	// Response back to Teams await 
	context.sendActivity({ text: "AI response..." }); 
}

What Data the Bot Can Access

Data Accessible to the Bot

The bot has access only to the data explicitly provided by Microsoft Teams through the Bot Framework during a direct interaction with the bot.

Accessible data includes:

• User email address (retrieved via TeamsInfo.getMember()).
• User display name.
• AadObjectId (unique identifier of the user in Entra ID).
• Message text sent directly to the bot.
• Message type (text, file, command, adaptive card input, etc.).
• Teams conversation ID.
• Tenant ID (Microsoft 365 tenant identifier).
• Channel ID (in case of group or team conversation).
• Files attached by the user directly to a message.
• Adaptive Card submission data, including form inputs.
• Bot mention context (if a user mentions the bot in a channel).
• Basic team/channel metadata, such as:
  • Team name.
  • Channel name.
  • Channel type (standard/private/shared).

Important:

• The bot only receives user information for the user who interacts with it.
• It does not get a list of all channel members or organization users unless explicitly requested through Graph API — which we do NOT use.

Data NOT Accessible to the Bot

The bot cannot access any Microsoft 365 resources outside the context of the direct interaction.

Non-accessible data includes:

• Private conversations between other users.
• Messages in regular Teams channels, unless:
  • The bot is explicitly @mentioned.
  • A message is sent to the bot via a dedicated bot channel.
• Chat history in any channel or group (outside messages sent to the bot).
• User calendars (Outlook Calendar events).
• User mailboxes (Outlook email).
• Contacts or personal address books.
• Files in SharePoint or OneDrive (unless the user attaches a file directly in the chat with the bot).
• Organization-wide user lists (full directory).
• Presence data (online/offline status).
• Teams meeting information and meeting chats.
• Permissions, group memberships, or roles in Entra ID.
• Any data protected by Microsoft Graph API, including:
  • OneDrive / SharePoint repositories.
  • Teams team structures.
  • M365 user profiles.
  • Organizational reports.
  • Security logs.
• Any system-wide configuration stored in the Microsoft 365 tenant.

Guaranteed Security Boundaries:

• The bot cannot see anything unless the user explicitly interacts with it.
• It has zero visibility into content or metadata outside that interaction.

Minimum Requirements

Required

• Microsoft 365 account with Teams.
• Access to Teams Admin Center.
• Internet connectivity to Matrix42 backend.

Not required

• App Registration in Entra ID.
• API permissions.
• Admin consent.
• Custom domains or SSL certificates.

Installation Guide

Option A — Users install the app manually

1. Go to Teams App
2. Find “M42 Assist” and add it.
3. Contact your admin to finalize installation

Option B — Automatic installation for users

1. Go to Teams apps → Setup policies.
2. Create or edit a policy.
3. Add “M42 Assist” to Installed Apps.
4. Assign the policy to users or user groups.

Admins may also share a link:

Microsoft Marketplace

However, regardless of the installation method, the application will not require any additional Microsoft Graph API permissions or Entra ID (Azure AD) consent.

For a business-level overview of what M42 Assist does, see Solution description. For the ESM/CAI setup steps that put this architecture into practice, see Configuration.