Microsoft admin approval

Why Teams bridges need tenant-wide admin consent, and how to hand the approval off to your Microsoft 365 administrator.

Microsoft Graph won't let an app read or send Teams channel messages on the strength of one user's sign-in. Those permissions have to be granted for the whole tenant by a Microsoft 365 administrator. ThreadBridge calls this admin approval, and until it's done, Teams bridges fail as soon as they try to subscribe to a channel. Slack has no equivalent tenant-wide step; see Slack workspace approval for its (simpler, one-step) version of handing a connection off to someone else.

If you're setting up the bridge

When approval is missing, the dashboard shows a banner with a Get approval link. That page gives you a link to send to your administrator, along with a summary of what they'll be asked to approve.

The person granting approval usually isn't the person who set up ThreadBridge and often has no account here at all, so the link works without signing in. It's a signed, single-purpose token that identifies your account, and it expires after seven days. Generate a fresh one if it lapses.

If you're the administrator

Opening the link shows what's being requested and a button that hands you off to Microsoft's own consent screen, signed in as yourself. Microsoft, not ThreadBridge, asks for the approval, and the permissions you'll see are the four in Connect Microsoft Teams: list teams, list channels, read channel messages, send channel messages.

Approving returns you to a confirmation page. Nothing else is asked of you, and you don't need a ThreadBridge account. The person who sent you the link can then start their bridge.

What approval does and doesn't allow

  • It's tenant-wide because Graph offers no narrower scope for channel messages. That's a Microsoft constraint, not a ThreadBridge preference.
  • ThreadBridge only subscribes to the channels explicitly mapped in a bridge, and drops notifications for anything else.
  • No directory, mailbox, calendar, file, or chat permissions are requested.
  • Approval can be withdrawn at any time from the Microsoft Entra admin center, under enterprise applications. Bridges stop relaying Teams messages when it is.

If you connect a different tenant later

Approval is recorded against the specific tenant that granted it. Connect a different Microsoft tenant and the banner comes back, because the new tenant hasn't approved anything yet.