# Microsoft 365 / Teams login integration

Import Microsoft 365 employees and let them sign in to AskTable from Teams.

使用指南 · 模块: organization · 管理人员 · 部署形态：Cloud / 私有部署 · 已确认产品版本：资料未说明 · 来源：编辑整理 · 按产品 4.2.76-1110（CLI 0.0.18）核对；私有部署的旧版本可能不包含近期变化。

The Microsoft 365 / Teams integration lets imported employees sign in with their enterprise identity when they open the AskTable personal app in Teams. Only employees who are imported and whose account and organization membership are active can sign in; the first sign-in does not create an account.

An organization Owner or Admin configures it in AskTable, and a Microsoft 365 enterprise administrator completes the setup in Entra and Teams. Entry: “Personal settings” → “Integration” → “Microsoft 365 / Teams”.

## Scope

- Only Microsoft 365 global commercial cloud (`login.microsoftonline.com` and `graph.microsoft.com`) is supported, not 21Vianet or government cloud tenants.
- AskTable must use an HTTPS domain employees can reach, and the backend must reach the Microsoft endpoints above.
- It works only inside Teams desktop, web, and mobile; there is no Microsoft sign-in entry in a regular browser.
- Only enabled Member employees are imported, not guests or personal Microsoft accounts.

## Steps

**Register an Entra app**

In “App registrations” in the [Microsoft Entra admin center](https://entra.microsoft.com/), create a single-tenant app and note the “Directory (tenant) ID” and “Application (client) ID”.

In “Certificates & secrets”, create a client secret and save its “Value” (not the secret ID). When the secret expires or rotates, update it in AskTable.

**Authorize reading the employee directory**

In “API permissions → Add a permission → Microsoft Graph → Application permissions”, add `User.Read.All`, and have an enterprise administrator “Grant admin consent”.

AskTable reads only employees' object ID, display name, enabled status, and user type. It does not read phone numbers or merge accounts by email. Administrators still choose which employees to import one by one.

**Enable it in AskTable**

Click “Enable” and enter the Tenant ID, Client ID, and Client Secret. Enabling does not verify Microsoft credentials or import employees automatically.

**Configure Teams single sign-on**

In the Entra app's “Expose an API”:

- Set the Application ID URI shown on the AskTable details page (format `api://your-AskTable-domain/client-ID`).
- Add the delegated scope `access_as_user`.
- In the app manifest, set `api.requestedAccessTokenVersion` to `2`.
- Pre-authorize the Teams clients for `access_as_user`: desktop and mobile `1fec8e78-bce4-4aaf-ab1b-5451cc387264`, web `5e3ce6c0-2b1f-4285-8d4b-75ee78787346`.

For the exact screens, see [Microsoft's Teams SSO app registration documentation](https://learn.microsoft.com/en-us/microsoftteams/platform/tabs/how-to/authentication/tab-sso-register-aad).

**Create a Teams personal app**

In the [Teams Developer Portal](https://dev.teams.microsoft.com/), create a personal app and add a “static tab in personal scope”:

- Content URL: the complete “App homepage address” from the AskTable details page. Do not remove `org_id` from Cloud addresses; keep the full path prefix for private deployments.
- Valid domains: the AskTable host name.
- SSO: the same Client ID and Application ID URI.

Publish it to the enterprise, then approve and assign the app according to enterprise policy. If the deployment's reverse proxy forbids embedding pages in iframes, allow Teams to load AskTable.

**Import employees and verify**

Return to AskTable, click “Import members”, choose employees, and submit. Open the personal app in Teams with an imported employee and confirm they enter the right organization. Enterprise policy may require consent or multi-factor authentication, so the first open may not be completely prompt-free.

The Tenant ID cannot be changed directly after saving; disconnect before switching enterprises. After disconnecting, accounts, members, and history are kept, but the organization's Teams sign-in stops working immediately. For common rules, see [Enterprise integration login](https://docs.asktable.com/en/organization/enterprise-login). After importing, assign [project roles](https://docs.asktable.com/en/organization/members-and-roles) and [data permissions](https://docs.asktable.com/en/permissions).

## Common issues

| Symptom                              | Check                                                                                                               |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------- |
| Reading the employee directory fails | Tenant ID, Client ID, the secret value and its expiry; the `User.Read.All` application permission and admin consent |
| Authorization fails in Teams         | Content URL, valid domains, Application ID URI, pre-authorized client IDs, access token version                     |
| Identity verified but cannot enter   | Whether the employee is imported and the account and membership are active                                          |