> ## Documentation Index
> Fetch the complete documentation index at: https://resources.athenaintel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Teams

Connect Microsoft Teams to Athena to read channel conversations and chats in
chat, summarize threads, and send messages back to Teams — using your own Teams
identity, with no bot to install and no personal token to paste.

<Info>
  Athena connects to Teams with a tenant-restricted, per-user OAuth flow against
  Microsoft Graph. Each channel or chat you connect becomes a catalog you can
  open in Drive, reference in chat with `@`, and use with Athena's tools and
  agents.
</Info>

## What connecting Teams unlocks

* **Read channel threads** — list your teams and channels, read messages and
  their replies.
* **Read chats** — list and read your 1:1 and group chats.
* **Send messages** — post to a channel or reply in a chat from a session or an
  agent.
* **Teams toolkit** in any session — `list_teams_channels`,
  `read_teams_channel`, `send_teams_message`, `list_teams_chats`,
  `read_teams_chat`, `send_teams_chat_message`.

Athena only ever sees the Teams content the signed-in user can already see:
tokens are **delegated** (per user), so Microsoft enforces your existing Teams
permissions on every request. Athena requires no application (app-only) Graph
permissions and no Teams app or bot manifest.

Setup is two steps: an admin **registers an Entra ID app once**, then each
member **connects their channels and chats**.

## Step 1 — Register the Entra ID app (admin, once)

Athena uses the customer's own Entra ID (Azure AD) app registration, so your
tenant keeps full control of consent, conditional access, and revocation.

<Steps>
  <Step title="Create the app registration">
    In the [Azure Portal](https://portal.azure.com), go to **App registrations →
    New registration**.

    * **Name**: e.g. `Athena Microsoft Teams`
    * **Supported account types**: *Accounts in this organizational directory
      only* (single tenant)
    * **Redirect URI**: platform **Web**, value:

    ```
    https://api.athenaintel.com/api/teams-direct/oauth/callback
    ```
  </Step>

  <Step title="Add the Microsoft Graph delegated permissions">
    Under **API permissions → Add a permission → Microsoft Graph → Delegated
    permissions**, add every permission below, then click **Grant admin consent
    for \<tenant>**.

    | Permission                | Admin consent | What Athena uses it for                                             |
    | ------------------------- | ------------- | ------------------------------------------------------------------- |
    | `offline_access`          | No            | Refresh tokens, so a connection outlives the \~1 hour access token  |
    | `openid`                  | No            | ID token for the sign-in handshake                                  |
    | `profile`                 | No            | Labels the connection with the signed-in account                    |
    | `email`                   | No            | Supplies the `email` claim used to label the connection             |
    | `Team.ReadBasic.All`      | Yes           | `GET /me/joinedTeams` — lists your teams in the connect picker      |
    | `Channel.ReadBasic.All`   | Yes           | `GET /teams/{team}/channels` — lists channels in the connect picker |
    | `ChannelMessage.Read.All` | Yes           | Reads channel messages and their replies                            |
    | `ChannelMessage.Send`     | No            | Posts a message to a channel                                        |
    | `Chat.Read`               | Yes           | Lists your chats and reads chat messages                            |
    | `ChatMessage.Send`        | No            | Sends a message in a chat                                           |

    <Note>
      Athena requests the `https://graph.microsoft.com/.default` scope, so the
      permissions above must be present on the registration **and** admin-consented
      before anyone connects — there is no incremental consent at sign-in time.
      For a read-only connection, omit `ChannelMessage.Send` and
      `ChatMessage.Send`; everything else still works.
    </Note>
  </Step>

  <Step title="Create a client secret">
    Under **Certificates & secrets → New client secret**, create a secret and
    copy its **Value** immediately (Azure only shows it once).
  </Step>

  <Step title="Collect the three values Athena needs">
    From the app's **Overview** page plus the secret you just created:

    * **Directory (tenant) ID**
    * **Application (client) ID**
    * **Client secret**
  </Step>
</Steps>

## Step 2 — Enable Teams in Athena (admin, once)

<Info>
  This step is done by an **Athena workspace admin or owner**, and it applies to
  the **entire workspace** — the app registration from Step 1 is saved once,
  centrally, and every member then connects against it. Individual members
  cannot do this themselves: until an Athena admin completes this step, the
  Microsoft Teams connect option stays unavailable for everyone in the
  workspace. This is a separate person from the Entra ID (Azure) administrator
  in Step 1, though it may be the same person if they hold both roles.
</Info>

Go to **[Workspace Settings → Treasury → Integrations](https://app.athenaintel.com/dashboard/workspace-settings/treasury/?tab=integrations)**
and find the **Microsoft Teams (Direct OAuth)** card.

<Steps>
  <Step title="Turn the integration on">
    Toggle **Microsoft Teams** on. The connect card only appears on the
    Integrations page for members while this toggle is on.
  </Step>

  <Step title="Fill in the credentials and save">
    * **Azure AD Tenant ID** — restricts sign-in to accounts in your tenant only
    * **Client ID**
    * **Client Secret** — stored encrypted at rest; never returned by the API

    Click **Save Configuration**. To rotate the secret later, enter the new
    value and save again; leave the field empty to keep the existing one.
  </Step>
</Steps>

## Step 3 — Connect your channels and chats (each member)

Go to **[Integrations](https://app.athenaintel.com/dashboard/integrations/)** and
click **Microsoft Teams (Direct OAuth) → Connect Microsoft Teams (Direct)**.

<Steps>
  <Step title="Sign in with Microsoft">
    A Microsoft sign-in popup opens, restricted to your tenant. Approve the
    requested access.
  </Step>

  <Step title="Pick channels and chats">
    Athena shows the teams, channels, and chats your account can see. Select the
    ones you want to connect — each becomes a catalog you can open in Drive,
    reference with `@` in chat, and use with the Teams toolkit and agents.
  </Step>
</Steps>

Use **Add Another Channel** on the same card to connect more later.

<Tip>
  Your tokens are encrypted at rest, are scoped to your own Teams identity, and
  refresh silently in the background. You can disconnect a channel or chat at any
  time from the Integrations page, and your Azure admin can revoke the app's
  consent tenant-wide at any point.
</Tip>

## Troubleshooting

* **"Configuration Required" dialog on Connect** — the workspace toggle is on but
  the tenant ID / client ID / secret have not been saved yet. Finish Step 2.
* **Sign-in fails with a tenant error** — the account is not in the tenant
  configured in Step 2, or the app registration is not single-tenant.
* **Sign-in succeeds but no teams or channels are listed** — admin consent has
  not been granted for `Team.ReadBasic.All` and `Channel.ReadBasic.All`.
* **Reading a channel fails while listing works** — `ChannelMessage.Read.All` is
  missing or not admin-consented.
* **Redirect / reply URL mismatch** — the app registration must have
  `https://api.athenaintel.com/api/teams-direct/oauth/callback` registered under
  the **Web** platform.