Application Configuration in Azure Portal for OAuth2 Account to use in Teams

1 Overview
2 Prerequisites
3 Key Steps in the Workflow
4 Troubleshooting
5 Frequently Asked Questions

Overview

The Snaps in the Microsoft Teams Snap Pack require an OAuth2 account to access the resources in Azure. For the OAuth2 account to authorize successfully, create, and configure an application corresponding to the account as shown in the workflow.

You must complete steps one to three in the Azure Portal and the remaining steps in the Snap account (SnapLogic®Platform).

Prerequisites

An Azure account with a free subscription to create the application.

Key Steps in the Workflow

Create an Application in the Azure Portal

Log in to the Microsoft Azure Portal.
Navigate to Azure services > Microsoft Entra ID.
Navigate to Add > App registration.
On the Register an application page, specify the name for registering the application and click Register. Learn more about creating an application at Quickstart: Register an app in the Microsoft identity platform - Microsoft identity platform.

To use an existing application, navigate to Portal Home > Azure Active Directory > App registrations > All applications. In the search box, specify the application name you want to use. Details on registered application is display in the search list.

Define Permissions

The Teams Online Snap Pack supports the following three types of accounts:

The permissions for the registered application are either Delegated or Application permissions based on the account types. Select Delegated permissions for OAuth2 User Accounts and Application permission for OAuth2 Application Accounts.

On the left navigation panel, navigate to Manage, select API permissions > Add a permission.
On the Request API permissions window, select Microsoft Graph > Delegated permissions for the OAuth2 User account and Application permissions for the OAuth2 Application Account.
Select the required permissions from Files, Users, and Teams. Choose the minimum API permissions listed under Scopes and Permissions Required for Teams.
Click Add Permissions. View all the permissions added under Configured permissions.
Click Grant admin consent confirmation and select Yes.
In the navigation panel, click Overview and select Add a Redirect URI. You will be redirected to the Platform configurations page.
1. Under Platform configurations, click Add a platform.
  
  The Configure platforms window displays.
2. Select Web and specify the Redirect URI in the following format:
  https://<control-plane-name>.snaplogic.com/api/1/rest/admin/oauth2callback/<snap-pack-name>
  where the <control-plane-name> corresponds to the domain part of your SnapLogic URL—elastic (global control plane) or emea (EMEA control plane).
  For example:
  https://emea.snaplogic.com/api/1/rest/admin/oauth2callback/teams
  https://elastic.snaplogic.com/api/1/rest/admin/oauth2callback/teams
3. Select Web and specify either of the following Redirect URIs based on the region your server is located:
4. Click Configure. A popup message displays indicating that the application is successfully updated.
On the Platform configurations page, click Save.

Locate the Application Credentials in the Azure Portal

To authorize your account in SnapLogic, you must have the following application credentials:

Application (Client) ID
Directory (Tenant) ID
Client secret value

On the application page, navigate to Overview.
Under Essentials, note the Application (client) ID and Directory (tenant) ID needed for the Snap account.
In the navigation panel, select Manage > Certificates & secrets.
On the Certificates & secrets page, click + New client secret.
In the Add a client secret window, enter the Description, select an option for Expires from the dropdown list, and click Add.
The Client value and Secret ID are generated. This value and ID are required to configure the OAuth2 account.

You can copy the Client secret value only after it is generated. Note that this value is displayed only once, so ensure to copy it securely.

Scopes and Permissions Required for Teams API

Microsoft Teams exposes a few granular permissions that control the access that apps have to resources. When users sign into your app, they are required to consent to these permissions.

Delegated permissions (work or school account only*)

Delegated permissions (work or school account only*)
Permission	Display String	Description	Admin Consent Required?
Channel.Create	Create channels	Create channels in any team, on behalf of the signed-in user.	Yes
ChannelMember.ReadWrite.All	Add and remove members from channels.	Add and remove members from channels, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.	Yes
ChannelMessage.Send	Send channel messages	Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user.	No
ChannelSettings.ReadWrite.All	Read and write the names, descriptions, and settings of channels.	Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.	No
ChannelSettings.ReadWrite.Group	Update the names, descriptions, and settings of this team’s channels.	Update this group's channel names, channel descriptions, and channel settings, without a signed-in user.	No
Directory.AccessAsUser.All	Access directory as the signed-in user	Allows the app to have the same access to information in the directory as the signed-in user.	Yes
Directory.ReadWrite.All	Read and write directory data	Allows the app to read and write data in your organization's directory, such as users, and groups. It does not allow the app to delete users or groups, or reset user passwords.	Yes
Group.ReadWrite.All	Read and write all groups	Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user. Also allows the app to read and write calendar, conversations, files, and other group content for all groups the signed-in user can access. Additionally allows group owners to manage their groups and allows group members to update group content.	Yes
GroupMember.ReadWrite.All	Read and write group memberships	Allows the app to read and write group memberships.	No
TeamMember.ReadWrite.All	Add and remove members from teams.	Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.	Yes
TeamSettings.ReadWrite.All	Read and change teams' settings	Read and change all teams' settings, on behalf of the signed-in user.	Yes
User.Read.All	Read all users' full profiles	Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.	Yes
Application permissions
Permission	Display String	Description	Admin Consent Required?
Channel.Create	Create channels.	Create channels in any team, without a signed-in user.	Yes
Channel.Create.Group	Create channels in this team.	Create channels in this group, without a signed-in user.	No
ChannelMember.ReadWrite.All	Add and remove members from all channels.	Add and remove members from all channels, without a signed-in user. Also allows changing a member's role, for example from owner to non-owner.	Yes
Directory.ReadWrite.All	Read and write directory data	Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user. Does not allow user or group deletion.	Yes
Group.ReadWrite.All	Read and write all groups	Allows the app to create groups, read and update group memberships, and delete groups. Also allows the app to read and write calendar, conversations, files, and other group content for all groups. All of these operations can be performed by the app without a signed-in user.	Yes
GroupMember.ReadWrite.All	Read and write group memberships	Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.	Yes
TeamMember.ReadWrite.All	Add and remove members from all teams.	Add and remove members from all teams, without a signed-in user. Also allows changing a team member's role, for example from owner to non-owner.	Yes
TeamSettings.ReadWrite.All	Read and change teams' settings	Read and change all teams' settings, without a signed-in user.	Yes
TeamSettings.ReadWrite.Group	Update the settings for this team.	Read and write this team's settings, without a signed-in user.	No
Teamwork.Migrate.All	Manage migration to Microsoft Teams	Creating and managing resources for migration to Microsoft Teams	Yes
User.Read.All	Read all users' full profiles	Allows the app to read the full set of profile properties, group membership, reports and managers of other users in your organization, without a signed-in user.	Yes

* Personal Microsoft accounts are not supported.

Specify the Credentials And Validate the Snap account

Navigate to the Snap of your choice and configure the OAuth2 account with the details from the Azure portal's registered application. Refer to Teams Dynamic OAuth2 Account, Teams OAuth2 Application Account, or Teams OAuth2 User Account for further account configuration.
Select the Auto-refresh token checkbox in the account settings and click Apply.
Click Authorize. The Access and Refresh tokens are generated. You will be redirected to the sign-in page of the Azure Portal.
Sign in to Azure Portal with valid credentials to redirect to the Snap Edit account settings dialog. The Access and Refresh tokens are autopopulated but encrypted in the Account settings.
Validate the Snap Account.

Troubleshooting

Common Errors	Reason	Response

Common Errors

Reason

Response

Error 401

Token is invalid

Provide a valid token and reauthorize the account.

The redirect URI specified does not match the reply URI configured for the application.

Incorrect redirect URI specified by user.

Add the following redirect_uri:
https://elastic.snaplogic.com/api/1/rest/admin/oauth2callback/teams

URL error when invoking the operation

Ensure the tenant domain name is correct.

Ensure that Directory (tenant) ID noted from the application is in the correct format.

Example: 2060aafa-89d9-423d-9514-eac46338ec05

Frequently Asked Questions

Yes, you can register a new application or use an existing application in the Azure portal to create an OAuth account. Refer to the configuration documentation key flow: Create an Application in the Azure Portal. Learn more at Quickstart: Register an app in the Microsoft identity platform - Microsoft Entra

In our configuration documentation, the key workflow Locate application credentials in the Azure Portal highlights the values of Application ID, Client ID, and Secret key. For more information, refer to Teams OAuth2 Application Account.

For any support, contact the support team. The help icon in the Snap would provide referential information with the selected Snap from the application.

The Scopes and Permissions Required for the Teams in this document specify the Delegated and Application permissions details. For any other permissions that are needed for the application, refer to Microsoft Graph permissions reference - Microsoft Graph

For information on the account and supported account types in Teams Online Snap Pack, refer to Account types for Teams Online Snap Pack.

Related Content