Agent accounts

A channel bot is an application with its own identity: people talk to the bot. An agent account is different: an agent operates a real user account of a messaging platform, or a mailbox, through that account's own sign-in. Two modes share one engine:

Mode	The account is	Typical use	Starts with
Delegate (`on_behalf`)	Yours	"When someone mentions me or messages me on Teams, let my agent answer for me." "Let my agent answer the emails it can, and flag the ones I must answer myself."	Your approval before anything is posted, an AI label, a 2-minute grace period, the agent stepping back when you write
AI user (`ai_user`)	A dedicated service account everyone knows is an AI, with its own mailbox and calendar	An AI colleague that answers direct messages, follows whole channels and decides when to speak - or runs a shared mailbox (`support@`, `executive-assistant@`)	Replies posted at once, no label, direct messages and mentions answered

Agent accounts are managed in Profile > Agent Accounts. Every user manages their own; administrators see every account with All accounts.

Two platforms are supported: Microsoft Teams (chats and channels) and Microsoft Outlook (a mailbox, see Mailboxes (Microsoft Outlook)). The engine is platform-agnostic: other platforms plug into the same rules, approvals and settings.

Before you start

An integration signed in as the account. Connect a Microsoft integration (Integrations > New integration > Microsoft) and sign it in as the account the agent operates: yourself for a delegate, the service account for an AI user. The integration's token must be one you may use - your own integration, or one shared with you with its owner's consent. The scopes the agent needs (Chat.Read, ChatMessage.Send, ChannelMessage.Read.All, ChannelMessage.Send, User.ReadBasic.All for Teams; Mail.Read, Mail.ReadWrite, Mail.Send for Outlook) are already part of the Microsoft integration.
An agent. Its persona, knowledge bases and tools answer. Messages come from other people, who can write anything: prefer an agent whose tools you are comfortable running for them (read-only integration bindings, no destructive tools), and keep approval on for a delegate until you trust it.
A public HTTPS address for real time. Microsoft Graph only notifies an HTTPS address, built from BASE_URL. Without one, direct and group chats - and a mailbox's inbox - are polled every minute, and channels cannot be heard.
A work or school account: Microsoft Graph does not offer these APIs for personal Microsoft accounts.
Microsoft Graph allows one subscription per Microsoft application and chat or channel. When two agent accounts signed in through one application follow the same channel, only one of them hears it, and the other one's card says which account holds it (see When the account does not hear a conversation).
One agent account per platform account. A platform account - and an integration, on each platform - is operated by one enabled agent account at a time. One Microsoft integration can therefore run a Teams account and an Outlook mailbox together, but not two Teams accounts. Saving a second one is refused, naming the first when it is yours (another user's account is never named): put the extra behaviour in rules of the first one, or save the second one switched off. Saving reads who the integration is signed in as; when Microsoft cannot say in time, the account is checked again when it starts listening, and stays in error if the platform account is taken.

Operating a service account

You can operate several platform accounts from your own XTM One account: yours, and any service account you hold the credentials of. For example, Samuel signs in to XTM One as himself and runs the executive-assistant@ mailbox:

Connect a second Microsoft integration, signed in as executive-assistant@ (name it, for instance, [Executive Assistant] Microsoft).
Create an AI user account with that integration and the Executive Assistant agent. Under Account (integration) the editor shows who the integration is signed in as - check it reads the service account, not you.
Bind Microsoft on the agent (a per-user binding is enough) to give it the account's mailbox and calendar.

In that account's replies, the agent works as the service account:

Its Microsoft tools act as the account. Mail, calendar and Teams tools run with the account's integration, whatever the agent's own Microsoft binding would resolve to for you - never your mailbox. An agent with no Microsoft binding gets no Microsoft tools: the account changes which account a tool acts as, never which tools the agent has.
It talks to the person who wrote. The agent is told who wrote as the platform reports it, marked unverified, not that it talks to you. Your personal memory (what the assistant remembers about you) and your default knowledge bases and MCP servers are left out of these replies.
Your other agent accounts stay out of it. Two agent accounts never answer each other: a message posted by any agent account is left alone by the others, so your delegate and the Executive Assistant cannot reply to each other in a loop.

Every reply still counts against your agentic quota, and its tools run with your permissions.

Create an account

Open Profile > Agent Accounts and click New account.
Choose Delegate or AI user. The choice only sets starting values; every setting stays editable.
Under General, pick the platform (Microsoft Teams or Microsoft Outlook; a new account's rules follow it), name the account, pick the integration signed in as the account and the agent that answers. The editor shows who the integration is signed in as, and warns when another agent account already operates that account.
Review the Rules (below), the Replies settings and, if needed, the Schedule.
Use Test to check what the agent would do with a message, then Create.

Saving answers at once. In the background, the account reads who it is from the integration, subscribes to the conversations its rules reach, and starts listening: its card shows Setting up meanwhile, then its status and how it listens (Real time, Polling every minute). Microsoft confirms each subscription by calling the platform back, which can take a few seconds per conversation. When a conversation cannot be heard, the card says why and what to do (see When the account does not hear a conversation).

Rules

Rules are read top to bottom; the first rule that matches a message decides. A message no rule matches is left alone. Each rule matches on:

Setting	Options
Where	Direct messages, group chats, channels - any combination
Specific conversations	Chosen from the account's own chats and channels. Empty: every conversation of the selected kinds
Only these people	Focus the rule on some people (chosen from the directory, or typed as an email)
Members of these groups	XTM One groups: the rule also covers a sender one of whose Microsoft addresses (mail address or sign-in name) is the email of an active member. With no people and no group, the rule covers anyone
Except these people	People this rule never answers
Trigger	`Only when the account is mentioned`, or `Every message (full monitoring)`. A direct message always counts as addressed to the account. In channels, a rule waiting for a mention hears the mentions only: the channel's other messages - alerts and bot posts included - never reach the account, unless another rule answers every message there
Action	`Answer`, or `Ignore (stop here)` - an ignore rule placed first is how you exclude a conversation or a person entirely
Reply	`Always reply`, or `AI decides whether to reply`: the agent reads the message and stays silent unless its persona says it should speak
Follow the thread	Once the agent answered in a thread, later messages there count as addressed, and the agent decides whether to answer them. In a channel heard for mentions only, the platform checks that thread every minute for a day after the agent's last answer there, so a follow-up without a mention can take up to a minute to be seen

A rule can also override the account's defaults for the messages it answers: the response mode, the AI label, the grace period, and extra guardrails and instructions ("for my manager, be formal and never commit to a date"). The sparkle button next to the account's instructions and to each rule's guardrails writes or improves them with AI from a short description.

The editor offers ready-made rules: Monitor a channel (AI decides), Focus on some people, Ignore a conversation, Public channels, non-confidential only and Leadership groups, full access (both described below).

Access by audience

An agent with deep reach - board material, every integration, a long memory - should not answer everyone with everything. Besides who it answers, each rule decides what the agent may use for the messages it covers, in its Access section:

Integrations, knowledge bases, MCP servers, built-in tools, custom tools and skills. The section lists the agent's own; everything is on by default, and switching one off removes it from those replies. This is enforced by the platform, not asked of the model: a knowledge base switched off is not searched, an integration switched off has no tool. A rule only ever narrows the agent - a capability the agent gains later is on for a rule that left the list untouched, never for one that narrowed it.
Memory. Use the agent's memory off: the agent neither reads nor writes its memory for those messages, so what it learned in a board chat cannot surface in a public channel, and nothing said there is remembered.
Guardrails. The rule's instructions govern what the agent says to that audience ("only information already public inside the company; decline board, financial and HR questions politely"); generate them with AI from a one-line description.

Because the first matching rule decides, order is the policy: put channel rules first. An executive asking the Executive Assistant a question in #general then gets #general's access, not theirs, because everyone in the channel reads the answer. For example:

Public channels, non-confidential only - channels, when mentioned: no confidential knowledge base or integration, memory off, a guardrail.
Leadership groups, full access - direct and group chats, for the members of the Board and ExCo groups: everything the agent has.
Nothing else: anyone outside those groups messaging the account directly is left alone.

The Test tab shows which rule applies and whether it limits access; type an email as the sender to test with the groups of the XTM One user it belongs to. When a rule names groups, it also says who the sender was found to be: XTM One user ..., member of Board, in none of the groups the rules name (add them to the group), or No active XTM One user has the email ... (their XTM One account uses another email, or is deactivated).

Examples

Delegate, mentions and DMs only: the default rules. Add Focus on some people above them with Send automatically for your team, so only their questions skip your approval.
AI user following an incident channel: a rule on that channel with Every message and AI decides. The agent reads everything and speaks when it has something useful to add.
Never in #general: an Ignore rule on that channel, first in the list.

Mailboxes (Microsoft Outlook)

An Outlook agent account watches the account's inbox and handles each email its rules give the agent - your own mailbox as a delegate, or a service account's (support@, executive-assistant@) as an AI user.

Where. A mailbox has two kinds of conversation instead of chats and channels: Emails to the account alone (the account is the only recipient) and Emails with other recipients. The trigger reads Only when the account is in To or Every email, Cc included: an email to the account alone always counts as addressed to it, an email where it is only in Cc does not. A thread of replies is one conversation, named after its subject.

Starting rules. A new mailbox answers the emails sent to the account alone and those with the account in To, the agent deciding for each; emails where the account is only in Cc are left alone. As a delegate, replies wait for your approval, with the AI label, a 2-minute grace period and up to 10 replies per conversation and hour; as an AI user, replies are sent at once, up to 30.

Who. Only these people and Except these people take an address or a whole domain written @example.com (that exact domain, not its subdomains): for instance Ignore emails from @newsletter.example.com, or answer @customer.com only.

Triage. For each email a rule hands it, the agent makes one of three choices, and says why in one line:

The agent	What happens	Shown in the account's page as
Answers	The reply goes out as the response mode says (sent, waiting for your approval, or recorded in shadow)	`Answered`
Hands it to you - it cannot or should not answer (a decision only you can take, missing information, a sensitive topic)	Nothing is sent; by default the email is flagged for follow-up, filed in the category `Needs your attention`, and the notification bell tells you, with the agent's reason	`Handed to you`
Leaves it - it needs no reply (a thank-you, an FYI, a confirmation)	Nothing is sent; by default the email is filed in `No reply needed`	`The agent stayed silent`

The choice is read by the platform from a structured answer, not from the wording of a reply. A rule with Always reply lets the agent answer or hand over, never leave an email unanswered. The agent's reason shows under The agent's reason when you open the email in the Decisions tab.

What the mailbox shows (Replies > Mailbox triage): for each of the three outcomes, whether the email is marked as read, the Outlook category it is filed in (empty for none; the category is added to the email's own), and for an email handed to you whether it is flagged and whether you are notified. By default an answered email is marked as read and filed in Answered by AI. In Shadow mode the mailbox is left untouched and nobody is notified.

Replies. The agent replies in the email's thread - to the sender, or to everyone when others were on the email - with the signature below under the answer and the original email quoted below it, as Outlook does. The agent reads the thread's earlier emails, and the names of the email's attachments, as context. If you answer the email yourself during the grace period, or write in the thread, the agent steps back as on Teams.

Signature (Replies > Signature). A reply the agent sends never goes through Outlook, so a signature add-in installed in Outlook never signs it. The account chooses what it carries:

Signature	What the reply carries	When to choose it
The account's own (default)	The signature of the account's latest sent emails, copied	Signatures set in Outlook, or a service account whose sent mail is signed
From a signature integration	The person's current signature from a Letsignit integration, read when each reply is sent: their signature and banner as Letsignit composes them now, its reply variant first	Letsignit signs your mail in Outlook (the add-in): the reply looks like one the person sent, banner of the day included
None	No signature	The mail server signs every outgoing email in transit (Letsignit's server-side signature, an SMTP connector): the reply is signed there, once

The signature is looked up by the account's email address and kept for 10 minutes. When the integration cannot be read, or holds no signature for that address, the reply carries the account's own, and the account's card says why until a reply carries the integration's signature again.

Left alone. The account's own emails, drafts, meeting invitations and responses, emails sent by any agent account (each carries a header saying so, so two agent mailboxes never answer each other in a loop), and automated mail - newsletters, mailing lists, notifications, auto-replies and out-of-office messages, recognised by the headers such mail carries (RFC 3834) - shown as Automated mail (a notification, a newsletter, an auto-reply).

Replies

Setting	What it does
Response mode	`Send automatically`; `Ask me first` - replies wait in your approval queue; `Shadow (record only)` - nothing is posted, so you can see what the agent would have said while you tune the rules
AI label	A line such as Sent by an AI agent on behalf of Sam added to every reply, before or after it. It is added by the platform, never left to the model. `{name}` stands for the account's name. A rule can turn it on or off
Grace period	Wait before answering. If the account's human answers meanwhile, the agent stays silent. A restart during the wait does not lose the message
Step back after the owner writes	Once the human writes in a conversation, the agent stays out of it for this many minutes
Replies per conversation and hour	A safety limit, for instance between two AI accounts. `0`: no limit
Context messages	How many earlier messages of the thread or chat the agent reads. The conversation is replayed from the platform - messages the human wrote themselves included - so the agent answers in context, as a participant
Instructions	Added to the agent's persona for every reply of this account; can be generated with AI
Reactions as feedback	On by default. A reaction someone puts on an answer of the agent rates it: by default a thumbs up is positive and a thumbs down negative; click an emoji to make it positive, negative or ignored. See below
Notify me when a reply is sent	On by default. Each reply the account posts on its own (`Send automatically`) reaches you in the notification bell - where it was posted, to whom, and the start of what was said - so you can follow what is said on your behalf without reading every conversation. A reply you approve does not notify you again

Reactions as feedback

When people react to an answer the agent posted, their reaction becomes a rating of that answer in the agent's Feedback tab (and in what the agent's persona improvement reads), next to the thumbs given in the web chat.

Anyone who can react counts, colleagues without an XTM One account and guests included. The platform keeps only a keyed fingerprint of who reacted - enough to count one rating per person and to remove it when the reaction is removed - never their name or id.
A skin tone counts as the same emoji. Someone holding a positive and a negative emoji on the same answer does not rate it. Emojis you did not map are ignored.
A reaction counts for 14 days after the answer was posted. Switching the setting off stops reading new reactions; switching it on later does not read the past ones.
In AI user mode, the account's own reactions are not ratings (the account is the agent). In On my behalf mode, your own reaction on your delegate's answer counts.
Reactions are read as they happen in chats and in channels the account hears in full. In channels heard for mentions only - Microsoft allows one subscription per channel, and that one only carries mentions - and when the platform has no public HTTPS address, the answers are checked every few minutes, then less often as they age.
The account page shows how many positive and negative ratings each answer received (Replies tab), and the totals over the period (Overview tab).

The agent never answers the account's own messages, nor messages from apps, bots, workflows and other agent accounts.

Approvals

With Ask me first, each reply waits in Replies waiting for your approval at the top of Profile > Agent Accounts, and the notification bell tells you. For each one you see the message, the conversation and the rule, and you can send the draft, edit it first, or drop it. The AI label is added when the reply is sent. A reply nobody approves expires after a day. Shadow drafts can also be sent from the Replies tab of the account's page.

Active hours

A weekly schedule with a timezone. During these hours answers only inside the windows; Outside these hours (when I am away) answers only outside them - for instance evenings and weekends for a delegate. A window that ends before it starts runs past midnight.

Understanding what happened

The name of an account, or its Activity button, opens the account's page. It keeps every message the account heard over the last 30 days, in three tabs:

Overview - over the last 24 hours, 7 days or 30 days: how many messages the account heard and how many were for the agent, what it did with them (answered, waiting for your approval, stayed silent, left alone, failed) and the share it answered, the median time to answer and to approve, the ratings of its answers. Charts show the activity over time, the kinds of conversation and why messages were left alone; tables show what each rule decided and the conversations and people the account heard the most. A figure, a conversation or a person opens the Decisions tab on it. Hide the messages left alone from the timeline to see only what the agent did.
Decisions - every message, newest first, filtered by what the account did, the kind of conversation, a conversation, a person or a search, page by page. A row opens on why it happened: the reason (The account is not mentioned, No rule covers it, The account owner took over, Hourly reply limit reached...), the rule, how the message was addressed (a direct message, a mention, a follow-up in a thread), whether a grace period ran, and the reply it produced. When a rule names groups, it also shows who the sender was found to be, as in the Test tab.
Replies - every reply the agent wrote, filtered by status or searched: what was posted, the drafts waiting for you (send, edit or drop them here), shadow drafts, and the replies that failed with why.

Use Test in the editor to try a message against unsaved rules.

A message from a conversation no rule covers reads No rule covers it, whoever wrote it. Seeing some after narrowing the rules (for instance from a channel you no longer follow) means the account was still subscribed to it: the first such message triggers a new synchronization, which drops the subscription within a minute or two.

When the account does not hear a conversation

Each synchronization checks every conversation the rules reach. When some cannot be heard, the account card says how many (Not listening to 12 of 14 conversations), when it last checked, and one entry per cause: what is wrong, the conversations it affects (All chats, or the channel by name), what to do, and the button that does it. Technical details shows what Microsoft answered, word for word, for support. While a new check runs, the card keeps the previous check's findings and says so. Once fixed, use Synchronize now (or wait for the next synchronization, within the hour).

The card says	What it means	What to do
The account's integration cannot be used	The integration is gone, disconnected, or its token is not one you may use	Open the integration and sign it in as the account, or pick another one in the account's settings
Microsoft Teams rejected the integration's sign-in	The sign-in expired or was revoked	Sign the integration in again as the account
Microsoft Teams refused to notify the account	Microsoft refused the subscription: the integration lacks the permission the card names (`Chat.Read` for chats, `ChannelMessage.Read.All` for channels - often an administrator's consent in Entra ID), or the account is no longer a member of the conversation	Get the permission granted, sign the integration in again, then synchronize
Your agent account ... already follows it / Another user's agent account already follows it	Microsoft allows one subscription per application and conversation, and another agent account of this platform holds it	Remove the conversation from one of the two accounts' rules, or connect one of them through another Microsoft application
... already follows it through the same app	Another platform signed in as this account through the same Microsoft application (for instance a staging instance) holds the subscription	Remove it there, or use another Microsoft application for one of the two
Microsoft Teams could not reach the platform to confirm the subscription	Microsoft calls the platform back before it creates a subscription, and the call never arrived: `BASE_URL/api/v1/agent-accounts/notifications/microsoft_teams` is not reachable from the internet over HTTPS (behind a VPN or an access proxy, for instance)	An administrator makes `BASE_URL` publicly reachable over HTTPS
Channels cannot be heard without a public HTTPS address	`BASE_URL` is not a public HTTPS address: chats are polled every minute, channels cannot be heard	An administrator sets `BASE_URL` to a public HTTPS address
The conversation no longer exists, or the account left it	The channel or chat is gone, or the account was removed from it	Remove it from the rules, or add the account back
Microsoft Teams asked the platform to slow down / did not answer	A temporary condition	Nothing: the next synchronization tries again

The account keeps hearing every conversation that is not listed: a card with problems and the Active status still answers there.

Security notes

An agent account acts with its owner's integration token and agent. It is never shared; administrators can see and edit every account.
Messages from other people are untrusted input to an agent that acts as you. The platform's prompt-injection checks and content quarantine apply as on channels, and a tool that needs approval stops the reply instead of posting an explanation - but the safest setup is a delegate with approval and an agent with read-only tools.
Group membership is read on every message: someone removed from a group stops reaching what that group could at their next message. A sender is matched to an XTM One user by the addresses the platform reports from its directory (for Microsoft, the mail address and the sign-in name), which the sender cannot type; a sender with no XTM One account belongs to no group. The decisions show only the groups the rules name, never a sender's other memberships.
Access limits are enforced by the platform, guardrails by the model. Put what must not leak behind an access limit (a knowledge base switched off, memory off), and use guardrails for tone and for what the agent should decline to discuss.
With AI switched off on the platform, no message is answered (each is recorded as AI unavailable); the accounts stay yours to create, edit, synchronize or delete, and their waiting replies to send or drop. Generating instructions with AI waits for AI to be back.
Every created, changed, deleted, approved and rejected account or reply is recorded in the audit log, and every agent turn counts against the owner's agentic quota.