Microsoft Teams app

The MergeHarbor app for Microsoft Teams does what the Slack app does: it answers questions about pull requests, summarises reviews, explains findings, opens a fix pull request after someone allowed confirms it, and posts review alerts with buttons. This page covers how to connect it and where Teams differs. If you only want alerts in a channel, an incoming webhook is the simpler option.

Connect

1. In the console, open Integrations → Microsoft Teams and follow the link to add the MergeHarbor app to a team. Your Teams administrator may need to allow the app in the Teams admin center first.
2. When the app joins, it posts a Connect to MergeHarbor card in the team.
3. Someone with the settings.manage permission in MergeHarbor opens the card’s link while signed in and confirms. The link works once and expires after seven days. Until then, the app does not answer.
4. Map channels and chats to repositories in the console.

A connection covers your whole Microsoft 365 tenant: every team, group chat and personal chat in the tenant that adds the app belongs to the same MergeHarbor organization. A tenant belongs to one organization at a time.

What you can ask

Mention @MergeHarbor in a channel or group chat, or message it in a personal chat. The requests are the same as in Slack:

You write	MergeHarbor answers with	Credits
A pull request link, or summarise	The stored review summary, confidence, counts and findings	None
explain finding 2	One finding with its suggested change	None
status	Pull request state, review status, open findings and the latest fix PR	None
open a fix	A confirmation card	None
link	A card with a one-time link to connect your Teams account (valid for 15 minutes)	None
help	What the app can do	None
Any other question	An answer from the same engine as Ask in the console	Yes

A question needs a pull request, named with a link or as PR #12 in acme/payments. Follow-ups in the same thread can leave it out. Answers are cards with a View in MergeHarbor button and a line saying whether credits were used. Questions and answers also appear on the pull request in the console, under Questions from Microsoft Teams.

How Teams differs from Slack

• No slash command. Use @MergeHarbor link and @MergeHarbor status instead of /mergeharbor.
• No ephemeral messages. Teams has no messages that only one person sees, so when someone who is not allowed presses a button, the refusal is posted in the thread.
• Channel history is not read. For a follow-up, the app uses only its own redacted memory of the thread (the pull request and the last exchange), not earlier messages in the channel.
• Chats have no threads. In group and personal chats the app replies in the chat.
• Standard channels count as public, because anyone in the team can read them. Private and shared channels and group chats count as private, and personal chats as direct messages.
• Alerts to the author reach their personal chat with the app only if they have chatted with it before.

People, roles, caps and alerts

These work as in Slack:

• People are linked by the email address (or user principal name) Teams reports for them, or with @MergeHarbor link. People who are not linked get read-only answers.
• Mappings give a channel or chat a set of repositories and a role: ask, fix or approver. The most specific mapping wins, and a private repository is answered in a standard channel only when that channel is mapped to it by name. See Channels, repositories and roles.
• Credit caps per channel and per person, each calendar month.
• Fix pull requests are opened only after the author or an approver (in fix conversations) or an approver (in approver conversations) presses Open fix pull request.
• Alerts go to a conversation you pick, to every conversation mapped to the repository, or to the author’s personal chat, with Explain, Open fix PR and Mute 24h buttons.
• Activity log with filters and CSV export, and no message text.

Data handling

• Verified requests. Every request from Teams carries a Bot Framework token. MergeHarbor checks its signature, issuer, audience and expiry, and rejects anything else. Replies go only to Microsoft’s Bot Framework hosts.
• Redaction. Message text is redacted of secrets before it is queued, and the queued copy is deleted once handled. Everything the app posts is redacted, and mentions are only ones MergeHarbor writes.
• What is stored. Per thread, the pull request it is about and a short redacted memory, kept for 90 days after the last answer; the activity log, with no message text, for 400 days. Questions and answers are kept on the pull request like console questions.
• Disconnect. Removing the app from its last team or chat, or disconnecting in the console, revokes the connection. Mappings and links are kept and apply again if you connect the tenant again.

Self-hosted installations

Self-hosted installations create their own Azure Bot and Microsoft Entra app registration, set TEAMS_BOT_APP_ID and TEAMS_BOT_APP_SECRET, and upload the app package from deploy/teams-app/. Steps are in docs/integrations/TEAMS.md and docs/OAUTH_APPS.md, “Teams app”.