Connect Microsoft Teams

Connecting Microsoft Teams links your Microsoft 365 tenant to your ThreadBridge account. It's two steps rather than one: you sign in, and then an administrator approves the app for the tenant. Both are required before a bridge can move a message.

If you weren't signed in when you started (using the "Continue with Microsoft Teams" button rather than an existing session), signing in also creates your ThreadBridge account, using the name and email Microsoft provides, instead of asking you to fill in a separate sign-up form first. If you're already signed in, it just connects the tenant to the account you're using.

Choose a setup tier

From the dashboard, choose Connect Teams. You'll be asked to pick one of two tiers before signing in to Microsoft:

• Guided: ThreadBridge lists your teams and channels automatically, so you pick from a dropdown when you create a bridge. This needs Channel.ReadBasic.All, which is tenant-wide: Graph has no narrower "just this channel" version of it.
• Secure: drops Channel.ReadBasic.All entirely. Instead of picking from a list, you enter the team ID and channel ID yourself when you create a bridge. Good fit if your IT team would rather not grant a permission that can list every channel in the tenant.

The choice only affects what's requested at sign-in and how you pick channels afterward; everything else about how a bridge runs is identical. You can reconnect later to switch tiers; it won't affect bridges you've already created.

Step 1: sign in

1. Pick Guided or Secure on the setup page.
2. Sign in with your Microsoft 365 account and accept the permission prompt.
3. You're returned to ThreadBridge with the tenant connected.

Your tenant is identified from the sign-in itself, not by asking Microsoft for directory information; ThreadBridge never requests permission to read your directory.

Step 2: administrator approval

Reading and sending channel messages through Microsoft Graph requires consent granted for the whole tenant by an administrator. Until that happens, bridges fail when they try to subscribe to a channel, and the dashboard shows a banner with a link to send to your administrator. That flow is described in Microsoft admin approval.

Permissions ThreadBridge asks for

Guided requests:

Permission	Why
Team.ReadBasic.All	List the teams in the tenant so you can pick one in the channel map.
Channel.ReadBasic.All	List the channels inside a team.
ChannelMessage.Read.All	Receive messages posted in the channels you mapped.
ChannelMessage.Send	Post messages arriving from the other platform.
offline_access	Refresh the access token so a running bridge doesn't stop after an hour.
openid	Identify which tenant signed in.
profile, email	Your name and email address, so connecting Teams can also create your ThreadBridge account, and your organization's domain to label the tenant.

Secure drops Channel.ReadBasic.All and requests everything else:

Permission	Why
Team.ReadBasic.All	List the teams in the tenant so you can confirm the team ID you were given.
ChannelMessage.Read.All	Receive messages posted in the channel you mapped.
ChannelMessage.Send	Post messages arriving from the other platform.
offline_access	Refresh the access token so a running bridge doesn't stop after an hour.
openid	Identify which tenant signed in.
profile, email	Your name and email address, so connecting Teams can also create your ThreadBridge account, and your organization's domain to label the tenant.

Microsoft's message permissions are tenant-wide by design: Graph has no "just these two channels" scope for channel messages, on either tier. ThreadBridge narrows this itself: the runtime only subscribes to the specific channels in a bridge's map, and ignores anything delivered for a channel that isn't mapped.

How Teams messages reach ThreadBridge

For each mapped Teams channel, the runtime creates a Microsoft Graph subscription (a webhook registration that tells Microsoft where to send change notifications). Graph caps those at roughly three days, so the runtime renews each one about half an hour before it expires. Subscriptions survive a restart on purpose: the runtime finds and reuses the ones it already has rather than churning them, and a subscription for a bridge you stopped simply lapses when its renewal stops happening.

Which teams you can pick from (Guided)

The channel picker lists the teams that the Microsoft account you connected with belongs to. If a team you need is missing, join it in Teams and reload the form, or connect with an account that's already a member.

Standard channels are supported. Private and shared channels use a different Graph resource and are not supported today.

Entering a team and channel manually (Secure)

On the Secure tier, the bridge form asks for a team ID and a channel ID instead of showing a dropdown. Both are visible in Teams itself: open the channel, choose Get link to channel, and the link contains both IDs. Your Teams administrator can also read them off the Microsoft Teams admin center or the Graph API directly.

As with Guided, only standard channels are supported.

Token expiry

Microsoft access tokens are short-lived. ThreadBridge refreshes them in the background before they expire and hands the fresh token to the running bridge. You'll only need to reconnect if the refresh token itself is revoked (for example after a password reset or a conditional-access policy change), and the bridge will report an authentication error when that happens.