Microsoft Teams (identos.ms-teams)

User-delegated proxy for the Microsoft Graph Teams API. Every call runs as the signed-in user, so the caller's Teams and chat memberships apply naturally. Two upstream-auth modes are supported:

• entra_refresh (default) — PolicyArc uses the refresh token captured at the user's Microsoft sign-in to mint a fresh, correctly-audienced token per Microsoft service at call time. One sign-in works across any combination of Microsoft connectors — Graph (Mail, OneDrive, Teams) and Azure DevOps together. The minted token is cached per (user, resource) and re-minted on expiry; every call is made as the signed-in user.
• idp_passthrough — forwards the user's Microsoft sign-in token directly to Graph, with no exchange. That sign-in token carries a single audience, so passthrough works for only one Microsoft resource — either Graph (Mail/OneDrive/Teams) or Azure DevOps, not both; don't mix passthrough across Graph and Azure DevOps. Choose this only for strict tenants that disable refresh-token issuance (no offline_access), or that don't want a long-lived refresh token warehoused by PolicyArc. Otherwise prefer entra_refresh.

When to use it

• An agent or workflow needs to list the caller's joined teams and a team's channels.
• An agent needs to read channel messages or send a channel message as the caller.
• An agent needs to list and read the caller's chats and send chat messages as the caller.

What it does NOT do

• No service-account / application-wide access. Access is always the signed-in user's; there is no shared service account, and the caller only ever sees teams/channels/chats they belong to.
• No team or channel administration. The connector reads basic team/channel metadata and reads/sends messages; it does not create, archive, or manage teams, channels, or memberships.

Tool surface (10 tools)

Read paths use teams:read (teams/channels) and teams:messages:read (messages/chats); sends use teams:messages:write. The autogenerated reference below this README has the full list with route patterns and input schemas.

Operator data

Key	Effect
restricted_channels	Channels that may not be read or posted to.
allow_external_chats	When false, operations on chats including external/guest participants are denied.

(Policy rules ship in the connector's Rego package; connector-owned packages are loaded into OPA. Behaviour matches the gateway's connector-policy aggregation.)

Prerequisites

• One PolicyArc Microsoft IdP (provider key microsoft) configured with the app's client_id/client_secret and the tenant authorize/token endpoints. For the default entra_refresh mode, the login scopes must include offline_access so a refresh token is captured; idp_passthrough does not need it. This is the same IdP Azure DevOps uses — shared, not per-connector. See the Entra ID IdP guide.
• The Entra app granted these delegated Microsoft Graph permissions with admin consent: Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Read.All, ChannelMessage.Send, Chat.Read, Chat.ReadWrite.
• PBAC_GATEWAY_CREDENTIAL_KEY set on the AS (encrypts the cached tokens).

Install

The connector supports two upstream-auth modes, selected at install time:

• entra_refresh (default) — the gateway uses the refresh token from the user's Microsoft sign-in to mint a Graph-audienced token per call. Works alongside other Microsoft connectors (Mail, OneDrive, Azure DevOps) with a single sign-in.
• idp_passthrough — the user's sign-in token is forwarded to Graph directly. Only works for Graph alone — don't mix it with an Azure DevOps passthrough connector. Reach for this only if your tenant disables refresh-token issuance or you don't want PolicyArc holding a long-lived refresh token; otherwise prefer entra_refresh.

Install from the admin UI (Resources → Add → Microsoft Teams), choose your auth mode, and click Install. The gateway resolves credentials from the Microsoft IdP registration.

Troubleshooting

• 502 "admin consent / API permission missing" — the Entra app is missing one of the Graph permissions above, or admin consent was not granted.
• 401 from Graph — the refresh token is expired or offline_access was not in the login scopes; re-authenticate through the Entra IdP.

Manifest reference

• ID: identos.ms-teams
• Version: 1.0.0
• Resource type: urn:connector:identos:ms-teams
• Capabilities: mcp

Supported auth modes

Type	Details
entra_refresh	requires IdP microsoft
idp_passthrough	requires IdP microsoft

Setup fields

ID	Label	Default	Secret?	Notes
upstream_auth.type	Authentication	entra_refresh	no	Authentication mode. entra_refresh (default) mints a separate per-resource token for each Microsoft service from your one sign-in, so a single login works across any mix of Microsoft connectors — Graph (Mail/OneDrive/Teams) and Azure DevOps together. idp_passthrough instead forwards your Microsoft sign-in token as-is, and that token is valid for only one audience: passthrough therefore works for either Graph (Mail/OneDrive/Teams) or Azure DevOps, not both. Use entra_refresh if you need more than one.

Scopes

Scope
teams:read
teams:messages:read
teams:messages:write
teams:admin

Routes

Method	Pattern	Scope	Resource template
GET	/v1.0/me/joinedTeams	teams:read	—
GET	/v1.0/teams/{team_id}	teams:read	teams://{{team_id}}
GET	/v1.0/teams/{team_id}/channels	teams:read	teams://{{team_id}}
GET	/v1.0/teams/{team_id}/channels/{channel_id}	teams:read	teams://{{team_id}}/{{channel_id}}
GET	/v1.0/teams/{team_id}/channels/{channel_id}/messages	teams:messages:read	teams://{{team_id}}/{{channel_id}}
GET	/v1.0/teams/{team_id}/channels/{channel_id}/messages/{message_id}	teams:messages:read	teams://{{team_id}}/{{channel_id}}/{{message_id}}
POST	/v1.0/teams/{team_id}/channels/{channel_id}/messages	teams:messages:write	teams://{{team_id}}/{{channel_id}}
GET	/v1.0/me/chats	teams:messages:read	—
GET	/v1.0/chats/{chat_id}/messages	teams:messages:read	teams-chat://{{chat_id}}
POST	/v1.0/chats/{chat_id}/messages	teams:messages:write	teams-chat://{{chat_id}}

MCP tools

Name	Scope	Description
list_joined_teams	teams:read	List all Microsoft Teams the signed-in user is a member of.
get_team	teams:read	Get metadata for a specific Microsoft Team by its team ID.
list_channels	teams:read	List all channels in a Microsoft Team.
get_channel	teams:read	Get metadata for a specific channel within a Microsoft Team.
list_channel_messages	teams:messages:read	List messages in a Teams channel. Returns top-level messages (replies are nested).
get_channel_message	teams:messages:read	Get a single message from a Teams channel by its message ID.
send_channel_message	teams:messages:write	Send a message to a Teams channel. Supports plain text and HTML body content.
list_chats	teams:messages:read	List all 1:1 and group chats the signed-in user participates in.
list_chat_messages	teams:messages:read	List messages in a 1:1 or group chat.
send_chat_message	teams:messages:write	Send a message to a 1:1 or group chat.

Operator data schema

Keys the operator can supply under data.pbac.operator.connectors["identos.ms-teams"].* — consumed by the connector's policy.

Key	Type	Description
restricted_channels	array	Channel IDs that are read-only for non-admin users. Members may read but cannot send messages to these channels.
allow_external_chats	boolean	When false (default), listing and reading chats with external (guest) participants is blocked. Set true to permit external chat access.