Microsoft Teams (identos.ms-teams)

User-delegated proxy for the Microsoft Graph Teams API. Every call runs as the signed-in user, so the caller's Teams and chat memberships apply naturally. Two upstream-auth modes are supported:

• entra_refresh (default) — PolicyArc uses the refresh token captured at the user's Microsoft sign-in to mint a fresh, correctly-audienced token per Microsoft service at call time. One sign-in works across any combination of Microsoft connectors — Graph (Mail, OneDrive, Teams) and Azure DevOps together. The minted token is cached per (user, resource) and re-minted on expiry; every call is made as the signed-in user.
• idp_passthrough — forwards the user's Microsoft sign-in token directly to Graph, with no exchange. That sign-in token carries a single audience, so passthrough works for only one Microsoft resource — either Graph (Mail/OneDrive/Teams) or Azure DevOps, not both; don't mix passthrough across Graph and Azure DevOps. Choose this only for strict tenants that disable refresh-token issuance (no offline_access), or that don't want a long-lived refresh token warehoused by PolicyArc. Otherwise prefer entra_refresh.

When to use it

• An agent or workflow needs to list the caller's joined teams and a team's channels.
• An agent needs to read channel messages or send a channel message as the caller.
• An agent needs to list and read the caller's chats and send chat messages as the caller.

What it does NOT do

• No service-account / application-wide access. Access is always the signed-in user's; there is no shared service account, and the caller only ever sees teams/channels/chats they belong to.
• No team or channel administration. The connector reads basic team/channel metadata and reads/sends messages; it does not create, archive, or manage teams, channels, or memberships.

Tool surface (10 tools)

Read paths use teams:read (teams/channels) and teams:messages:read (messages/chats); sends use teams:messages:write. The autogenerated reference below this README has the full list with route patterns and input schemas.

Operator data

The connector's Rego reads no operator data. Earlier versions of this README listed restricted_channels and allow_external_chats. No rule reads them, so setting them has no effect.

The Rego has one rule, and it does not fire today. It is meant to deny a chat route whose chat id ends in @thread.tacv2, the suffix of a channel thread, so that a channel thread is reachable only through the channel routes. It compares input.resource.id with the prefix teams-chat://. input.resource.id is the id of the resource the token holds, not the called chat. The gateway passes the chat id in input.context.rs_context.resource_id, without the prefix. It was bare over REST (19:abc@thread.tacv2) and URL-encoded over MCP (19%3Aabc%40thread.tacv2). On a local instance list_chat_messages for 19:abc@thread.tacv2 returned 200 over REST and over MCP.

Prerequisites

• One PolicyArc Microsoft IdP (provider key microsoft) configured with the app's client_id/client_secret and the tenant authorize/token endpoints. For the default entra_refresh mode, the login scopes must include offline_access so a refresh token is captured; idp_passthrough does not need it. This is the same IdP Azure DevOps uses — shared, not per-connector. See the Entra ID IdP guide.
• The Entra app granted these delegated Microsoft Graph permissions with admin consent: Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Read.All, ChannelMessage.Send, Chat.Read, Chat.ReadWrite.
• PBAC_CREDENTIAL_KEY (or the legacy PBAC_GATEWAY_CREDENTIAL_KEY) set on the AS (encrypts the cached tokens).

Install

The connector supports two upstream-auth modes, selected at install time:

• entra_refresh (default) — the gateway uses the refresh token from the user's Microsoft sign-in to mint a Graph-audienced token per call. Works alongside other Microsoft connectors (Mail, OneDrive, Azure DevOps) with a single sign-in.
• idp_passthrough — the user's sign-in token is forwarded to Graph directly. Only works for Graph alone — don't mix it with an Azure DevOps passthrough connector. Reach for this only if your tenant disables refresh-token issuance or you don't want PolicyArc holding a long-lived refresh token; otherwise prefer entra_refresh.

Install from the Admin Portal (APIs & Connectors → + Connect a resource → Microsoft Teams), choose your auth mode, and select Connect. The gateway resolves credentials from the Microsoft IdP registration.

Troubleshooting

• 502 "admin consent / API permission missing" — the Entra app is missing one of the Graph permissions above, or admin consent was not granted.
• 401 with "error": "idp_link_required" — the gateway, not Graph, answers this when the user has no stored microsoft token or the stored refresh token is expired or revoked. Open the link_url from the response body and sign in through the Entra IdP. If no link can be built, the gateway answers 502 with "refresh token expired or revoked; user must re-authenticate" instead.
• 502 "entra_refresh: no stored refresh token ... must authenticate with offline_access" — the user signed in without offline_access, so no refresh token was stored. In our run the gateway answered this 502, with no link_url, while the user's stored access token was still valid. The login scopes must include offline_access (see the prerequisites above).

Manifest reference

• ID: identos.ms-teams
• Version: 1.1.0
• Resource type: urn:connector:identos:ms-teams
• Capabilities: mcp

Supported auth modes

Type	Details
entra_refresh	requires IdP microsoft
idp_passthrough	requires IdP microsoft

Setup fields

ID	Label	Default	Secret?	Notes
upstream_auth.type	Authentication	entra_refresh	no	Authentication mode. entra_refresh (default) mints a separate per-resource token for each Microsoft service from your one sign-in, so a single login works across any mix of Microsoft connectors — Graph (Mail/OneDrive/Teams) and Azure DevOps together. idp_passthrough instead forwards your Microsoft sign-in token as-is, and that token is valid for only one audience: passthrough therefore works for either Graph (Mail/OneDrive/Teams) or Azure DevOps, not both. Use entra_refresh if you need more than one.

Scopes

Scope
teams:read
teams:messages:read
teams:messages:write
teams:admin

Routes

Method	Pattern	Scope	Resource template
GET	/v1.0/me/joinedTeams	teams:read	—
GET	/v1.0/teams/{team_id}	teams:read	teams://{{team_id}}
GET	/v1.0/teams/{team_id}/channels	teams:read	teams://{{team_id}}
GET	/v1.0/teams/{team_id}/channels/{channel_id}	teams:read	teams://{{team_id}}/{{channel_id}}
GET	/v1.0/teams/{team_id}/channels/{channel_id}/messages	teams:messages:read	teams://{{team_id}}/{{channel_id}}
GET	/v1.0/teams/{team_id}/channels/{channel_id}/messages/{message_id}	teams:messages:read	teams://{{team_id}}/{{channel_id}}/{{message_id}}
POST	/v1.0/teams/{team_id}/channels/{channel_id}/messages	teams:messages:write	teams://{{team_id}}/{{channel_id}}
GET	/v1.0/me/chats	teams:messages:read	—
GET	/v1.0/chats/{chat_id}/messages	teams:messages:read	teams-chat://{{chat_id}}
POST	/v1.0/chats/{chat_id}/messages	teams:messages:write	teams-chat://{{chat_id}}

MCP tools

Name	Scope	Description
list_joined_teams	teams:read	List all Microsoft Teams the signed-in user is a member of.
get_team	teams:read	Get metadata for a specific Microsoft Team by its team ID.
list_channels	teams:read	List all channels in a Microsoft Team.
get_channel	teams:read	Get metadata for a specific channel within a Microsoft Team.
list_channel_messages	teams:messages:read	List messages in a Teams channel. Returns top-level messages (replies are nested).
get_channel_message	teams:messages:read	Get a single message from a Teams channel by its message ID.
send_channel_message	teams:messages:write	Send a message to a Teams channel. Supports plain text and HTML body content.
list_chats	teams:messages:read	List all 1:1 and group chats the signed-in user participates in.
list_chat_messages	teams:messages:read	List messages in a 1:1 or group chat.
send_chat_message	teams:messages:write	Send a message to a 1:1 or group chat.