> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Teams > Connect Microsoft Teams with an Entra ID app registration so Oleria can discover team membership, Teams admin roles, Teams apps, and Teams audit activity. Connect Microsoft Teams to Oleria to see who belongs to each team (including guests and owners), who holds Teams administration roles, which Teams apps are installed and what they can access, and what changed - from the Microsoft 365 unified audit log. A single Oleria connection covers **one Microsoft Entra tenant** - Oleria discovers every user, team, and Teams app in that tenant through Microsoft Graph. > [!NOTE] > > This page covers access governance for Teams. To receive Oleria alerts and notifications in Teams, see [Microsoft Teams messaging](/workspace/teams-messaging.md) - it uses a separate app registration. ## What Oleria discovers | Area | Detail | | :- | :- | | **Users** | Every tenant user, with guests marked as external. MFA registration state comes from Entra's registration report (needs Entra ID P1 or P2); last activity comes from the tenant sign-in record (Entra ID P1), falling back to the Teams usage report. | | **Teams** | Every team, with owner and guest capacities carried on each membership and owners recorded as each team's owners, plus visibility, archived state, and member counts. | | **Roles** | The Teams administration roles (Teams Administrator, Teams Communications Administrator and support roles, Teams Devices Administrator, Teams Telephony Administrator, Teams External Collaboration Administrator, Teams Reader), with user and role-assignable-group assignments. | | **Teams apps** | Apps published to your organization's catalog or installed in at least one team, as non-human identities - including each app's resource-specific consent grants (what the app may read or do in the teams it's installed in). | | **Activity** | Teams events from the Microsoft 365 unified audit log - team and channel lifecycle, membership and role changes, app installs and removals, sign-ins to Teams, admin-center changes, and shared-channel invitations. Message content events are excluded. | ## Prerequisites * A Microsoft Entra tenant with Microsoft Teams, and permission to create an **app registration** and grant **admin consent** (Global Administrator or Privileged Role Administrator). * Your tenant's **Directory (tenant) ID**. * Optional, for MFA state and sign-in-based last activity: **Microsoft Entra ID P1 or P2** licensing. * Audit activity uses Microsoft Purview **Audit (Standard)**, which is on by default for Microsoft 365 subscriptions and keeps 180 days of Teams events. ## Set up the integration Oleria authenticates app-only (client credentials) - no user account is tied to the connection. **1. Create an app registration** In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** -> **App registrations** -> **New registration**. Name it (for example, `Oleria Teams Connector`), keep **Accounts in this organizational directory only**, and select **Register**. Copy the **Application (client) ID** and the **Directory (tenant) ID** from the overview page. **2. Grant Microsoft Graph application permissions** Under **API permissions** -> **Add a permission** -> **Microsoft Graph** -> **Application permissions**, add: | Permission | Used for | | :- | :- | | `User.Read.All` | Users | | `Group.Read.All` | Teams enumeration | | `Team.ReadBasic.All` | Per-team details (archived state, member counts) | | `TeamMember.Read.All` | Team membership | | `Organization.Read.All` | Tenant name and validation | | `RoleManagement.Read.Directory` | Teams admin roles and assignments | | `AppCatalog.Read.All` | Your organization's Teams app catalog | | `TeamsAppInstallation.ReadForTeam.All` | Apps installed in teams and their consent grants | | `AuditLogsQuery.Read.All` | Teams audit activity | | `Reports.Read.All` (recommended) | Teams usage report — the last-activity fallback when Entra P1 sign-in data is unavailable | | `AuditLog.Read.All` (optional) | MFA registration state and sign-in last activity (needs Entra ID P1/P2) | | `ReportSettings.Read.All` (optional) | Detects when usage reports conceal user identifiers | | `TeamMember.ReadWrite.All` (actions) | Add and remove team members | | `TeamsAppInstallation.ReadWriteForTeam.All` (actions) | Disable a Teams app (uninstall it from teams) | | `RoleManagement.ReadWrite.Directory` (optional, actions) | Add or remove a user's Teams admin role. Oleria uses it only for the Teams administration roles listed above, but it lets the app assign any directory role, including Global Administrator, so add it only if you want these actions. | | `TeamsAppInstallation.ReadWriteAndConsentForTeam.All` (optional, revert) | Reinstall apps that require resource-specific consent when reverting **Disable NHI**. It lets the app consent on behalf of every team, a broader grant than the rest of this table. Without it, those teams are reported as not restored. | Then select **Grant admin consent** for your tenant. Without admin consent, Microsoft issues tokens with no permissions and the connection is refused with a message naming the fix. > [!NOTE] > > You can omit the action permissions for a read-only connection - discovery still works, and the remediation actions show as needing permission. **3. Create a client secret** Under **Certificates & secrets** -> **New client secret**, create a secret and copy its **Value** immediately (it is shown only once). Track the expiry date - the connection stops when the secret expires. ## Connect Microsoft Teams to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **Microsoft Teams**. **2. Complete the connection form** | Field | Notes | | :- | :- | | **Tenant ID** | Required. The Directory (tenant) ID of your Entra tenant. It can't be changed after the connection is created. | | **Client ID** | Required. The app registration's Application (client) ID. | | **Client Secret** | Required. The client secret value. Stored in a secret vault - only a reference is kept on the connection. | **3. Complete the connection** Oleria validates the credentials, confirms admin consent was granted, verifies the tenant matches the Tenant ID you entered, and begins the first sync. ## Verify the integration Confirm Microsoft Teams appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, review the discovered users, teams, roles, Teams apps, and activity in your Oleria workspace. ## Remediation actions | Action | What it does | | :- | :- | | **Add user to team** | Adds the user to the team as a member. Revert removes them. Microsoft's API can't add guest users app-only, and adding a disabled user is rejected. | | **Remove user from team** | Removes the member from the team. Revert re-adds them with their prior role (an owner is restored as an owner). A removed **guest** can't be re-added app-only - the revert reports this instead of silently skipping it. | | **Add user to role** | Assigns one of the Teams administration roles to the user tenant-wide. Revert removes that assignment. Any other directory role is refused. | | **Remove user from role** | Removes the user's direct assignments of a Teams administration role, including ones scoped to an administrative unit. Revert re-creates each one at its scope. A role held through a role-assignable group is changed by removing the user from that group. | | **Disable NHI (Teams app)** | Uninstalls the Teams app from every team it's installed in. Revert reinstalls the recorded set; an app that requires resource-specific consent needs the `TeamsAppInstallation.ReadWriteAndConsentForTeam.All` permission to reinstall, and is reported per team otherwise. | > [!NOTE] > > Oleria refuses to disable a Teams app backed by the connection's own app registration, or Oleria's own Teams notifications bot. Blocking an app tenant-wide has no API - use the Teams admin center (**Teams apps** -> **Manage apps**) for a permanent block. ## Known limitations * **Commercial and GCC tenants only.** GCC High, DoD, and 21Vianet tenants use different endpoints and lack the audit search API this integration uses. * **MFA state and sign-in last activity need Entra ID P1 or P2** plus the optional `AuditLog.Read.All` permission. Without them, MFA shows as unavailable and last activity falls back to the Teams usage report (date-level, last 90 days). * **Concealed report identifiers** (Microsoft 365 admin center -> **Reports** -> "Display concealed user, group, and site names") prevent the usage-report fallback from matching users. * **User lifecycle belongs to the identity provider.** Disabling or enabling the Entra user account is a Microsoft Entra ID integration action, not a Teams action. * **Channels are not yet modeled** - including private and shared channel membership. Standard channels inherit team membership. * **Apps installed only in personal scope or chats** are not enumerated (Microsoft provides no tenant-wide listing; per-user and per-chat calls don't scale). * **Audit attribution caveat (Microsoft-documented):** membership changes made through Entra ID or the Microsoft 365 admin center are attributed to an existing team owner, not the actual initiator. Oleria carries the recorded principal name on each event. * **Old teams may be invisible:** Microsoft documents that certain unused old teams lack the group property the tenant-wide teams listing filters on. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.