Microsoft Teams

Connect Microsoft Teams to Oleria to see who belongs to each team (including guests and owners), who holds Teams administration roles, which Teams apps are installed and what they can access, and what changed - from the Microsoft 365 unified audit log. A single Oleria connection covers one Microsoft Entra tenant - Oleria discovers every user, team, and Teams app in that tenant through Microsoft Graph.

This page covers access governance for Teams. To receive Oleria alerts and notifications in Teams, see Microsoft Teams messaging - it uses a separate app registration.

What Oleria discovers

Area	Detail
Users	Every tenant user, with guests marked as external. MFA registration state comes from Entra’s registration report (needs Entra ID P1 or P2); last activity comes from the tenant sign-in record (Entra ID P1), falling back to the Teams usage report.
Teams	Every team, with owner and guest capacities carried on each membership and owners recorded as each team’s owners, plus visibility, archived state, and member counts.
Roles	The Teams administration roles (Teams Administrator, Teams Communications Administrator and support roles, Teams Devices Administrator, Teams Telephony Administrator, Teams External Collaboration Administrator, Teams Reader), with user and role-assignable-group assignments.
Teams apps	Apps published to your organization’s catalog or installed in at least one team, as non-human identities - including each app’s resource-specific consent grants (what the app may read or do in the teams it’s installed in).
Activity	Teams events from the Microsoft 365 unified audit log - team and channel lifecycle, membership and role changes, app installs and removals, sign-ins to Teams, admin-center changes, and shared-channel invitations. Message content events are excluded.

Prerequisites

A Microsoft Entra tenant with Microsoft Teams, and permission to create an app registration and grant admin consent (Global Administrator or Privileged Role Administrator).
Your tenant’s Directory (tenant) ID.
Optional, for MFA state and sign-in-based last activity: Microsoft Entra ID P1 or P2 licensing.
Audit activity uses Microsoft Purview Audit (Standard), which is on by default for Microsoft 365 subscriptions and keeps 180 days of Teams events.

Set up the integration

Oleria authenticates app-only (client credentials) - no user account is tied to the connection.

Create an app registration

In the Microsoft Entra admin center, go to Entra ID -> App registrations -> New registration. Name it (for example, Oleria Teams Connector), keep Accounts in this organizational directory only, and select Register. Copy the Application (client) ID and the Directory (tenant) ID from the overview page.

Grant Microsoft Graph application permissions

Under API permissions -> Add a permission -> Microsoft Graph -> Application permissions, add:

Permission	Used for
`User.Read.All`	Users
`Group.Read.All`	Teams enumeration
`Team.ReadBasic.All`	Per-team details (archived state, member counts)
`TeamMember.Read.All`	Team membership
`Organization.Read.All`	Tenant name and validation
`RoleManagement.Read.Directory`	Teams admin roles and assignments
`AppCatalog.Read.All`	Your organization’s Teams app catalog
`TeamsAppInstallation.ReadForTeam.All`	Apps installed in teams and their consent grants
`AuditLogsQuery.Read.All`	Teams audit activity
`Reports.Read.All` (recommended)	Teams usage report — the last-activity fallback when Entra P1 sign-in data is unavailable
`AuditLog.Read.All` (optional)	MFA registration state and sign-in last activity (needs Entra ID P1/P2)
`ReportSettings.Read.All` (optional)	Detects when usage reports conceal user identifiers
`TeamMember.ReadWrite.All` (actions)	Add and remove team members
`TeamsAppInstallation.ReadWriteForTeam.All` (actions)	Disable a Teams app (uninstall it from teams)
`RoleManagement.ReadWrite.Directory` (optional, actions)	Add or remove a user’s Teams admin role. Oleria uses it only for the Teams administration roles listed above, but it lets the app assign any directory role, including Global Administrator, so add it only if you want these actions.
`TeamsAppInstallation.ReadWriteAndConsentForTeam.All` (optional, revert)	Reinstall apps that require resource-specific consent when reverting Disable NHI. It lets the app consent on behalf of every team, a broader grant than the rest of this table. Without it, those teams are reported as not restored.

Then select Grant admin consent for your tenant. Without admin consent, Microsoft issues tokens with no permissions and the connection is refused with a message naming the fix.

You can omit the action permissions for a read-only connection - discovery still works, and the remediation actions show as needing permission.

Create a client secret

Under Certificates & secrets -> New client secret, create a secret and copy its Value immediately (it is shown only once). Track the expiry date - the connection stops when the secret expires.

Connect Microsoft Teams to Oleria

Open the integration

Go to your Oleria workspace, select Integrations -> select Microsoft Teams.

Complete the connection form

Field	Notes
Tenant ID	Required. The Directory (tenant) ID of your Entra tenant. It can’t be changed after the connection is created.
Client ID	Required. The app registration’s Application (client) ID.
Client Secret	Required. The client secret value. Stored in a secret vault - only a reference is kept on the connection.

Complete the connection

Oleria validates the credentials, confirms admin consent was granted, verifies the tenant matches the Tenant ID you entered, and begins the first sync.

Verify the integration

Confirm Microsoft Teams appears on the Connected tab of your Oleria Integrations page. After the first sync completes, review the discovered users, teams, roles, Teams apps, and activity in your Oleria workspace.

Remediation actions

Action	What it does
Add user to team	Adds the user to the team as a member. Revert removes them. Microsoft’s API can’t add guest users app-only, and adding a disabled user is rejected.
Remove user from team	Removes the member from the team. Revert re-adds them with their prior role (an owner is restored as an owner). A removed guest can’t be re-added app-only - the revert reports this instead of silently skipping it.
Add user to role	Assigns one of the Teams administration roles to the user tenant-wide. Revert removes that assignment. Any other directory role is refused.
Remove user from role	Removes the user’s direct assignments of a Teams administration role, including ones scoped to an administrative unit. Revert re-creates each one at its scope. A role held through a role-assignable group is changed by removing the user from that group.
Disable NHI (Teams app)	Uninstalls the Teams app from every team it’s installed in. Revert reinstalls the recorded set; an app that requires resource-specific consent needs the `TeamsAppInstallation.ReadWriteAndConsentForTeam.All` permission to reinstall, and is reported per team otherwise.

Oleria refuses to disable a Teams app backed by the connection’s own app registration, or Oleria’s own Teams notifications bot. Blocking an app tenant-wide has no API - use the Teams admin center (Teams apps -> Manage apps) for a permanent block.

Known limitations

Commercial and GCC tenants only. GCC High, DoD, and 21Vianet tenants use different endpoints and lack the audit search API this integration uses.
MFA state and sign-in last activity need Entra ID P1 or P2 plus the optional AuditLog.Read.All permission. Without them, MFA shows as unavailable and last activity falls back to the Teams usage report (date-level, last 90 days).
Concealed report identifiers (Microsoft 365 admin center -> Reports -> “Display concealed user, group, and site names”) prevent the usage-report fallback from matching users.
User lifecycle belongs to the identity provider. Disabling or enabling the Entra user account is a Microsoft Entra ID integration action, not a Teams action.
Channels are not yet modeled - including private and shared channel membership. Standard channels inherit team membership.
Apps installed only in personal scope or chats are not enumerated (Microsoft provides no tenant-wide listing; per-user and per-chat calls don’t scale).
Audit attribution caveat (Microsoft-documented): membership changes made through Entra ID or the Microsoft 365 admin center are attributed to an existing team owner, not the actual initiator. Oleria carries the recorded principal name on each event.
Old teams may be invisible: Microsoft documents that certain unused old teams lack the group property the tenant-wide teams listing filters on.

Contact us

For questions about this integration, contact us at support@oleria.com.

Overview

Generic connectors

Identity providers

HR systems

Cloud infrastructure

Applications

Ticketing

Messaging

What Oleria discovers

Prerequisites

Set up the integration

Connect Microsoft Teams to Oleria

Verify the integration

Remediation actions

Known limitations

Contact us

​What Oleria discovers

​Prerequisites

​Set up the integration

​Connect Microsoft Teams to Oleria

​Verify the integration

​Remediation actions

​Known limitations

​Contact us

What Oleria discovers

Prerequisites

Set up the integration

Connect Microsoft Teams to Oleria

Verify the integration

Remediation actions

Known limitations

Contact us