Teams MCP - Permissions — Unique AI Documentation
Teams MCP - Permissions
All permissions are Delegated (not Application), meaning they act on behalf of the signed-in user and can only access data that user has access to.
Permission Summary
| Permission |
Type |
ID |
Admin Consent |
Required |
User.Read |
Delegated |
`` |
No |
Yes |
Calendars.Read |
Delegated |
`` |
No |
Yes |
OnlineMeetings.Read |
Delegated |
`` |
No |
Yes |
OnlineMeetingRecording.Read.All |
Delegated |
`` |
Yes |
Yes |
OnlineMeetingTranscript.Read.All |
Delegated |
`` |
Yes |
Yes |
offline_access |
Delegated |
`` |
No |
Yes |
ChannelMessage.Send |
Delegated |
`` |
No |
Yes |
ChatMessage.Send |
Delegated |
`` |
No |
Yes |
Chat.ReadBasic |
Delegated |
`` |
No |
Yes |
Chat.Read |
Delegated |
`` |
No |
Yes |
Team.ReadBasic.All |
Delegated |
`` |
No |
Yes |
Channel.ReadBasic.All |
Delegated |
`` |
No |
Yes |
ChannelMessage.Read.All |
Delegated |
`` |
Yes |
Yes |
Understanding Consent Requirements
This is standard Microsoft behavior, not Teams MCP specific. All Microsoft 365 apps use the same consent model.
Standard Microsoft Consent Process
Admin adds the app and grants admin-required permissions
- For Teams MCP:
OnlineMeetingRecording.Read.All and OnlineMeetingTranscript.Read.All require admin consent
- Chat messaging permissions do not require admin consent and can be approved by individual users.
ChannelMessage.Read.All does require admin consent.
Admin approval workflow (if tenant has it enabled)
- Users request admin approval
- Admin approves app for that user
User consent (always required for delegated permissions)
- Each user must consent individually
Microsoft Documentation:
Least-Privilege Justification
Each permission is the minimum required for its function. No narrower alternatives exist.
User.Read
| Aspect |
Detail |
| Purpose |
Retrieve the signed-in user's profile (ID, email, display name) |
| Used For |
Identifying the user when storing tokens and creating subscriptions |
| Why Not Less |
This is the minimum permission to read any user data |
Why Not User.ReadBasic.All |
That permission reads other users; we only need the signed-in user |
Calendars.Read
| Aspect |
Detail |
| Purpose |
Read the user's calendar events |
| Used For |
Determining if a meeting is recurring |
| Why Not Less |
No narrower permission exists for reading calendar events |
Why Not Calendars.ReadWrite |
We don't create or modify calendar events, only read them |
OnlineMeetings.Read
| Aspect |
Detail |
| Purpose |
Read meeting metadata (subject, start/end time, participants) |
| Used For |
Fetching meeting details when a transcript notification arrives |
| Why Not Less |
No narrower permission exists for reading meeting data |
Why Not OnlineMeetings.ReadWrite |
We don't create or modify meetings, only read them |
OnlineMeetingRecording.Read.All
| Aspect |
Detail |
| Purpose |
Read recordings from all meetings the user can access |
| Used For |
Downloading MP4 recording files to store alongside transcripts |
| Why Not Less |
No per-meeting recording permission exists; .All is the minimum |
| Admin Consent |
Required because recordings contain audio/video of meetings |
OnlineMeetingTranscript.Read.All
| Aspect |
Detail |
| Purpose |
Read transcripts from all meetings the user can access |
| Used For |
Downloading VTT transcript content for ingestion |
| Why Not Less |
No per-meeting transcript permission exists; .All is the minimum |
| Admin Consent |
Required because transcripts may contain sensitive meeting content |
offline_access
| Aspect |
Detail |
| Purpose |
Obtain refresh tokens for long-lived sessions |
| Used For |
Refreshing expired access tokens without user re-authentication |
| Why Required |
Without this, users would need to re-authenticate every ~1 hour |
ChannelMessage.Send
| Aspect |
Detail |
| Purpose |
Send messages to Microsoft Teams channels |
| Used For |
Posting messages on behalf of the user |
| Why Not Less |
No narrower permission exists for sending channel messages |
ChatMessage.Send
| Aspect |
Detail |
| Purpose |
Send messages to Microsoft Teams chats |
| Used For |
Posting messages on behalf of the user |
| Why Not Less |
No narrower permission exists for sending chat messages |
Chat.ReadBasic
| Aspect |
Detail |
| Purpose |
List the user's chats with basic metadata |
| Used For |
Returning chat ids plus distinguishing metadata |
Chat.Read
| Aspect |
Detail |
| Purpose |
Read full message content from Teams chats |
| Used For |
Retrieving message history |
Team.ReadBasic.All
| Aspect |
Detail |
| Purpose |
List all Teams the user is a member of |
| Used For |
Returning team ids plus isArchived status |
Channel.ReadBasic.All
| Aspect |
Detail |
| Purpose |
List channels in a Team |
| Used For |
Returning channel ids plus metadata |
ChannelMessage.Read.All
| Aspect |
Detail |
| Purpose |
Read message content from Teams channels |
| Used For |
Retrieve channel message history |
| Admin Consent |
Required because channel messages may contain sensitive organisational content |
Why Delegated (Not Application) Permissions
| Factor |
Delegated |
Application |
| User involvement |
User signs in and consents |
No user; admin pre-configures |
| Data access scope |
Only the signed-in user's data |
All users' data in tenant |
| Setup requirement |
None (self-service) |
Admin creates Access Policies |
| Least privilege |
Yes - user controls their own data |
No - broad tenant access |
The MCP model requires self-service user connections where each user:
- Connects their own account
- Controls what data they share
- Can disconnect at any time
Permission Reference Links