Skip to main content

​
Overview

Once Microsoft Teams is connected, the Dema Agent can read and manage Teams chats and channels, follow message threads and replies, and manage channel members — all on your behalf. It is useful for pulling context from team discussions and sharing Dema analyses into a channel. Teams is served by Microsoft’s official hosted Work IQ / Agent 365 MCP server. The agent acts as the user who authorizes the connection, so it only sees what that user can already see in Teams.

​
Prerequisites

  • A Microsoft 365 organization (work or school account). Personal Microsoft accounts are not supported.
  • A Microsoft 365 Copilot license for the user who connects. Work IQ is backed by the Microsoft 365 Copilot Chat API, so tool calls fail without it.
  • A Microsoft Entra (Azure AD) administrator to complete the one-time tenant setup below.
  • Your Microsoft Entra tenant ID (a GUID). Find it in the Entra admin center under Overview → Tenant ID.

​
One-time tenant setup (admin)

1

Provision the Agent 365 Tools service principal

A Global Administrator runs this once per tenant, using the Azure CLI:
az ad sp create --id ea9ffc3e-8a23-4a7d-836d-234d7c7565c1
Prefer a UI? In Microsoft Graph Explorer, signed in as an admin, send POST https://graph.microsoft.com/v1.0/servicePrincipals with body {"appId": "ea9ffc3e-8a23-4a7d-836d-234d7c7565c1"}. A 201 Created response means it worked.
2

Grant admin consent

After the service principal exists, grant tenant-wide admin consent for the Teams permission (McpServers.Teams.All) when prompted during the first connection, or ahead of time from the Microsoft 365 admin center under Agents → Tools.
This setup is shared across the Microsoft Teams, Outlook, and SharePoint integrations. Once the service principal is provisioned, you only need to consent to each integration’s specific permission.

​
Connect Microsoft Teams

1

Open the integration in Dema

In Dema, go to Agents → Settings → Integrations, find Microsoft Teams, and click Connect.
2

Enter your tenant MCP URL

Enter the MCP URL in the form below, replacing {tenant_id} with your Entra tenant ID:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_TeamsServer
3

Sign in and approve

Click Add, sign in with your Microsoft work or school account, and approve the permission Dema requests. You are returned to Dema with the integration marked as Active.

​
Scopes Dema requests

ScopeWhat it allows
McpServers.Teams.AllRead and manage Teams chats, channels, messages, threads, and members on your behalf
offline_accessRefresh access so you do not have to reconnect frequently
The session runs as the user who authorizes it, so the agent only sees the chats and channels that user can already access.

​
Troubleshooting

  • AADSTS650052 / “your organization lacks a service principal”. The Agent 365 Tools service principal is not provisioned in your tenant. An admin must run the provisioning step above.
  • Sign-in rejected. You are using a personal Microsoft account. Use a work or school (organizational) account.
  • The agent gets no access or a 403. The signing-in user is missing a Microsoft 365 Copilot license. Assign one and allow time for it to propagate.
  • Dema says the URL is invalid. The MCP URL must be https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_TeamsServer with {tenant_id} replaced by your real tenant GUID.
  • Permission not grantable in Entra. An Entra admin must register/consent the Work IQ Teams MCP server (mcp_TeamsServer) before the McpServers.Teams.All permission can be consented.

​
Additional resources