Set up Microsoft Teams service credential

A Microsoft Teams service credential lets a Glean agent access Microsoft Teams through a shared application identity and not as any individual user. You register an app in Microsoft Entra ID, grant it the Microsoft Graph application permissions the agent needs, and store the connection details in Glean.

Glean handles authentication automatically. The credential is stored encrypted, and the agent never sees the raw client secret.

• Authentication: Microsoft Entra application identity (OAuth 2.0 client credentials)
• Scope: Whatever Microsoft Graph application permissions the app has
• Access: Determined by the Graph permissions you grant

Prerequisites

• Permission to create or manage an app registration in Microsoft Entra ID.
• Permission to grant Microsoft Graph application permissions and admin consent.
• A Glean administrator who can create service credentials.
• The Microsoft Teams template enabled for your deployment. If you do not see it in the list of templates, contact your Glean representative to turn it on.

Step 1: Create an app registration in Microsoft Entra ID

1. In the Azure portal, go to Microsoft Entra ID → App registrations and create a new app registration for Glean.

2. Under Certificates & secrets, create a new client secret.

   Important

   The client secret value is shown only once. Copy it and store it somewhere safe. If you lose it, you will have to create a new secret.

3. From the app's Overview page, copy the Application (client) ID and Directory (tenant) ID.

4. Under API permissions, add only the Microsoft Graph application permissions the agent needs. Then click Grant admin consent.

5. In the Teams Admin Center, note the Teams app ID for the app you want to link to the agent. This is distinct from the application (client) ID and isn't used to mint tokens.

Step 2: Create the service credential in Glean

1. In Glean, go to Admin console → Platform → Tools → Service credentials.
   
2. Click Add.
3. Select Microsoft Teams App under Service credentials.
4. Fill in these fields:
   • Credential name: A human-readable name for the credential.
   • Description: A brief description of what this credential is used for.
   • Application (Client) ID: The application (client) ID from your app registration's Overview page.
   • Client Secret: The client secret you created under Certificates & secrets (stored encrypted). Used to mint Microsoft Graph tokens via the OAuth 2.0 client-credentials flow.
   • Directory (Tenant) ID: The directory (tenant) ID of the Microsoft Entra tenant where the app is registered, from the Overview page.
   • Teams App ID: The Microsoft Teams app ID from the Teams Admin Center, used to link this credential to an agent.
   • Audience: Which users or groups can attach this credential to agents.
5. Select Save. Glean stores the client secret as an encrypted secret and doesn't display it again.

Step 3: Attach the credential to an agent

When the agent makes a request to the Microsoft Graph API, Glean automatically attaches the correct authentication token. The agent also gains a Teams skill that explains how to call the Graph API for Teams data.

1. Go to Agents in Glean.

2. Select the agent to which you want to add the service credentials.

3. In the Tools tab, select Service credentials and select the Microsoft Teams credential you created.

   

Verify it works

Success

Ask the agent something that requires Teams data, for example, "list my recent Teams channels." If it returns data, the credential is working.

What the agent can do

Depending on the permissions you grant, the agent may be able to read Teams data such as:

• Team and channel metadata
• Messages or threads
• Meeting metadata or transcripts

note

TODO: Replace this generic list with the exact supported capabilities once the underlying template and skill are confirmed.

Security and operational notes

• Dedicated app registration: use a dedicated app registration for Glean, separate from other integrations.
• Least privilege: grant only the Microsoft Graph application permissions the agent needs.
• Admin consent: review admin consent carefully before saving the credential.
• Rotation: rotate the client secret regularly. Create a new secret, update the credential in Glean, then delete the old secret in Entra ID.

Troubleshooting

The client ID, tenant ID, or client secret is wrong. Re-check and re-enter the credential values.

The app lacks the required Graph permissions or admin consent. Add the required permissions and grant admin consent.

The app has fewer permissions than the use case requires. Review the app's Graph permissions.

The template isn't enabled for your deployment. Contact your Glean representative to turn it on.

See also

• Service credentials overview