> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Teams (Delegated)

> Send 1:1 Microsoft Teams chat messages from a service account in your MSP's tenant, through an Entra app you register.

Triggr sends 1:1 Teams chat messages as a service account in your own Microsoft 365 tenant, through an Entra app you register. It's separate from [Microsoft Graph (GDAP)](/integrations/microsoft-graph/gdap-service-account) and [Microsoft Graph (SAM)](/integrations/microsoft-graph/sam), which work in your clients' tenants.

## Set up Microsoft 365

You need an account that can create users and register apps in your tenant. See Microsoft's guide to [registering an app](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app).

<Steps>
  <Step title="Create the service account">
    Create a user such as `triggr-teams@yourdomain.com` with a licence that includes Microsoft Teams. Recipients see messages from this account.
  </Step>

  <Step title="Register an app">
    In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID > App registrations > New registration**, choose Single tenant only, click Register and copy the Application (client) ID and Directory (tenant) ID from Overview.
  </Step>

  <Step title="Add Triggr's redirect URI">
    Under Authentication, click **Add Redirect URI** (or Add a platform), choose Web, enter `https://app.triggr-app.com/oauth/callback` and click Configure.
  </Step>

  <Step title="Add the Teams permissions">
    Go to **API permissions > Add a permission > Microsoft Graph > Delegated permissions**, tick `Chat.Create` and `ChatMessage.Send`, and click Add permissions.
  </Step>

  <Step title="Create a client secret">
    Under **Certificates & secrets > Client secrets**, click New client secret and copy its Value, not its Secret ID. Note when it expires.
  </Step>
</Steps>

Neither permission needs admin consent: the service account accepts them when it signs in from Triggr, so your [user consent settings](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent) must allow that.

## Connect it in Triggr

<Steps>
  <Step title="Open the integration">
    Go to **Integrations > Microsoft Teams (Delegated)** and click Configure on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter your app">
    Enter the Application (client) ID as ClientID, the secret's Value as ClientSecret and the Directory (tenant) ID as TenantID, then click Save Configuration.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/microsoft-teams-delegated/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=10295ff0440cc56667739af381639840" alt="The Microsoft Teams (Delegated) configuration window with empty ClientID, ClientSecret and TenantID fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1354" data-path="images/microsoft-teams-delegated/configure.png" />
    </Frame>
  </Step>

  <Step title="Authorize as the service account">
    Click **Authorize** on the Base Configuration card, sign in as the service account, not as yourself, and click Accept. Last Authorized shows when it happened.
  </Step>
</Steps>

There's no per-client setup: every workflow sends from this one account.

## Send a message

Use two Generic Integration Action steps with Integration set to Microsoft Teams (Delegated) and URL Type set to Relative to base URL (`https://graph.microsoft.com/v1.0`).

<Steps>
  <Step title="Open the chat">
    Add a step named `Open chat` with Method POST, URL `/chats`, Body Type JSON and this body, which reads the recipient's user principal name from a form field with Field ID `email`:

    ```json theme={null}
    {
      "chatType": "oneOnOne",
      "members": [
        {
          "@odata.type": "#microsoft.graph.aadUserConversationMember",
          "roles": ["owner"],
          "user@odata.bind": "https://graph.microsoft.com/v1.0/users('triggr-teams@yourdomain.com')"
        },
        {
          "@odata.type": "#microsoft.graph.aadUserConversationMember",
          "roles": ["owner"],
          "user@odata.bind": "https://graph.microsoft.com/v1.0/users('{{ ctx.params.email }}')"
        }
      ]
    }
    ```

    If the two already have a chat, Microsoft returns it instead of creating another.
  </Step>

  <Step title="Send the message">
    Add a step with Method POST, URL `/chats/{{ ctx.steps['Open chat'].body.id }}/messages`, Body Type JSON and the body `{"body": {"content": {{ ctx.params.message | json }}}}`, which reads the text from a form field with Field ID `message`.
  </Step>
</Steps>

See Microsoft's [Create chat](https://learn.microsoft.com/en-us/graph/api/chat-post) and [Send message in a chat](https://learn.microsoft.com/en-us/graph/api/chat-post-messages), and [Data and expressions](/studio/workflows/expressions) for templates.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Need admin approval when you click Authorize">
    The service account isn't allowed to consent to the app. Change your [user consent settings](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent), for example by allowing consent to apps registered in your organisation and classifying `Chat.Create` and `ChatMessage.Send` as low impact.
  </Accordion>

  <Accordion title="AADSTS50011 when you click Authorize">
    The redirect URI doesn't match. Add `https://app.triggr-app.com/oauth/callback` as a Web redirect URI on the app, exactly as written.
  </Accordion>

  <Accordion title="access token expired and no refresh token available">
    The integration hasn't been authorized. Click Authorize and sign in as the service account.
  </Accordion>

  <Accordion title="no access token in refresh response">
    Microsoft stopped renewing the sign-in, for example after a password reset or an expired client secret. Replace ClientSecret if it expired, then click Authorize again.
  </Accordion>

  <Accordion title="integration request failed with status code: 403">
    The app is missing `Chat.Create` or `ChatMessage.Send`. Add it, then click Authorize again so the service account accepts it.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.