Navigation
ELOWEN · Documentation

Last updated: October 27, 2026

Browse documentation · Link Microsoft accounts for Teams
Channels and chatbots

Link Microsoft accounts for Teams

Linking a Microsoft account lets a Teams user reach their Chetty access from Teams and lets Chetty work in their Microsoft 365 data.

Before you start

  • The Teams bot works: its credentials are set and it answers in a personal chat. See Microsoft Teams.
  • You are a Microsoft Entra administrator for the tenant, or you know who is.
  • Chetty has a public HTTPS address. Web sign-in cannot work without one.

Sign in from a personal chat

  1. Create a second single-tenant Entra app registration for the sign-in connection.
  2. Add the redirect URI https://token.botframework.com/.auth/web/redirect and grant the delegated scopes listed in Grant the scopes.
  3. In the Azure Bot resource, add an OAuth connection using the Microsoft Entra ID v2 provider, with that application's ID, secret and tenant. Leave Token Exchange URL empty.
  4. In Chetty, open the MS Teams page and enter the connection's exact name as OAuth connection name.
  5. Turn on Personal-chat Microsoft sign-in.

A tenant member who is enabled in Chetty can then sign in from a Teams personal chat and work with their linked account's access.

Sign in to the web app

  1. On the MS Teams page, turn on Enable Microsoft sign-in.
  2. Set Public Chetty URL to Chetty's public HTTPS address.
  3. Register that address followed by /api/auth/sso/microsoft/callback as a redirect URI on the bot app.

People then sign in to Chetty with their Microsoft account instead of a local password.

Match an existing account

Personal-chat linking and web sign-in are separate features, and both end at one linked Chetty account.

  • Link existing accounts by e-mail matches exactly one existing Chetty account on the first web sign-in. After that, the Entra object ID is the lasting identity.
  • Link Chetty account on the Teams workspace lets an administrator attach a known Teams identity to another existing account.

Ambiguous or conflicting matches are refused rather than guessed.

Create accounts automatically

Set Account provisioning to Entire tenant to create a Chetty account for every enabled member of the configured tenant.

Chetty tells a member from a guest by the ID token's optional acct claim; add it under Token configuration of the bot app. Without that claim, Chetty asks Microsoft Graph instead, which needs the User.Read.All application permission with tenant-admin consent. Guests, disabled accounts and identities outside the tenant are rejected.

Default projects for new accounts and New personal Project for each new account apply only to accounts created afterwards. Existing accounts keep what they have.

Use Microsoft 365 tools

Microsoft 365 tools act with the linked account's delegated identity and permissions, wherever that account is used, including shared chats and that person's scheduled jobs. The tokens stay in the Bot Framework Token Service, not in Chetty.

Microsoft 365 access defaults to Read only. Read and write still previews each change until the agent commits it explicitly.

Grant the scopes

The delegated app needs only the scopes for the tools you intend to use. A practical set is:

openid profile email offline_access
User.Read User.Read.All People.Read
Files.ReadWrite.All Sites.ReadWrite.All
Mail.ReadWrite Mail.Send Mail.ReadWrite.Shared Mail.Send.Shared
Calendars.ReadWrite Calendars.ReadWrite.Shared
Contacts.ReadWrite Tasks.ReadWrite
Group.ReadWrite.All Notes.ReadWrite.All
Chat.ReadWrite ChatMessage.Send
Team.ReadBasic.All Channel.ReadBasic.All ChannelMessage.Read.All ChannelMessage.Send

Keep offline_access so a connection survives token expiry. Add GroupMember.Read.All only if a directory group-membership call reports it missing. The Teams connection does not need Chat.Read.All.

Check that it worked

  1. Sign in from a Teams personal chat with a test Microsoft account.
  2. Ask Chetty for something simple from Microsoft 365, such as your next calendar appointment.
  3. Open the account in Users and confirm it shows as linked to the Microsoft identity you used.

If it does not work

  • Sign-in button missing: the matching switch is off on the MS Teams page, or OAuth connection name does not match the Azure Bot connection exactly.
  • Sign-in fails at Microsoft: the redirect URI is missing from the Entra app, or the delegated scopes are not granted.
  • "Could not verify your access in the Microsoft directory": the app cannot read directory data. Add the claim or the Graph permission described in Create accounts automatically.
  • A Microsoft 365 tool is refused: Microsoft 365 access is Read only, or the scope for that tool was never granted.
  • A link is refused: more than one Chetty account matches that e-mail, or the identity is already linked elsewhere.

Read Microsoft Teams for the bot setup, What is shared in a channel for shared chats, and Channels for access rules.