Reference
Microsoft Teams permissions
The Conclude app for Microsoft Teams asks for the permissions listed here. This page is for tenant admins who review app permissions before they approve them. Resource-specific consent (RSC) permissions are declared in the app manifest, and Teams grants them when the app is installed in a team or chat. Delegated scopes come through Microsoft Graph. The signed-in user grants them, or an admin grants them for the whole tenant.
RSC permissions that Conclude uses to connect platforms
The current app manifest, version 1.4.0, declares these permissions. An installation holds the set that its own manifest version declared, from the install or the last upgrade. Older installations may therefore hold fewer.
| Scope | Description | Use case |
|---|---|---|
| ChannelSettings.ReadWrite.Group | Retrieve and modify channel information | Conclude lists and modifies the channels in a team |
| Channel.Create.Group | Create channels | Conclude creates new channels in a team |
| ChannelMessage.Read.Group | Read all channel messages | Conclude reads all channel messages in a team |
| ChannelMember.ReadWrite.Group | Read and add members of a private or shared channel | Conclude lists and adds members of private and shared channels. Standard channels follow team membership. This permission replaced ChannelMember.Read.Group in manifest 1.3.2 |
| ChatMessage.Read.Chat | Read all chat messages | Conclude reads all messages in a chat |
| ChatSettings.ReadWrite.Chat | Read and write settings for a chat | Conclude reads and writes chat settings such as the topic |
| Chat.Manage.Chat | Manage a chat | Conclude adds members to a chat and removes them |
| Chat.ManageDeletion.Chat | Delete and recover a chat | Conclude deletes a chat when the chat is removed from Conclude. Added in manifest 1.3.4 |
| TeamMember.Read.Group | List all members in a team | Conclude lists all members in a team |
| TeamSettings.Read.Group | Read team settings | Conclude reads a team’s name, settings and photo. Added in manifest 1.3.4 |
| TeamsAppInstallation.Read.Group | Read the apps installed in a team | Conclude reads its own installation in a team and the permissions granted to it. Added in manifest 1.4.0 |
| TeamsTab.ReadWrite.Group | Read and write tabs in a channel | Conclude lists its own tabs in channels and removes them. Added in manifest 1.3.4 |
| TeamsTab.Create.Group | Create tabs in a channel | Conclude adds its own tabs to channels. TeamsTab.ReadWrite.Group does not cover creating a tab. Added in manifest 1.3.4 |
| TeamsTab.ReadWrite.Chat | Read and write tabs in a chat | Conclude adds its own tabs in a chat and removes them. Added in manifest 1.3.4 |
| TeamsTab.Read.Chat | Read tabs in a chat | Conclude lists the tabs in a chat. TeamsTab.ReadWrite.Chat does not cover listing. Added in manifest 1.3.4 |
Installations made with a manifest version before 1.3.2 also hold ChatMember.Read.Chat and ChannelMember.Read.Group. The current manifest no longer declares these two permissions, and Conclude does not use them.
Delegated scopes that Conclude requests for User Sync
When someone signs in to Conclude with a Microsoft account, Conclude requests only the standard OpenID Connect scopes, User.Read and offline_access. It requests the scopes below when a workspace is added or authorized. The user grants them, or an admin grants them through the tenant-wide admin consent link that Conclude provides.
| Scope | Description | Use case |
|---|---|---|
| Chat.ReadWrite | Create chats and read/write messages in chats | Conclude creates new direct messages and group chats. It also reads and edits messages |
| Channel.Create | Create channels | Conclude creates channels in selected teams. The RSC permission Channel.Create.Group will replace this scope |
| ChannelMessage.ReadWrite | Read and write user channel messages | Conclude edits messages in channels and soft deletes them |
| ChannelMessage.Read.All | Read all messages in a channel | Conclude reads hosted content and batches of replies in channel messages. The RSC permission ChannelMessage.Read.Group covers the other channel message reads |
| ChannelMessage.Send | Send messages to a channel on behalf of a user | Conclude sends messages to a Teams channel on behalf of the user |
| ChannelMember.ReadWrite.All | Add and remove members from all channels | Conclude lists the members of a channel and adds new members |
| ChannelSettings.ReadWrite.All | List channels in a team and modify their settings | Conclude lists channels and sets channel topics. The RSC permission ChannelSettings.ReadWrite.Group will replace this scope |
| Team.ReadBasic.All | Read the names and descriptions of teams | Conclude gets the list of teams that the signed-in user has joined |
| TeamMember.Read.All | Read members of teams | Conclude lists all members of a team. The RSC permission TeamMember.Read.Group will replace this scope |
| TeamsAppInstallation.ReadWriteAndConsentSelfForChat | Allow Conclude to install itself into a chat | Once Conclude is installed in a chat, it can subscribe to the messages in that chat and post messages |
| TeamsAppInstallation.ReadWriteAndConsentSelfForTeam | Allow Conclude to install itself into a team | Once Conclude is installed in a team, it can subscribe to the messages in that team and post messages |
| User.ReadBasic.All | Read basic info about all users | Conclude reads basic information about all users, including their name and profile picture |
| User.Read | Sign in and read user profile | Conclude reads the signed-in user’s profile to identify the user |
| offline_access | Maintain access to data you have given it access to | Conclude keeps the access token refreshed after a successful sign-in |
Conclude adds two more groups of scopes, but only when your configuration needs them.
| Scope | Description | Use case |
|---|---|---|
| Files.Read.All | Read all files the user can access | Requested when attachment copying is enabled for Connect Internal, External or Bridge. Conclude reads files shared in synced conversations |
| Files.ReadWrite.All | Have full access to user files | Requested together with Files.Read.All. Conclude uploads a file on behalf of the signed-in user and sends an invitation to another user |
| TeamsTab.ReadWriteSelfForTeam | Manage Conclude’s own tabs in teams | Requested when Apps or Connected Apps are enabled. Conclude adds its own tabs to team channels and removes them |
| TeamsTab.Read.All | Read tabs in teams and chats | Requested when Apps or Connected Apps are enabled. Conclude finds its existing tabs |
AppCatalog.Read.All appeared in older versions of this list. Conclude now requests it only outside production. There it uses the scope to find its own app ID in the organization’s app catalog.
Some tenant admins curate Conclude’s permissions themselves. This is called custom tenant authentication, and Conclude handles it differently. Conclude requests offline_access and https://graph.microsoft.com/.default. The .default scope resolves to whatever delegated permissions the tenant has consented to. Conclude therefore never asks again for a scope that an admin has removed. Conclude does not provide an admin consent link for these organizations.
For the equivalent list for Slack, see Slack permissions. For how Conclude handles data more broadly, see the Security page.