# Integrate Microsoft Teams with Cobalt

Receive updates in Microsoft Teams


:::info
Learn how to set up an integration between Cobalt and Microsoft Teams. The availability of this feature depends on your [PTaaS tier](https://docs.cobalt.io/en-us/articles/cobalt-ptaas-tiers-tGUEyGwLaS?region=US).

:::

## Integration Overview

Integrate with Microsoft Teams to seamlessly collaborate with Cobalt pentesters and other pentest team members directly from Teams.

### How it Works

* Install the [Cobalt Offensive Security app](https://marketplace.microsoft.com/en-us/product/office/wa200009350?tab=overview), from the Microsoft Teams app store, into your Teams environment


:::info
**Note:** If you have an EU account, install the "[Cobalt Offensive Security EU](https://marketplace.microsoft.com/en-us/product/WA200009690?tab=Overview)" app instead

:::

* In Teams, a channel manager adds the Cobalt Offensive Security app to a Teams channel, authenticates to Cobalt, and selects the specific pentest to connect to the channel
* Members of the Teams channel can use the Cobalt Offensive Security app to post or reply to messages, directly from Teams
* Pentest team members with a Cobalt account, as well as Cobalt’s pentesters and staff, can see, respond, or send new messages from Cobalt’s Pentest Chat, which are syndicated to the connected Teams channels
* Pentester Updates are sent to the channel(s) connected to that specific pentest

### Limitations

Please be aware of the following considerations when using this integration. We are working to improve the integration and address these limitations.

* Messages will not appear as threads in Teams or Cobalt Chat.
* A Teams channel can only be connected to a single Cobalt pentest.
* Editing a Teams message does not retry the attempt to sync to the Cobalt platform.


---

## Integrate with Microsoft Teams

Connect your Microsoft Teams workspace to your Cobalt Organization in order to sync Cobalt pentests chat with Teams channels, allowing your team to collaborate on a test directly from your Teams instance.

### Required Permissions

The Cobalt Offensive Security app requires specific Microsoft Graph API permissions to function properly. These are **not** configured in the Teams app manifest, but must be granted by your Teams administrator through the Azure portal:

Navigate to: **Azure Portal → App registrations → Cobalt Offensive Security → API permissions → Add a permission → Microsoft Graph → Application permissions**

Add the following **Microsoft Graph Application Permissions**:

* **ChannelMessage.Read.All** - Read all channel messages across the organization to enable bot message synchronization
* **Chat.Read.WhereInstalled** - Read chat messages only in conversations where the Cobalt Offensive Security app is installed (RSC permission)
* **Files.Read.All** - Read file metadata and properties for attachments shared in Teams conversations
* **Sites.Read.All** - Download file content from SharePoint sites when files are shared through Teams
* **User.ReadBasic.All** - Allow to read a basic set of profile properties of Teams users to enrich the synced messages with user info.

After adding these permissions, an administrator must click **"Grant admin consent"** to activate them.

**Security Note**: The Cobalt Offensive Security app only accesses Teams channels where it is explicitly added. While `ChannelMessage.Read.All` and file permissions have organization-wide scope at the API level, the app's functionality is limited to channels where it's installed and only processes messages directed to the bot. `Chat.Read.WhereInstalled` uses Resource Specific Consent (RSC) to restrict access exclusively to chats where the app is present.

### Install Cobalt Teams Application in Your Teams Instance

As an administrator for your Microsoft Teams instance, you can add the Cobalt Offensive Security app to your environment by:


1. Go to Apps within your Microsoft Teams interface
2. Search "Cobalt Offensive Security"
3. Click “Add”

### Uninstall Teams Integration

To remove the Cobalt Offensive Security app from your Microsoft Teams instance:


1. Navigate to the "Apps" section within Microsoft Teams, then "Manage your apps".
2. Find the Cobalt Offensive Security app; expand it to see where it's used.
3. Click the trash can icon to remove from each channel as needed. Note: If you're a Teams Administrator, you can also remove apps from the Teams admin center.

Here’s what to expect once you’ve removed the Cobalt Offensive Security app:

* Data synchronization between Cobalt and Microsoft Teams stops.
* All channel connections for specific pentests are deleted. If you decide to reinstall the integration, you’ll need to set up the connection for each pentest.
* Any previously posted messages from Cobalt to your Teams channels will remain visible in Teams.
* Posting new messages, or responding to previously posted pentest messages in Teams, will no longer be possible.


---

## Connect Channels

Once you’ve installed the Cobalt Offensive Security app in your Microsoft Teams instance, you can connect a Teams channel to a pentest, so your teams and pentesters can seamlessly collaborate directly from the Teams channel or through the Cobalt platform.

### Connect a Teams Channel to a Pentest

To communicate with the Cobalt pentest team through Microsoft Teams, you must connect a Teams channel to a specific Cobalt pentest. The person who sets up the Teams channel connection must have a Cobalt account which has access to the Cobalt pentest.


1. Go to the Teams channel which you wish to connect to a pentest, and add the "Cobalt Offensive Security" app
2. Type “@Cobalt Offensive Security connect”
3. In the bot response, which shows instructions to set up the connection, click “Login & Select Test”
4. Sign in to the Cobalt platform
5. Select the pentest you wish to connect to the Teams channel
6. Review the confirmation message from the Cobalt Offensive Security bot to verify the correct pentest has been connected to the channel. Note:  Only one pentest can be connected to a Teams channel.

### Disconnect Teams Channel(s)

Once you’ve connected your Microsoft Teams instance, you can view all pentests connected to Teams channels.


1. After logging in to Cobalt, go to Integrations > Microsoft Teams > Configuration. Here, you can see pentests for which you have connected Teams channels.
2. Click “Disconnect” beside the desired pentest to remove the Teams connection.
3. If disconnection was successful, in the Teams channel, a new post will confirm that the channel is no longer connected.

You may also disconnect directly from Teams, by going to the desired channel, and using the bot command “@Cobalt Offensive Security disconnect”.

### Send a Message from Teams

Once a Teams channel has been connected to a Cobalt pentest, you can send messages to the pentest chat directly from Teams.


1. In the Teams channel, click the "Cobalt Offensive Security" icon in the Compose Message box
2. Enter your message in the “Send Message” dialog box
3. Click “Send”

You can also use the bot command “@Cobalt Offensive Security chat” then type your message. Once sent, the message will appear in the Cobalt Chat for the associated pentest, and will be syndicated to your Teams channel for visibility to the other channel members.

### Get Help within Teams

You can also use the bot command “@Cobalt Offensive Security help” to view a list of the available commands and what they are used for.

### Pentester Updates in Teams

If a Teams channel has been connected to a Cobalt pentest, during the course of the pentest, updates posted by pentesters will be sent as messages to the connected channel(s).


---

## Support

If you have issues or need support, contact [support@cobalt.io](mailto:support@cobalt.io).


---

## Frequently Asked Questions

**Q: Do all messages in my Teams channel get synced to the Cobalt pentest?**

A: No. Only messages or replies sent using the Cobalt Offensive Security bot will be synced to Cobalt.  Any other communication within the channel, using the standard Teams messaging features, will remain private to that channel, and are not visible to Cobalt.

**Q: Do I need to provide pentesters and Cobalt staff with access to Microsoft Teams?**

A: No.  Pentesters and Cobalt staff can see and respond to messages posted via the Microsoft Teams integration using the Pentest Chat within the Cobalt platform.

**Q: Do all members of my Teams channel need to have access to the Cobalt platform?**

A: No. You can invite anybody you wish from your organization to the Teams channel, even those without a Cobalt account.  All members of the channel will be able to post, respond and view communications from the associated pentest.

**Q: Can Cobalt access data in my Microsoft Teams instance when I use this integration?**

A: No. Cobalt has no visibility or access to your Teams system, except for messages posted using the Cobalt Offensive Security bot.

**Q: Where do messages sent from Teams appear in the Cobalt platform?**

A: Messages are synchronized to the Cobalt Chat for the pentest or engagement that they are associated with.

**Q: Who can see the messages sent using the integration?**

A: Messages sent to Cobalt from the Teams bot will be visible to Cobalt users who have been granted access to the associated pentest (including your Cobalt Staff members, Pentesters, and any team members that you have invited to the pentest in the Cobalt platform).  After you’ve connected a Teams channel to a pentest, messages posted using the Cobalt Offensive Security bot will be syndicated to the connected pentest’s InApp chat on the Cobalt platform, and vice versa. Users with access to the Teams channel will be able to see the messages originating from the Cobalt InApp chat on the connected pentest.

**Q: How do I control who sees the Cobalt discussions in Teams?**

A: Anybody you add to a Teams channel that is connected to a Cobalt pentest will be able to see the discussion.  Cobalt has no visibility or control over the membership of your Teams channels.  As such, it is the customer’s responsibility to manage access in Teams.

**Q: Can I subscribe to multiple Cobalt pentests from the same Teams channel?**

A: No, a Teams channel can only be connected to one Cobalt pentest.  To connect another pentest, you may remove the original connection, then connect the new test.  Otherwise, you must create a new channel.

**Q: Can I discuss a specific Cobalt finding using the integration?**

A: Currently the integration supports Cobalt’s Pentest Chat only, not Finding chat.  You may reference a finding ID when sending a message, but the message will remain in the Pentest Chat, and will not be directly associated to the specific finding.

**Q: Does the integration support threading?**

A: No, threaded messaging  is not currently supported, but will be in a future release.

**Q: Does the integration support file attachments?**

A: Yes. When you send a message to the Cobalt bot in Teams, attachments are included with the message in Cobalt's in-app chat. For messages sent from in-app chat, attachments are displayed in the Teams channel as links that users can click to securely download the files.

**Q: Does the integration support reactions?**

A: No, emoji reactions are not currently supported, but will be in a future release.

Microsoft Teams

Cobalt Integrations Overview

Troubleshooting

HTTP Connector

Import Assets from Google Sheets

Map Cobalt Pentest Finding Severity to Jira Issue Priority

Modify Jira Issue Summary to contain Pentest Title

Create Azure DevOps Work Item for Findings

Send MS Teams notifications for Findings

Create GitLab tickets for Findings

Create Jira tickets for Findings

Send email notifications for Findings from Outlook

Create GitHub tickets for Findings

How to Guides

Connect your applications

Integration Builder

Synchronize Cobalt Severity Levels with Jira

Push Cobalt Findings to Jira

Jira Cloud Integration

Jira Data Center Integration

Troubleshoot Your Jira Integration

Switching to a New Jira Instance

Integrate Jira with Cobalt

Slack

Webhooks

DefectDojo

Kenna Security

Vanta

Carried Over Findings

Create Test Finding

Integrations

How to get started with Cobalt

Getting Started

Risk Advisories

Assets are what we pentest

Asset Types

Create an Asset

Assets

Pentests

Overview

Asset Details

Pentest Details

Scope & Test Period

Preparation

Create a Pentest

Pentest Process

Pentest States

Coverage Checklist

Pentest Expectations

Set Up an In-House Pentest

Complete an In-House Pentest (For Pentesters)

In House Pentests

Finding States

Severity Levels

Remediate Findings

Findings

Customize Your Report

Co-branded Reports

Contents of a Pentest Report

Reports

Engagements Overview

Digital Risk Assessment

Secure Code Review

Engagements

Insights

Planning

Cobalt Methodologies Overview

Web Methodologies

API Methodologies

External Network Methodologies

Internal Network Methodologies

Mobile Methodologies

Cloud Configuration Review Methodologies

Cloud Pentest Methodology

Desktop Methodologies

AI/LLM Methodologies

Digital Risk Assessment Methodology

Secure Code Review Methodologies

Methodologies

Attack Surface Monitoring (ASM)

Attack Surface

DAST Scanner Overview

Best Practices

Partial Scans: Reduced Scope

Scans

Sequence recorder

Targets

Target Authentication

Extra Hosts

Blackout Period

DAST Scanner

Account Overview

Account Settings

Password Best Practices

Sign In to Cobalt

Troubleshoot Sign-in Issues

User Account

Collaboration Overview

Collaborate on Pentests

Groups

Manage Pentest Collaborators

Manage Notifications

User Roles and Permissions

Collaboration

Organization Overview

Manage Users

Your Cobalt Contract

Configure SAML SSO

How to Configure SAML 2.0 for Cobalt 

SAML Migration: Update Your Configuration

SCIM Provisioning Setup Guide

Configure Organization Settings

Organization

Track Your Credits

Cobalt Credits

Cobalt PtaaS Tiers

Credits

Cobalt API Overview

Create a Personal Cobalt API Token

Get an Organization Token

Revoke Your Personal Cobalt API Tokens

Create or Modify an Asset

Import Findings to Google Sheets

Cobalt API

Glossary

March 2026

February 2026

January 2026

November 2025 

August 2025

July 2025

June 2025

May 2025

April 2025

March 2025

January 2025

December 2024

November 2024

October 2024

September 2024

August 2024

July 2024

June 2024

May 2024

April 2024

March 2024

January 2024

What's New

Guide

Cobalt Product Documentation