Microsoft Teams App Permissions
Thread’s Microsoft Teams integrations use two connected applications to provide seamless collaboration between Teams and Thread Inbox: the Service App and the Companion App.
- Service App → Installed in your clients’ Teams environment, this app allows end-users to chat directly with your service team, submit tickets, and collaborate within Teams. It powers the client-side communication experience between Microsoft Teams and Thread Inbox.
- Companion App → Installed in your internal Teams environment, this app gives your technicians and service staff the ability to receive notifications, reply to messages, update tickets, and manage workflows directly from Teams. It connects your internal operations with client-side interactions.
Each permission listed below is required to ensure secure authentication, file sharing, and message delivery between Microsoft Teams and Thread. All permissions are requested through Microsoft Graph, using the least privilege necessary for functionality.
🔐 Permissions Overview
Permission | Type | Purpose | Used By |
AppCatalog.Read.All | Application | Identifies if the Thread Service App is already installed in the organization’s Teams App Catalog. | Service App |
AppCatalog.ReadWrite.All | Delegated | Uploads or updates Thread apps in the Teams catalog and migrates older versions by name. | Service App |
Channel.Create | Application | Creates channels for dynamic or automated workflows (e.g., per-ticket or per-client flows). | Companion App |
Channel.Delete.All | Application | Deletes temporary or dynamic channels automatically when a Thread is closed. | Companion App |
Channel.ReadBasic.All | Application | Enables Thread to manage dynamic channels created for tickets or workflows. | Companion App |
Chat.Create | Application | Creates group chats between members, contacts, or automation processes. | Service App |
Chat.ReadWrite.All | Application | Sends and updates messages within Teams group chats. | Service App |
ChatMember.ReadWrite.All | Application | Adds or removes Microsoft 365 users from group chats as needed. | Service App |
ChatMessage.Read.All | Application | Reads chat messages to detect file attachments (required because Teams does not include this data in its onMessage event). | Service App |
Domain.Read.All | Application | Reads domain information to assign a default domain to dummy users (used for iOS compatibility, as Teams mobile requires at least two chat members). | Service App |
Delegated | Reads the user’s primary email address for identity and account linking. | Companion App, Service App | |
Files.Read.All | Application | Reads Microsoft 365 files to enable file sharing between Teams chats and Thread Inbox/PSA tickets. | Service App |
Group.Read.All | Application | Enables Single Sign-On (SSO) between Microsoft Teams and Thread Inbox. | Companion App |
offline_access | Delegated | Maintains continuous access to approved data without requiring re-authentication. | Companion App, Service App |
openid | Delegated | Allows users to sign in with Microsoft 365 accounts and share basic profile information. | Companion App, Service App |
Organization.Read.All | Application, Delegated | Retrieves organization and tenant details during onboarding (delegated during setup, application thereafter). | Companion App, Service App |
profile | Delegated | Accesses basic profile data (name, picture, username, email). | Companion App, Service App |
Sites.Read.All | Application | Downloads files from SharePoint for file sharing between Teams and Thread Inbox/PSA. | Service App |
Team.ReadBasic.All | Application | Fetches Teams lists from Microsoft 365 to display in Thread Flows (future functionality). | Companion App |
TeamsAppInstallation.ReadWriteAndConsentForChat | Application | Installs Thread Service Apps into Teams group chats automatically. | Service App |
User.Read | Delegated | Required for SSO authentication. | Companion App, Service App |
User.Read.All | Delegated | Retrieves user details and avatars for authentication and display. | Companion App, Service App |
User.ReadWrite.All | Application | Creates dummy members for group chats when needed. | Service App |
