Hermes Agent Microsoft Teams support comes in two separate parts: a Teams chat bot that lets your team message the agent like a colleague, and a meeting pipeline that reads Teams transcripts through Microsoft Graph and posts a summary back after each call.
📺 Watch: NEW Hermes Agent Updated Changes AI Agents Forever..
🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside
This guide covers both, in the order you'd build them. Every command, setting and permission below comes from the official Hermes Microsoft Teams setup page and the Teams Meetings page.
Julian Goldie shares his agent setups, step-by-step trainings and four live coaching calls a week inside the AI Profit Boardroom. If you want to map your Microsoft 365 setup with someone first, book a free AI strategy session.
Two Teams features, two different jobs
The first part is the teams gateway platform. People type to the bot in Teams, and Hermes answers with its full toolset. The messaging docs list the Teams toolset as hermes-teams, with full tools including the terminal.
The second part is the teams_pipeline plugin. Nobody types to it. Microsoft Graph tells Hermes a meeting produced a transcript, and the pipeline fetches it, summarises it and delivers the result.
The Graph listener docs put the difference plainly: the chat bot is something users talk to, while the Graph listener is Microsoft 365 telling Hermes something happened.
You can run the bot alone. The pipeline can also run alone if you deliver summaries by incoming webhook, Notion or Linear. Most teams end up wanting both.
Set up the Hermes Agent Microsoft Teams bot
The quickest route is hermes gateway setup and picking Microsoft Teams from the list. The manual route has six steps.
- Install the Teams CLI. Run npm install -g @microsoft/teams.cli@preview, then teams login. The docs say this CLI handles bot registration with no Azure portal needed. Run teams status --verbose to see your own AAD object ID.
- Open a public HTTPS address. Teams cannot deliver to localhost. The default port is 3978. The docs show devtunnel, ngrok and cloudflared, and a named devtunnel keeps the same URL across restarts.
- Create the bot. Run teams app create with the name Hermes and an endpoint ending in /api/messages. It prints a client ID, client secret and tenant ID, plus an install link. The secret is shown once, so save it straight away.
- Fill the env file. In ~/.hermes/.env add TEAMS_CLIENT_ID, TEAMS_CLIENT_SECRET, TEAMS_TENANT_ID and TEAMS_ALLOWED_USERS with the AAD object IDs of the people allowed in.
- Start the gateway. Run hermes gateway restart, or hermes gateway run to watch it in the foreground. A health check on port 3978 should answer ok.
- Install the app. Run teams app get with your app ID and the install-link flag, open the link, and it opens in the Teams client. Send the bot a direct message.
One detail trips people up: the tunnel speaks HTTPS to the outside, but the Hermes listener on 3978 is plain HTTP. If the tunnel forwards HTTPS to it, the logs show a 400 error.
📺 Watch: How to Build Teams of Hermes Agents!
How the bot behaves in chats and channels
In a personal chat the bot answers every message. In group chats and channels it answers only when someone @mentions it, and Hermes strips the mention tag before the agent reads the text.
If your app manifest adds resource-specific consent for reading messages, Teams starts sending every message in the conversation. Then set TEAMS_REQUIRE_MENTION to true, so the bot stays quiet unless it is mentioned or someone replies to it.
Risky commands don't arrive as a typed question. Hermes sends an Adaptive Card with four buttons: Allow Once, Allow Session, Always Allow and Deny. Click one and the card changes to show the decision.
In a shared channel, if a teammate clicks someone else's approval, the security docs say they get a private card response telling them only the requester can answer.
Set TEAMS_HOME_CHANNEL to a conversation ID if you want cron jobs and proactive messages to land in Teams. You can even send /update from Teams to update Hermes, and the bot goes quiet for a few seconds while the gateway restarts.
📺 Watch: New FREE Hermes Agent Teams Update is INSANE!
What the Teams adapter supports
The platform comparison in the messaging gateway docs lists what each chat app can do. This table pairs the Teams row with the pipeline's delivery options.
| Item | Teams chat bot | Teams meeting pipeline |
|---|---|---|
| Who starts it | A person messaging the bot | A Microsoft Graph change notification |
| Port and path | 3978, /api/messages | 8646, /msgraph/webhook |
| Credentials | TEAMS_CLIENT_ID, secret, tenant ID | MSGRAPH_CLIENT_ID, secret, tenant ID |
| Supported per docs | Images, threads, typing indicator | Transcripts first, recording plus STT fallback |
| Not ticked in the docs table | Voice, files, reactions, streaming | Joining or speaking in a live call |
| Where output goes | The same chat or channel | Teams, Notion or Linear |
Need a Microsoft 365 plan for your agent? Book a free AI strategy session and bring your tenant details.
The Teams meeting pipeline, step by step
The pipeline is a bundled plugin, and bundled plugins are never switched on for you. Enable it with hermes plugins enable teams_pipeline, or run hermes gateway setup and pick Teams Meetings.
Per the Teams Meetings page, the pipeline does five things in order:
- It receives Microsoft Graph webhook events.
- It resolves the meeting and looks for the transcript first.
- If there is no usable transcript, it downloads the recording and runs speech-to-text, which needs ffmpeg installed.
- It stores job state and sink records locally.
- It writes the summary to Notion, Linear or Microsoft Teams.
The listener is its own gateway platform called msgraph_webhook. It listens on port 8646 and refuses to start without a client state secret. The docs suggest making one with openssl rand -hex 32.
Then you subscribe. The plugin CLI creates Graph subscriptions for the getAllTranscripts and getAllRecordings resources, pointed at your public /msgraph/webhook address.
For delivery back into Teams there are two modes. Incoming_webhook posts with a static Teams URL, with no reply threading and no reactions. Graph mode posts into a chat or channel under the app's identity, and needs extra permissions.
Microsoft Graph permissions and the 72-hour trap
The Graph app registration guide uses app-only sign-in, so you need a tenant admin. Its prerequisite is a Microsoft 365 tenant with Teams Premium or Teams licences that produce transcripts and recordings.
- Transcript summaries: OnlineMeetings.Read.All and OnlineMeetingTranscript.Read.All.
- Recording fallback: OnlineMeetingRecording.Read.All and CallRecords.Read.All.
- Graph delivery: ChannelMessage.Send for channels, Chat.ReadWrite.All for chats.
Out of the box, those permissions reach every meeting in the tenant. The guide recommends an Application Access Policy in PowerShell to limit the app to named users, and warns that it can take up to 30 minutes to apply. Microsoft documents the same control on Microsoft Learn.
Now the trap. Graph subscriptions expire after at most 72 hours, and they don't renew themselves. The operator guide calls this the number one failure mode. Schedule hermes teams-pipeline maintain-subscriptions every 12 hours with Hermes cron, a systemd timer or crontab.
If your admin has switched off Graph access to transcripts, Microsoft says creating or renewing a transcript subscription fails with a 403 error.
My verdict on Hermes in Teams
Start with the chat bot. It takes one CLI, one tunnel and four env lines, and the approval cards make it safe to let the agent run real commands from a channel.
Add the meeting pipeline once the bot is steady and you have admin access. Lock it down with an Application Access Policy, and put the renewal job on a schedule before you trust it.
If you'd rather have the agent join live calls, the official pipeline doesn't do that. A community plugin called MeetStream in the Hermes plugin catalog says it joins Teams calls as a visible bot, but it is not a Nous Research plugin. Grok Bot takes a different route, and the Grok Bot Microsoft Teams guide explains it.
Julian's Agent OS guide shows how the gateway, plugins and models fit together, and Goldie Bench compares the models you could put behind the bot. Members of the AI Profit Boardroom get the installable Agent OS. For a plan built around your tenant, book a free AI strategy session.
FAQ
Does the Hermes Teams bot need the Azure portal?
Not for the chat bot. The Teams CLI registers the bot and prints the client ID, secret and tenant ID. The meeting pipeline is different: its Graph app is registered in the Entra admin centre by a tenant admin.
Why does my bot ignore messages in a channel?
In channels and group chats it answers only when @mentioned. If it ignores direct messages too, your AAD object ID is probably missing from TEAMS_ALLOWED_USERS.
Can Hermes join a Teams call and talk?
The official meeting pipeline doesn't join calls. It reads transcripts or recordings after Graph reports them. Live call joining is offered by the community MeetStream plugin, not by Nous Research.
Why did my meeting summaries stop after three days?
Graph subscriptions last at most 72 hours. Schedule hermes teams-pipeline maintain-subscriptions, every 12 hours as the operator guide suggests, and check it with the dry-run flag.
Where can the summaries be sent?
To a Teams chat or channel through Graph, to a channel through an incoming webhook, or to Notion and Linear sinks.
Can the pipeline read every meeting in my company?
The application permissions allow that by default. Add an Application Access Policy so the app can only read meetings for the users you grant.
Build the bot first, add the pipeline second, schedule the renewal job, and your Hermes Agent Microsoft Teams setup is ready for real work.
