Microsoft Teams
Version: 1.9
Updated: Mar 4, 2024
Microsoft Teams is the ultimate hub for teamwork and intelligent communications. Built on the strength and scale of Microsoft 365 with over 120 million users, Microsoft Teams is a chat-based workspace in Microsoft 365. Microsoft Graph makes it easy to create large numbers of teams and populate them with users and channels, by automating the creation and management of teams, and channels. also send a messages to chats or channels.
Actions
- Add Channel Members (Notification) - Add a conversation member to a Channel. This operation is allowed only for private Channels.
- Add Team Members (Notification) - Add new multiple conversation Members to a Team.
- Archive Team (Containment) - Archive the specified team. When a team is archived, users can no longer send or like messages on any channel in the team, edit the team's name, description, or other settings, or in general make most changes to the team. Membership changes to the team continue to be allowed.
- Archive Team On Incident Closure Trigger (Trigger) - Archive Team automatically when the SOAR Incident is closed.
- Create Channel (Notification) - Create a new channel by including the display name and description in a team.
- Create Team (Notification) - Create a Team from scratch.
- Create Team On Incident Creation Trigger (Trigger) - When a new incident is created, automatically a new Team will be created in Microsoft Teams and all investigators of the incident will be added to the Team.
- Delete Channel (Containment) - Delete the specified Channel.
- List Channel Members (Enrichment) - Retrieve a list of conversation members from a Channel.
- List Channel Messages (Enrichment) - Retrieve the list of messages in a channel of a team. By using the delta query, you can get new or updated messages in a channel.
- List Channels (Enrichment) - Retrieve the list of channels in this team.
- List Team Members (Enrichment) - List the conversation member collection of a Team.
- List Teams (Enrichment) - List all the Teams available in an organization.
- List Users (Enrichment) - Retrieve a list of users objects.
- Remove Member From Channel (Containment) - Delete a conversation member from a Channel. This operation is allowed only for private channels.
- Search Channels Messages (Enrichment) - Retrieve messages across all Channels in a Team.
- Search Chats Messages (Enrichment) - Retrieve all messages from all chats that a user is a participant in, including one-on-one chats, group chats, and meeting chats.
- Send Chat Message (Notification) - Create a new chat and Send a chat message to a one-on-one chat or group chat conversation.
- Send Teams Message (Notification) - Send a new chat Message in the specified Channel in a Team.
- Microsoft Teams List Channel Messages Daemon (Daemon) - A Daemon that retrieves the list of messages in a channel of a team.
Microsoft Teams configuration
Each application you want the Microsoft identity platform to perform identity and access management (IAM) needs to be registered. Registering it establishes a trust relationship between your application and the identity provider, the Microsoft identity platform.
Register an application
Registering your application establishes a trust relationship between your app and the Microsoft identity platform. The trust is unidirectional: your app trusts the Microsoft identity platform, and not the other way around.
Follow these steps to create the app registration:
- Sign in to the Azure portal.
- If you have access to multiple tenants, use the Directory + subscription filter
in the top menu to select the tenant in which you want to register an application. - Search for and select the Azure Active Directory.
- Under Manage, select App registrations > New registration.
- Enter a Name for your application. Users of your app might see this name, and you can change it later.
- Select Register to complete the initial app registration.
- Don't enter anything for Redirect URI (optional).
- When registration completes, the Azure portal displays the app registration's Overview pane, which includes its Application (client) ID. Also referred to as just client ID, this value uniquely identifies your application in the Microsoft identity platform.
The client ID as one aspect in validating the security tokens it receives from the identity platform.
Add Credentials
Credentials are used by confidential client applications that access an API. Examples of confidential clients are web apps, or service- and daemon-type applications. Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime.
You can add client secrets (a string) as credentials to your confidential client app registration.
Add a Client Secret
The client secret, known also as an application password, is a string value of your app.
- Select your application in App registrations in the Azure portal.
- Select Certificates & secrets > New client secret.
- Add a description for your client secret.
- Select a duration.
- Select Add.
- Record the secret's value for use in your client application resource - it's never displayed again after you leave this page.
Add Permissions to API
- Select your application in App registrations in the Azure portal.
- Select API permissions > Add a permission
- Delegated permissions are selected by default. Delegated permissions are appropriate for client apps that access an API as the signed-in user, and whose access should be restricted to the permissions you select in the next step.
- Application permissions are for service- or daemon-type applications that need to access API as themselves, without user interaction for sign-in or consent. Unless you've defined application roles for your API.
- Select Add a permission, and below are the permissions to be added to the application you just created.
Microsoft Teams Test connector:
One of the following permissions is required to call this Action. To learn more, including how to choose permissions, see Permissions.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
| Application | User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
| Application | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
Add Channel Members Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
| Application | User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | ChannelMember.ReadWrite.All |
| Application | ChannelMember.ReadWrite.All |
Add Team Members Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
| Application | User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | TeamMember.ReadWrite.All |
| Application | TeamMember.ReadWrite.All |
Archive Team AND Archive Team On Incident Closure Trigger Actions:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | TeamSettings.ReadWrite.All |
| Application | TeamSettings.ReadWrite.Group* |
Note: This API supports admin permissions. Global admins and Microsoft Teams service admins can access teams that they are not a member of.
Create Channel Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
| Application | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Channel.Create |
| Application | Channel.Create |
Note: This API supports admin permissions. Global admins and Microsoft Teams service admins can access teams that they are not a member of.
Create Team Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Team.Create |
| Application | Team.Create, Teamwork.Migrate.All |
Create Team On Incident Creation Trigger Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | TeamMember.ReadWrite.All |
| Application | TeamMember.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Team.Create |
| Application | Team.Create, Teamwork.Migrate.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
| Application | User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
Delete Channel Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Channel.Delete.All |
| Application | Channel.Delete.Group*, Channel.Delete.All, |
List Channel Members Action:
One of the following permissions is required to call this API.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | ChannelMember.Read.All, ChannelMember.ReadWrite.All |
| Application | ChannelMember.Read.All, ChannelMember.ReadWrite.All |
List Channel Messages Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
| Application | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Channel.ReadBasic.All, ChannelSettings.Read.All, ChannelSettings.ReadWrite.All |
| Application | Channel.ReadBasic.All, ChannelSettings.Read.All, ChannelSettings.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | ChannelMessage.Read.All |
| Application | ChannelMessage.Read.All |
List Channels Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Channel.ReadBasic.All, ChannelSettings.Read.All, ChannelSettings.ReadWrite.All |
| Application | Channel.ReadBasic.All, ChannelSettings.Read.All, ChannelSettings.ReadWrite.All |
This API supports admin permissions. Global admins and Microsoft Teams service admins can access teams that they are not a member of List Team Members Action.
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | TeamMember.Read.All, TeamMember.ReadWrite.All |
| Application | TeamMember.Read.Group*, TeamMember.Read.All, TeamMember.ReadWrite.All |
List Teams Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
| Application | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
List Users Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
| Application | User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
Remove Member From Channel Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | ChannelMember.ReadWrite.All |
| Application | ChannelMember.ReadWrite.All |
Search Channels Messages Action:
The following permissions are required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Not supported. |
| Application | ChannelMessage.Read.All |
Note: Before you call this Action with application permissions, you must request access. For details, see Protected APIs in Microsoft Teams
Search Chats Messages Action:
The following permissions are required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Not supported. |
| Application | Chat.Read.All, Chat.ReadWrite.All |
Note: Before you call this Action with application permissions, you must request access. For details, see Protected APIs in Microsoft Teams.
Send Chat Message Action:
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) | | Delegated (work or school account) | ChatMessage.Send, Chat.ReadWrite | | Application | Not supported. |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
| Application | User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Chat.Create, Chat.ReadWrite |
| Application | Chat.Create |
For the action to work correctly and to avoid permission errors, ensure that one of the following criteria is met:
- The Channel moderation must be Off
- The account must be added as a moderator
- The account must be added as a team owner
For more information please visit: Change moderator roles and settings in a channel
Send Teams Message Action:
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | ChannelMessage.Send |
| Application | Teamwork.Migrate.All |
Note: Application permissions are only supported for migration. In the future, Microsoft may require you or your customers to pay additional fees based on the amount of data imported.
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
| Application | GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
One of the following permissions is required to call this Action.
| PERMISSION TYPE | PERMISSIONS (FROM LEAST TO MOST PRIVILEGED) |
|---|---|
| Delegated (work or school account) | Channel.ReadBasic.All, ChannelSettings.Read.All, ChannelSettings.ReadWrite.All |
| Application | Channel.ReadBasic.All, ChannelSettings.Read.All, ChannelSettings.ReadWrite.All |
For the action to work correctly and to avoid permission errors, ensure that one of the following criteria is met:
- The Channel moderation must be Off
- The account must be added as a moderator
- The account must be added as a team owner
For more information please visit: Change moderator roles and settings in a channel
Microsoft Graph API need to be configure as listed the above permissions
Applications are authorized to call APIs when they are granted permissions by users/admins as part of the consent process. The list of configured permissions should include all the permissions the application needs.
Once API permission are added then Admin must consent to a grant these permissions, Learn more about permissions and consent
For detailed API documentation visit https://docs.microsoft.com/en-us/graph/api/resources/teams-api-overview?view=graph-rest-1.0
Configure Microsoft Teams in Automation Service and Cloud SOAR
Before you can use this automation integration, you must configure its authentication settings so that the product you're integrating with can communicate with Sumo Logic. For general guidance, see Configure Authentication for Automation Integrations.
How to open the integration's configuration dialog
- Access App Central and install the integration. (You can configure at installation, or after installation with the following steps.)
- Go to the Integrations page.
Classic UI. In the main Sumo Logic menu, select Automation and then select Integrations in the left nav bar.
New UI. In the main Sumo Logic menu, select Automation > Integrations. You can also click the Go To... menu at the top of the screen and select Integrations. - Select the installed integration.
- Hover over the resource name and click the Edit button that appears.
In the configuration dialog, enter information from the product you're integrating with. When done, click TEST to test the configuration, and click SAVE to save the configuration:
Use the information you set up above.
-
Label. Enter the name you want to use for the resource.
-
API URL. Enter your Microsoft Teams API URL. The default URL is
https://graph.microsoft.com/v1.0 -
Tenant ID. Enter the tenant ID of the AAD directory in which you created the application. (You can check from your app registration page).
-
Authentication Grant Type. Choose one of the following according to the permissions you add to your app:
- Password (Delegated Context)
- Client Credentials (Application Context)
-
Client ID. Enter your application ID. (You can check from your app registration page). This is required for both authentication grant types.
-
Client Secret. Enter your client secret. This is required for both authentication grant types.
-
Username. Enter the username of an admin user authorized to authenticate the integration. This is required only if you set the authentication grant type as Password (Delegated Context). Leave this field empty if you set the authentication grant type as Client Credentials (Application Context).
-
Password. Enter the password for the admin user. This is required only if you set the authentication grant type as Password (Delegated Context). Leave this field empty if you set the authentication grant type as Client Credentials (Application Context).
-
Connection Timeout (s). Set the maximum amount of time the integration will wait for a server's response before terminating the connection. Enter the connection timeout time in seconds (for example,
180). -
Verify Server Certificate. Select to validate the server’s SSL certificate.
-
Automation Engine. Select Cloud execution for this certified integration. Select a bridge option only for a custom integration. See Cloud or Bridge execution.
-
Proxy Options. Select whether to use a proxy. (Applies only if the automation engine uses a bridge instead of cloud execution.)
- Use no proxy. Communication runs on the bridge and does not use a proxy.
- Use default proxy. Use the default proxy for the bridge set up as described in Using a proxy.
- Use different proxy. Use your own proxy service. Provide the proxy URL and port number.
For information about Microsoft Teams, see Microsoft Teams documentation.
Change Log
- July 12, 2022 (v1.0) - First upload
- January 10, 2023 (v1.1) - Refactoring
- May 10, 2023 (v1.2) - Daemon added
- May 19, 2023 (v1.3)
- Updated Daemon - Microsoft Teams List Channel Messages Daemon (Removed HTML Tags from Messages)
- Documentation Updated
- Modified the action type from Containment to Notification for the following actions:
- Add Channel Members
- Add Team Members
- Create Channel
- Create Team
- June 26, 2023 (v1.4) - Removed unnecessary empty lines and other little changes
- June 28, 2023 (v1.6) - Visibility of the Resource fields changed
- July 5, 2023 (v1.8)
- Updated Actions - List Users & Create Channel
- March 4, 2024 (v1.9) - Updated code for compatibility with Python 3.12