Skip to content
AskTable

Documentation feedback

Current pageMicrosoft 365 / Teams login integration/en/how-to/connect-microsoft-teams

0 / 5,000

Your feedback will be sent to the maintenance team.

Go to console
Go to console
AskTable
Go to console

Members and permissions

Microsoft 365 / Teams login integration

Import Microsoft 365 employees and let them sign in to AskTable from Teams.

The Microsoft 365 / Teams integration lets imported employees sign in with their enterprise identity when they open the AskTable personal app in Teams. Only employees who are imported and whose account and organization membership are active can sign in; the first sign-in does not create an account.

An organization Owner or Admin configures it in AskTable, and a Microsoft 365 enterprise administrator completes the setup in Entra and Teams. Entry: “Personal settings” → “Integration” → “Microsoft 365 / Teams”.

Scope

  • Only Microsoft 365 global commercial cloud (login.microsoftonline.com and graph.microsoft.com) is supported, not 21Vianet or government cloud tenants.
  • AskTable must use an HTTPS domain employees can reach, and the backend must reach the Microsoft endpoints above.
  • It works only inside Teams desktop, web, and mobile; there is no Microsoft sign-in entry in a regular browser.
  • Only enabled Member employees are imported, not guests or personal Microsoft accounts.

Steps

Register an Entra app

In “App registrations” in the Microsoft Entra admin center, create a single-tenant app and note the “Directory (tenant) ID” and “Application (client) ID”.

In “Certificates & secrets”, create a client secret and save its “Value” (not the secret ID). When the secret expires or rotates, update it in AskTable.

Authorize reading the employee directory

In “API permissions → Add a permission → Microsoft Graph → Application permissions”, add User.Read.All, and have an enterprise administrator “Grant admin consent”.

AskTable reads only employees' object ID, display name, enabled status, and user type. It does not read phone numbers or merge accounts by email. Administrators still choose which employees to import one by one.

Enable it in AskTable

Click “Enable” and enter the Tenant ID, Client ID, and Client Secret. Enabling does not verify Microsoft credentials or import employees automatically.

Configure Teams single sign-on

In the Entra app's “Expose an API”:

  • Set the Application ID URI shown on the AskTable details page (format api://your-AskTable-domain/client-ID).
  • Add the delegated scope access_as_user.
  • In the app manifest, set api.requestedAccessTokenVersion to 2.
  • Pre-authorize the Teams clients for access_as_user: desktop and mobile 1fec8e78-bce4-4aaf-ab1b-5451cc387264, web 5e3ce6c0-2b1f-4285-8d4b-75ee78787346.

For the exact screens, see Microsoft's Teams SSO app registration documentation.

Create a Teams personal app

In the Teams Developer Portal, create a personal app and add a “static tab in personal scope”:

  • Content URL: the complete “App homepage address” from the AskTable details page. Do not remove org_id from Cloud addresses; keep the full path prefix for private deployments.
  • Valid domains: the AskTable host name.
  • SSO: the same Client ID and Application ID URI.

Publish it to the enterprise, then approve and assign the app according to enterprise policy. If the deployment's reverse proxy forbids embedding pages in iframes, allow Teams to load AskTable.

Import employees and verify

Return to AskTable, click “Import members”, choose employees, and submit. Open the personal app in Teams with an imported employee and confirm they enter the right organization. Enterprise policy may require consent or multi-factor authentication, so the first open may not be completely prompt-free.

The Tenant ID cannot be changed directly after saving; disconnect before switching enterprises. After disconnecting, accounts, members, and history are kept, but the organization's Teams sign-in stops working immediately. For common rules, see Enterprise integration login. After importing, assign project roles and data permissions.

Common issues

SymptomCheck
Reading the employee directory failsTenant ID, Client ID, the secret value and its expiry; the User.Read.All application permission and admin consent
Authorization fails in TeamsContent URL, valid domains, Application ID URI, pre-authorized client IDs, access token version
Identity verified but cannot enterWhether the employee is imported and the account and membership are active