> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dema.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Teams

> Let the Dema Agent read and manage Microsoft Teams chats, channels, members, and messages through Microsoft's hosted Teams MCP server.

export const Agent365SetupIntro = () => <>
    Microsoft's Agent 365 tools are exposed by a shared resource called **Agent 365 Tools** (application ID `ea9ffc3e-8a23-4a7d-836d-234d7c7565c1`). Its service principal is **not** provisioned in your tenant automatically, so an admin has to create it once before anyone can connect.

    <Warning>
      If you skip this step, the connection fails with **AADSTS650052** ("your organization lacks a service principal") and the required permissions never appear in Entra.
    </Warning>
  </>;

export const MicrosoftAgentPreviewNote = () => <Note>
    Microsoft Teams, Outlook, and SharePoint are currently **preview** integrations. They are built on Microsoft's Agent 365 / Work IQ MCP servers, which Microsoft ships as a preview feature — tool behavior may change, and your workspace may need the preview enabled before the integration appears.
  </Note>;

## Overview

Once Microsoft Teams is connected, the Dema Agent can read and manage Teams chats and channels, follow message threads and replies, and manage channel members — all on your behalf. It is useful for pulling context from team discussions and sharing Dema analyses into a channel.

Teams is served by Microsoft's official hosted **Work IQ / Agent 365** MCP server. The agent acts as the user who authorizes the connection, so it only sees what that user can already see in Teams.

<MicrosoftAgentPreviewNote />

***

## Prerequisites

* A **Microsoft 365** organization (work or school account). Personal Microsoft accounts are not supported.
* A **Microsoft 365 Copilot** license for the user who connects. Work IQ is backed by the Microsoft 365 Copilot Chat API, so tool calls fail without it.
* A **Microsoft Entra (Azure AD) administrator** to complete the one-time tenant setup below.
* Your **Microsoft Entra tenant ID** (a GUID). Find it in the [Entra admin center](https://entra.microsoft.com) under **Overview → Tenant ID**.

***

## One-time tenant setup (admin)

<Agent365SetupIntro />

<Steps>
  <Step title="Provision the Agent 365 Tools service principal">
    A Global Administrator runs this once per tenant, using the [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli):

    ```bash theme={null}
    az ad sp create --id ea9ffc3e-8a23-4a7d-836d-234d7c7565c1
    ```

    Prefer a UI? In [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer), signed in as an admin, send `POST https://graph.microsoft.com/v1.0/servicePrincipals` with body `{"appId": "ea9ffc3e-8a23-4a7d-836d-234d7c7565c1"}`. A `201 Created` response means it worked.
  </Step>

  <Step title="Grant admin consent">
    After the service principal exists, grant tenant-wide admin consent for the Teams permission (`McpServers.Teams.All`) when prompted during the first connection, or ahead of time from the [Microsoft 365 admin center](https://admin.microsoft.com) under **Agents → Tools**.
  </Step>
</Steps>

<Note>
  This setup is shared across the Microsoft Teams, Outlook, and SharePoint integrations. Once the service principal is provisioned, you only need to consent to each integration's specific permission.
</Note>

***

## Connect Microsoft Teams

<Steps>
  <Step title="Open the integration in Dema">
    In Dema, go to **Agents → Settings → Integrations**, find **Microsoft Teams**, and click **Connect**.
  </Step>

  <Step title="Enter your tenant MCP URL">
    Enter the **MCP URL** in the form below, replacing `{tenant_id}` with your Entra tenant ID:

    ```
    https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_TeamsServer
    ```
  </Step>

  <Step title="Sign in and approve">
    Click **Add**, sign in with your Microsoft **work or school** account, and approve the permission Dema requests. You are returned to Dema with the integration marked as Active.
  </Step>
</Steps>

***

## Scopes Dema requests

| Scope                  | What it allows                                                                       |
| ---------------------- | ------------------------------------------------------------------------------------ |
| `McpServers.Teams.All` | Read and manage Teams chats, channels, messages, threads, and members on your behalf |
| `offline_access`       | Refresh access so you do not have to reconnect frequently                            |

The session runs as the user who authorizes it, so the agent only sees the chats and channels that user can already access.

***

## Troubleshooting

* **AADSTS650052 / "your organization lacks a service principal".** The Agent 365 Tools service principal is not provisioned in your tenant. An admin must run the provisioning step above.
* **Sign-in rejected.** You are using a personal Microsoft account. Use a work or school (organizational) account.
* **The agent gets no access or a 403.** The signing-in user is missing a Microsoft 365 Copilot license. Assign one and allow time for it to propagate.
* **Dema says the URL is invalid.** The MCP URL must be `https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_TeamsServer` with `{tenant_id}` replaced by your real tenant GUID.
* **Permission not grantable in Entra.** An Entra admin must register/consent the Work IQ Teams MCP server (`mcp_TeamsServer`) before the `McpServers.Teams.All` permission can be consented.

***

## Additional resources

* [Set up the Agent 365 Tools service principal](https://learn.microsoft.com/microsoft-agent-365/developer/tooling)
* [Manage tools for agents in the Microsoft 365 admin center](https://learn.microsoft.com/microsoft-agent-365/bring-your-own-mcp)
* [Work IQ API permissions](https://learn.microsoft.com/microsoft-365/copilot/extensibility/work-iq/permissions)