# Epicurus Pro — Microsoft Teams onboarding (any organisation) The universal, repeatable path for **any company on Microsoft Teams** to get Epicurus Pro working as their own digital colleague. Register → connect → install → it answers *as your org*. > **Why order matters:** register + sign in with Microsoft **first** (this binds your Microsoft > tenant to your Epicurus org), **then** install the app in Teams. Messages from your Teams tenant > then route to *your* org — your people, your personas, your email subdomain — never a shared brain. --- ## 1. Register your organisation 1. Go to **https://epicurus.pro/dashboard**. 2. Click **Sign in with Microsoft** (top of the panel). Tick the Terms + Privacy consent. 3. Approve the Microsoft sign-in for your work account. What happens automatically: - A fresh, isolated Epicurus organisation is created for your Microsoft tenant. - Your **Microsoft tenant (AAD) is bound** to this org (`surface_links`), so Teams messages route here. - You get a branded subdomain `your-org.epicurus.pro` and a **$100 free trial** (no card). - You land in the admin dashboard as the owner. > Email signup also works (no Microsoft), but for Teams the **Microsoft sign-in is what binds your > tenant** — do it from the same admin account that will install the app. --- ## 2. Add your team + shape their AI personas In the dashboard **Team** section (admins only): 1. **Add teammates** by email (optionally a name). Each teammate gets their **own isolated agent** (private memory, credits, and a permanent email identity once named). 2. Click **Customize** on anyone (including yourself) to set: - **Agent name** — e.g. `Charlie`, `Alexa`, `Jacob` (this also becomes their email local-part). - **Role** — e.g. `Sales Lead`, `Operations`. - **Personality** — free text shaping how that agent talks and behaves. Everything else is inherited live from the org template (so org-wide changes flow to everyone). When a teammate later messages the bot in Teams, Epicurus matches their Teams identity to their account by email and routes them to **their own named persona** automatically. --- ## 3. Install the Epicurus app in Teams You need the app package `epicurus-pro.zip` (from your Epicurus contact, or built from `packages/teams-app/` via `node build.js`). The bot is **multi-tenant**, so no Azure app registration is required on your side. **Option A — Sideload (fastest, for a team/chat):** 1. In Teams: **Apps → Manage your apps → Upload a custom app** (requires custom-app upload to be allowed in your tenant). 2. Select `epicurus-pro.zip`. 3. Add it to a chat, a team, or as a personal app. **Option B — Org-wide (Teams Admin Center):** 1. **Teams admin center → Teams apps → Manage apps → Upload new app**. 2. Upload `epicurus-pro.zip`, then approve/allow it for your org (or the target users). **Consent on install:** the first time it's added to a team/group chat, a team or chat **owner** grants the resource-specific consent (read messages in that channel/chat, read the roster). This is a single click at install — no global admin consent required for core chat. --- ## 3b. Updating an already-installed app (logo, name, new features) Teams only accepts an update when the package's manifest **version is strictly higher** than the installed one — so **always update from a fresh dashboard download**: 1. Dashboard → **Integrations → Microsoft Teams** → **Download app package (.zip)**. Every dashboard download automatically carries a **new, higher version** (shown next to the panel title). 2. Upload it **over the installed app**: in Teams, **Apps → Manage your apps → (your app) → Upload an update** — or org-wide via **Teams admin center → Manage apps → (your app) → upload the new file**. 3. Give it a little while to propagate; a new name/icon may need a Teams restart to show everywhere. > ⚠️ The shareable link `your-org.epicurus.pro/install/teams` (and `/teams-app.zip`) is for **first > installs** — it serves your current version without minting a new one, so Teams will reject it as > an update. Updates come from the dashboard download, which bumps the version every time. --- ## 4. Verify - **DM the bot** (personal scope) — it should reply as your org's agent. - **In a channel/group chat**, **@mention** the bot — it replies only when addressed (it still reads the channel for memory/search). DMs always get a reply. - Ask it something multi-step ("chase the unpaid invoices and report back tomorrow") — it plans the steps, fires them, pauses for approval on anything that spends money or is risky, and reports back. --- ## Notes & gotchas - **Unbound tenant gate:** if someone installs the bot before the org is registered, the bot replies with a friendly "register at epicurus.pro/dashboard to activate" nudge instead of a free brain. (Operators can flip `TEAMS_ALLOW_UNBOUND_AUTOPROVISION=true` to allow zero-touch auto-provisioning.) - **Org-wide people directory (optional):** to let the agent look up *anyone* in your company (not just people in the current chat), a Microsoft admin grants `User.Read.All` consent. Without it, the agent still works — it just resolves people from the current conversation roster. - **Already installed before registering?** Once you register + bind, an operator can reconcile any orphaned auto-provisioned tenant with `POST /api/admin/teams/rebind {aadTenantId, tenantId}` (admin token) so your history/binding points at the right org. `GET /api/admin/teams/orphans` lists them. - **Approvals:** actions that spend money or are destructive always pause for a human "yes" in chat, identity-gated to whoever asked (or the owner). --- ## For operators (Epicurus side) - Bot: multi-tenant Bot Framework app `f4582ac0-6839-4d6f-badf-80353342798e`, endpoint `https://epicurus.pro/api/surfaces/teams/webhook`, `TEAMS_MULTI_TENANT=true`, `TEAMS_VERIFY_STRICT=true`. - Binding precedence: explicit `surface_links` (set at Microsoft SSO) **always** wins over auto-provision. Unbound tenants gate by default (`TEAMS_ALLOW_UNBOUND_AUTOPROVISION` to override). - Microsoft Graph mail/calendar is a **separate** app-only registration (currently the Kirby tenant, mailbox `a.epicurus@thekirbygroup.co.uk`) — independent of the multi-tenant chat bot. - Future scale step: publish to the Microsoft Teams Store for true one-click install (Microsoft validation, ~days–weeks). Until then, hand out `epicurus-pro.zip` + this guide.