Microsoft Teams tenant

Connect a Microsoft 365 tenant: prerequisites, permissions, the app package, team installs for channel routing, and removal. For administrators.

A Teams Administrator uploads the app package, and a Global Administrator connects the tenant. Then members chat with Omni and agent owners route team channels. The member side is on Agents in Microsoft Teams.

Prerequisites

• Custom app upload allowed. xpander ships as an app package (.zip), not through the Teams store. Check Teams admin center → Teams apps → Manage apps → Org-wide app settings. If your policy blocks it, contact xpander first.
• A Global Administrator (or Privileged Role Administrator) to approve the tenant-wide Graph permission. See Microsoft Entra admin center → Roles and administrators.
• A Teams Administrator to upload the package.
• An xpander organization where you are an admin.

Give your xpander contact your tenant ID (Microsoft Entra admin center, Overview).

Permissions

Permission	Type	Scope	Granted during
Channel.ReadBasic.All	Microsoft Graph, application	Channel names and IDs, tenant-wide	Step 2, by a Global Administrator
ChannelMessage.Read.Group	Resource-specific consent (RSC)	Messages within one team	Step 4, by that team’s owner

Channel.ReadBasic.All gives no access to message content, mail, files or calendars. ChannelMessage.Read.Group covers only teams where the app is installed. xpander stores no Microsoft access or refresh token: the connection only maps your tenant ID to your organization. Users are identified by the work email Microsoft sends with each message, and each has their own Omni conversations.

Application (client) ID: 6ef090b1-c159-4fbf-9011-fc9db88fc91a

Step 1: Upload the app package

Role required: Teams Administrator

1. Get the app package (.zip) from your xpander contact.
2. In the Teams admin center, go to Teams apps → Manage apps > Actions → Upload new app.
3. Confirm the status is Allowed, and that your permission and setup policies let users run it.

Without admin center access, enable Upload custom apps in your setup policy and upload from the Teams client (Apps → Manage your apps → Upload a custom app).

Custom apps do not appear in Teams store search. Publish it to your org catalog (Apps → Built for your org) or pin it through a setup policy.

Step 2: Connect your tenant

Role required: Global Administrator who is also an xpander organization admin

In Platform > Agents > Channels, select Connect Microsoft Teams, sign in with your Microsoft admin account, and accept the consent. The tenant shows as connected, and its switch turns Teams on or off for the organization (logged as Org Channels Updated). Each tenant maps to one organization, and connecting a second tenant replaces it.

Without Global Administrator rights, sign-in fails with an “administrator is required” message and nothing is created. Repeat with an account that holds the role.

If channel lists are empty in Step 4, the tenant-wide grant did not complete. A Global Administrator can grant it directly:

https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id=6ef090b1-c159-4fbf-9011-fc9db88fc91a

Replace {tenant-id}, then check the application’s API permissions in the Microsoft Entra admin center shows the permission as granted.

Step 3: User access

Nothing for admins. Users message xpander in Teams. Accounts link automatically when the work email matches an xpander account. Otherwise the user selects Link account and signs in once.

Step 4: Enable channel routing (optional)

Role required: team owner, for each team

Only for teams where an agent should answer messages that do not mention it. In Teams, open the team, select ••• → Manage team → Apps → Add, add xpander, and accept the consent that mentions channel messages. Then configure routing in the answering agent’s settings in xpander Chat.

Adding the app as a channel tab or personal app does not enable routing. Only a team-scope install grants ChannelMessage.Read.Group, and the consent prompt about channel messages confirms it.

Verify the deployment

Check	Expected result
Platform > Agents > Channels	Lists your tenant as connected
A direct message to the app in Teams	Returns a reply
After Step 4, the channel picker in an agent’s settings	Lists your teams’ channels

Troubleshooting

Teams admin center returns an access error

The account lacks the Teams Administrator or Global Administrator role. Assign it, ask an existing admin, or upload from the Teams client with Upload custom apps enabled.

Connecting reports that an administrator is required

Tenant-wide consent needs Global Administrator or Privileged Role Administrator. Application Administrator is not enough for Graph application permissions. Nothing was created, so repeat with the right account.

Channel lists are empty

Channel.ReadBasic.All was not granted. Use the consent URL in Step 2. A new grant can take up to one hour.

An agent does not respond to channel messages

The app was installed as a personal app or tab, not to the team. Re-add it through Manage team → Apps. If the agent answers mentions but not other messages, this is the cause.

Remove xpander

1. Disconnect the tenant under Platform > Agents > Channels. Routing is kept and restored if the same tenant reconnects.
2. Uninstall the app in the Teams admin center under Manage apps.
3. Remove the enterprise application in the Microsoft Entra admin center to revoke the Graph permission.

Next steps

Use agents in Microsoft Teams

The member side.

Connect a Slack workspace

The same for Slack.