1

I would like to create a webservice capable of automatically sending messages in Microsoft Teams. I tried authenticating as an application, but currently Microsoft does not support granting application permissions to send messages in Teams, so the only choice here is to authenticate using a service account with real credentials (Unless there is another way?). This method only specifies using user interaction to log in as a user.

I would like to use a service account teamchatbot@domain.com to authenticate with Microsoft Graph in order to send messages on Microsoft Teams. (similar to this but since I'm not accessing a resource it is a little different.) Is there a way I can silently obtain an access token on behalf of the service account in order to send messages?

Hilton Giesenow
  • 9,809
  • 2
  • 10
  • 24
Josh Sharkey
  • 1,008
  • 9
  • 34

2 Answers2

1

It seems that you have a misunderstanding.

Your scene is actually the same as this post.

You should use Resource Owner Password Credentials to call Microsoft Graph API to send messages.

Based on permissions, you need the Group.ReadWrite.All delegated permission. So you need to add this permission into your Azure AD app firstly.

enter image description here

Don't forget to click on "Grant admin consent for {your tenant}" after you add this permission.

Then you can get an access token like this:

enter image description here

You can see that https://graph.microsoft.com/Group.ReadWrite.All has been included in the response.

Now you could use this access token to call POST /teams/{id}/channels/{id}/messages.

Allen Wu
  • 15,529
  • 1
  • 9
  • 20
  • Just be aware of the downsides of the ROPC flow https://joonasw.net/view/ropc-grant-flow-in-azure-ad – juunas Jan 22 '20 at 06:11
  • 1
    Yes. And ROPC flow is not recommended because your password will be sent in the request. In another word, it is not safe. – Allen Wu Jan 22 '20 at 06:15
  • Thanks, I will give it a shot. You said, "then you can get an admin token like this:" Is there something missing after that part? – Josh Sharkey Jan 22 '20 at 07:08
  • @JoshSharkey No. There is nothing missing. I mean you can refer to my screenshot. Anything unclear? – Allen Wu Jan 23 '20 at 04:17
  • Random question to add on: will the service account then need a office365 team license to send messages? – Josh Sharkey Jan 30 '20 at 00:13
  • @JoshSharkey Yes. Team license is required. – Allen Wu Feb 03 '20 at 01:50
  • @AllenWu unrelated -- can you help me find the documentation for assigning a team license to an office account. – Josh Sharkey Feb 03 '20 at 02:53
  • @JoshSharkey See this: https://learn.microsoft.com/en-us/office365/admin/manage/assign-licenses-to-users?view=o365-worldwide#assign-licenses-to-users-on-the-licenses-page. – Allen Wu Feb 03 '20 at 03:29
0

There are a few other ways I can think of.

1) One is that you can create a Bot using the Microsoft Bot Framework, and once that bot is installed to the particular team, it can send "pro-active" messages (i.e. not a message in response to a user's message, but rather whenever you need).

Essentially, when you bot is added to the team, you get access to a specific event in your bot (OnMembersAdded for a general bot, and there's now a new event just for Teams). See more on this in my answer on Detect bot application open event. In this event, you get the information you need for later, which you can store in a database or wherever, and then create the message as if it's your bot posting to the channel. You can see more on that at Programmatically sending a message to a bot in Microsoft Teams.

This option above is a lot of work, but useful if there's other functionality you want from a bot (e.g. the ability to receive messages from the users)

2) Another, and even more simple way, is to create an incoming webhook directly to the channel. Here's a post on doing this using PowerShell, so you can do that for simple testing and extrapolate from there for Node.

Of course, things like Flow (Power Automate) are an option too, but you're already writing code so one of the above is probably easier.

Hope that helps

Hilton Giesenow
  • 9,809
  • 2
  • 10
  • 24