Grant permissions for Teams archive
Introduction
The Grant permissions for Teams archive page describes how to configure the API permissions required for the Teams archive job, enabling contentACCESS to authenticate and connect to the Microsoft Dataverse environment using a modern and more secure authentication method.
This page explains how to:
- add and configure the required Microsoft Graph and SharePoint API permissions;
- choose between delegated access and application access;
- grant admin consent for the assigned permissions;
- assign a client access certificate and create a client secret for the registered application.
Add API permissions
Navigate to your registered application (Azure Active Directory → App registration → Owned applications → registered application [Test_app in our example] → open the application by clicking on its title). On the application details page, click the API permissions button on the left menu. When the configured permissions page loads, click the + Add permission button and select the requested API.
On the Request API permissions → Microsoft APIs tab, you need permissions from the Microsoft Graph and SharePoint options. For the Teams archive, some permissions must be selected from the Delegated option, and some from the Application option. The required permission set depends on the Teams archive configuration in contentACCESS that you intend to use.
You can use delegated access or application access:
- With delegated access, contentACCESS connects to and accesses the Teams data in the name of a superuser. This superuser must have owner access to every team you want to archive.
- With application access, contentACCESS connects to Microsoft Teams using a configured application. This application must NOT have owner access to any of the Teams, but you need to request access to the Microsoft Protected API. For more information about how to request access to the Microsoft Protected API, see the How to request access to Microsoft Protected API subsection, or follow the guideline here. The request is usually accepted within a day or two. Application access is the recommended approach.
If you do not know at this point which approach fits your needs best, add both permission sets to the application. You can decide later, during the archive configuration, which option to use.
Microsoft Graph permissions
Select the Microsoft Graph option from the list, then choose the required Application and Delegated permissions from the categories below.
From the Delegated permissions category, locate the following permissions, then click the Add permissions button:
- ChannelMessage.Read.All – Read user channel messages
- Directory.Read.All – Read directory data
- Group.ReadWrite.All – Read and write all groups
- GroupMember.Read.All – Read all group memberships
- TeamsTab.Read.All – Read tabs in Microsoft Teams
- TeamworkTag.ReadWrite – Read and write tags in Teams
- User.Read – Sign in and read user profile
From the Application permissions category, locate the following permissions, then click the Add permissions button:
- ChannelMessage.Read.All – Read all channel messages
- Directory.Read.All – Read directory data
- Group.ReadWrite.All – Read and write all groups
- GroupMember.Read.All – Read all group memberships
- TeamsTab.Read.All – Read tabs in Microsoft Teams
- TeamsTab.ReadWrite.All – Read and write tabs in Microsoft Teams
- Teamwork.Migrate.All – Creating and managing resources for migration to Microsoft Teams
- TeamworkTag.Read.All – Read tags in Teams
SharePoint permissions
From the SharePoint option, the following Delegated and Application permissions are required:
Delegated permissions
- Sites.FullControl.All – Have full control of all site collections
- Sites.Manage.All – Read and write items and lists in all site collections
- Sites.ReadWrite.All – Read and write items in all site collections
- TermStore.ReadWrite.All – Read and write managed metadata
- User.ReadWrite.All – Read and write user profiles
Application permissions
- Sites.FullControl.All – Have full control of all site collections
- Sites.Manage.All – Read and write items and lists in all site collections
- Sites.ReadWrite.All – Read and write items in all site collections
- TermStore.ReadWrite.All – Read and write managed metadata
- User.ReadWrite.All – Read and write user profiles
Click Add permissions.
Example: Locate the permissions from the category and assign them to the application.
Enable delegated access
For delegated access, the following option must be enabled:
Note: In case of delegated access, some restrictions apply (throttling, recovering mentions, archiving private channels, etc., are not supported). Delegated access is not recommended for production usage.
Grant admin consent
After the permissions have been assigned to the application, the administrator must grant consent for these permissions. Click the Grant admin consent for "TENANTNAME" button.
Assign a client access certificate
When the permissions are assigned to the application and admin consent is granted, a client access certificate needs to be assigned to the application.
Note: If you have already configured the permissions for the SharePoint archive and assigned the client access certificate to the application, this step can be skipped for the Teams archive. If you are registering the app for the first time on the Azure portal (and starting with the Teams archive), you will need this step. The same applies to the creation of a client secret (next step).
Click Certificates & secrets in the left side menu. On the certificate management screen, click the Upload certificate button (Certificates tab). Browse to the client certificate you want to use and upload it. It can be a self-signed certificate or an already existing one. A PowerShell script for creating a self-signed certificate can be downloaded here.
Create a client secret
Add a new client secret by clicking the + New client secret button. This is necessary for some jobs and client applications (Test_client secret in our example).
After the configuration is done, copy the client secret shown on the Get client secret dialog box to a secure location so that you can refer to it later. The client secret will be required when configuring certain contentACCESS jobs with modern authentication, such as Email archive, SharePoint archive, Teams archive, GDPR Exchange, and Exchange connection.
Important: The App registration uses a client secret that has a limited lifetime (usually 1 year). It is important to maintain this information: every year, a new client secret needs to be generated for the App registration. The updated client secret must be applied in all affected contentACCESS configurations.