Skip to main content
Connect Microsoft Teams to Athena to read channel conversations and chats in chat, summarize threads, and send messages back to Teams — using your own Teams identity, with no bot to install and no personal token to paste.
Athena connects to Teams with a tenant-restricted, per-user OAuth flow against Microsoft Graph. Each channel or chat you connect becomes a catalog you can open in Drive, reference in chat with @, and use with Athena’s tools and agents.

​
What connecting Teams unlocks

  • Read channel threads — list your teams and channels, read messages and their replies.
  • Read chats — list and read your 1:1 and group chats.
  • Send messages — post to a channel or reply in a chat from a session or an agent.
  • Teams toolkit in any session — list_teams_channels, read_teams_channel, send_teams_message, list_teams_chats, read_teams_chat, send_teams_chat_message.
Athena only ever sees the Teams content the signed-in user can already see: tokens are delegated (per user), so Microsoft enforces your existing Teams permissions on every request. Athena requires no application (app-only) Graph permissions and no Teams app or bot manifest. Setup is two steps: an admin registers an Entra ID app once, then each member connects their channels and chats.

​
Step 1 — Register the Entra ID app (admin, once)

Athena uses the customer’s own Entra ID (Azure AD) app registration, so your tenant keeps full control of consent, conditional access, and revocation.
1

Create the app registration

In the Azure Portal, go to App registrations → New registration.
  • Name: e.g. Athena Microsoft Teams
  • Supported account types: Accounts in this organizational directory only (single tenant)
  • Redirect URI: platform Web, value:
2

Add the Microsoft Graph delegated permissions

Under API permissions → Add a permission → Microsoft Graph → Delegated permissions, add every permission below, then click Grant admin consent for <tenant>.
Athena requests the https://graph.microsoft.com/.default scope, so the permissions above must be present on the registration and admin-consented before anyone connects — there is no incremental consent at sign-in time. For a read-only connection, omit ChannelMessage.Send and ChatMessage.Send; everything else still works.
3

Create a client secret

Under Certificates & secrets → New client secret, create a secret and copy its Value immediately (Azure only shows it once).
4

Collect the three values Athena needs

From the app’s Overview page plus the secret you just created:
  • Directory (tenant) ID
  • Application (client) ID
  • Client secret

​
Step 2 — Enable Teams in Athena (admin, once)

This step is done by an Athena workspace admin or owner, and it applies to the entire workspace — the app registration from Step 1 is saved once, centrally, and every member then connects against it. Individual members cannot do this themselves: until an Athena admin completes this step, the Microsoft Teams connect option stays unavailable for everyone in the workspace. This is a separate person from the Entra ID (Azure) administrator in Step 1, though it may be the same person if they hold both roles.
Go to Workspace Settings → Treasury → Integrations and find the Microsoft Teams (Direct OAuth) card.
1

Turn the integration on

Toggle Microsoft Teams on. The connect card only appears on the Integrations page for members while this toggle is on.
2

Fill in the credentials and save

  • Azure AD Tenant ID — restricts sign-in to accounts in your tenant only
  • Client ID
  • Client Secret — stored encrypted at rest; never returned by the API
Click Save Configuration. To rotate the secret later, enter the new value and save again; leave the field empty to keep the existing one.

​
Step 3 — Connect your channels and chats (each member)

Go to Integrations and click Microsoft Teams (Direct OAuth) → Connect Microsoft Teams (Direct).
1

Sign in with Microsoft

A Microsoft sign-in popup opens, restricted to your tenant. Approve the requested access.
2

Pick channels and chats

Athena shows the teams, channels, and chats your account can see. Select the ones you want to connect — each becomes a catalog you can open in Drive, reference with @ in chat, and use with the Teams toolkit and agents.
Use Add Another Channel on the same card to connect more later.
Your tokens are encrypted at rest, are scoped to your own Teams identity, and refresh silently in the background. You can disconnect a channel or chat at any time from the Integrations page, and your Azure admin can revoke the app’s consent tenant-wide at any point.

​
Following new channels and chats automatically

Connecting is a snapshot by default: a channel created — or a DM started — after you connected stays invisible until you pick it. When you choose to follow everything, Athena re-runs discovery every 15 minutes with your existing connection and creates a catalog for each new conversation your account can see, across channels, 1:1 DMs, group chats, and meeting chats. Nothing is deleted automatically: leaving a channel or losing access leaves the catalog in place until you disconnect it. Each conversation stays its own catalog, so it remains individually @-mentionable and disconnectable. When a teammate already follows a channel you both belong to, you share one catalog in Drive — Athena still reads it under each person’s own Teams identity, so Microsoft’s permissions apply per user.

​
Keeping the connection alive

Microsoft sign-in sessions are long-lived but not permanent: they last about 90 days of continued use and end early on a password change or an admin/Conditional Access revocation. Athena refreshes them silently until then. Because Teams conversations have no settings page of their own, the Teams toolkit reports connection health directly in its results: list_teams_channels and list_teams_chats include the estimated expiry, and reads and sends append a reconnect warning once the session is close to expiring or has already ended. The estimate is Athena’s — Microsoft does not publish a session’s exact expiry. To reconnect, go to Integrations → Microsoft Teams (Direct OAuth) → Connect and sign in again. Every channel and chat you already follow is restored, so nothing has to be re-picked.

​
Troubleshooting

  • “Configuration Required” dialog on Connect — the workspace toggle is on but the tenant ID / client ID / secret have not been saved yet. Finish Step 2.
  • Sign-in fails with a tenant error — the account is not in the tenant configured in Step 2, or the app registration is not single-tenant.
  • Sign-in succeeds but no teams or channels are listed — admin consent has not been granted for Team.ReadBasic.All and Channel.ReadBasic.All.
  • Reading a channel fails while listing works — ChannelMessage.Read.All is missing or not admin-consented.
  • Redirect / reply URL mismatch — the app registration must have https://api.athenaintel.com/api/teams-direct/oauth/callback registered under the Web platform.