Microsoft Graph API permissions
The Atlan Teams integration uses Microsoft Graph API delegated permissions to authenticate on behalf of users and interact with Microsoft Teams. All permissions are user-delegated—no application-level (app-only) permissions are requested.
This page lists every permission the integration requests, identifies which require admin consent, and documents what's not requested. Use this as a reference when completing security review questionnaires or evaluating the integration's access surface before connecting.
All delegated permissions
The following delegated permissions are requested during the OAuth authorization flow.
The integration manifest may include one additional permission beyond those listed below. This page is updated once the complete permission set is confirmed by engineering.
| Permission | Admin consent required | Purpose |
|---|---|---|
User.Read | No | Lets users sign in to the integration and lets the integration read their basic profile (display name, email). Required for user identity during the authorization flow. |
offline_access | No | Lets the integration maintain access on behalf of the user when they're not actively using the app, by requesting refresh tokens. Required for background notification delivery. |
AppCatalog.Submit | No | Lets the signed-in user submit the Atlan Assistant app package to your organization's Teams app catalog for admin review and approval. Used during the non-admin setup path. |
TeamsAppInstallation.ReadWriteSelfForUser | No | Lets the integration read, install, upgrade, and uninstall the Atlan Assistant app for the signed-in user. Required for user-level app management and personal notification setup. |
AppCatalog.ReadWrite.All | Yes | Lets the integration create, read, update, and delete apps in your organization's Teams app catalog. Required when an admin publishes the Atlan Assistant app directly, bypassing the submission-and-review step. |
ChannelSettings.Read.All | Yes | Lets the integration read the settings (name, description, membership mode) of all channels in your organization's teams. Required for identifying and routing notifications to the correct channels. |
ChannelMessage.Read.All | Yes | Lets the integration read messages in all channels across your organization's teams on behalf of the signed-in user. Required when using features that surface Teams thread links in Atlan assets. |
Group.Read.All | Yes | Lets the integration read all groups in your organization, including Microsoft 365 groups that correspond to Teams. Required for resolving team membership and routing tenant-scoped notifications. |
Permissions requiring admin consent
Four of these delegated permissions require an Azure AD admin (Global Administrator or Privileged Role Administrator) to grant consent on behalf of the organization before the integration can use them.
Admin consent is required when a permission grants access to data across your entire organization—not just the data of the signed-in user. Microsoft enforces this distinction to prevent individual users from unilaterally authorizing broad organizational access.
AppCatalog.ReadWrite.All: Writes to the app catalog affect every Teams user in the organization. Admin consent ensures an authorized person controls what apps are published.
ChannelSettings.Read.All: Reading channel settings across all teams exposes organizational structure. Admin consent ensures this access is intentional and governed.
ChannelMessage.Read.All: Reading channel messages across the organization is a high-privilege operation. Admin consent is required because it grants access to content the signed-in user may not own.
Group.Read.All: Reading all groups exposes the organizational membership graph. Admin consent ensures this is approved at the organizational level.
If your Azure AD tenant has the admin consent workflow enabled, users who connect the integration are prompted to submit a consent request. An admin must approve it from the Microsoft Entra admin center before the integration becomes active.
What is not requested
The following permissions aren't requested by the Atlan Teams integration. These are commonly asked about in security reviews.
| Permission | Not requested because |
|---|---|
Files.ReadWrite.All | The integration doesn't read, write, or modify files in Teams, SharePoint, or OneDrive. |
Directory.Read.All | The integration doesn't require full directory access. Group.Read.All and User.Read are sufficient for the integration's needs. |
SharePoint.* (any SharePoint permission) | The integration has no SharePoint dependency. It operates entirely through the Teams channel and Bot Framework surfaces. |
The integration also doesn't request any Microsoft Graph application permissions (app-only access). Every scope is delegated, meaning the integration can only act within the bounds of the signed-in user's own access, subject to admin consent for the four organizational-scope permissions listed earlier.
Reduced-scope non-admin path
If the person setting up the integration doesn't have Azure AD admin access (and therefore can't grant the four admin-consent permissions), the integration supports a reduced-scope connection using only four permissions:
| Permission | Purpose in non-admin path |
|---|---|
User.Read | User sign-in and identity |
offline_access | Refresh tokens for background access |
AppCatalog.Submit | Submit the Atlan Assistant app for admin review |
TeamsAppInstallation.ReadWriteSelfForUser | Install and manage the app for the signed-in user |
In this path, the user submits the Atlan Assistant app for admin review rather than publishing it directly. The Teams administrator then reviews and approves the app in the Microsoft Teams Admin Center.
Notification routing to channels, reading channel settings, and team-scoped features require the four admin-consent permissions and are unavailable until an admin grants consent.
For step-by-step setup instructions for both paths, see Set up Teams marketplace app.
Security posture
Delegated only: All permissions are delegated. The integration acts on behalf of a signed-in user, not as an autonomous service. No application-level (app-only) permissions are used.
No SharePoint or OneDrive access: The integration doesn't request any SharePoint or OneDrive permission scopes. Files shared in Teams channels aren't accessible to or ingested by Atlan.
Minimal data retained: The integration stores only the configuration data required to deliver notifications: the Teams channel identifiers you configure and the authentication tokens needed to post to those channels. No conversation content, message history, or user lists are stored in Atlan. For details, see What data does Atlan store with the Microsoft Teams integration?
Scoped to your tenant: The integration uses a multi-tenant architecture where each Atlan tenant's credentials and channel mappings are isolated. The integration service routes events to the correct tenant backend and doesn't share credentials across tenants.