> ## Documentation Index > Fetch the complete documentation index at: https://docs.consile.ai/llms.txt > Use this file to discover all available pages before exploring further. # Connect Teams > Approve Consile at Microsoft with your work account. Teams requires a Microsoft 365 administrator to consent to channel messages for the whole organization. All permissions are read permissions, and the access can be revoked. *[Læs siden på dansk](https://docs.consile.ai/connect/forbind-teams.md)* You connect Teams by logging in at Microsoft with your work or school account and approving Consile. Consile stores the resulting access encrypted per customer. Your AI never sees the access itself, only answers to your questions. See [Teams](https://docs.consile.ai/en/connectors/teams.md) for what the connector can do. > [!NOTE] > > You need an active Teams subscription in the [portal](https://app.consile.ai), or the > system must be included in your plan ([the free edition](https://docs.consile.ai/en/portal/free-edition.md) or > [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md)). You must log in with a > Microsoft work or school account that uses Teams. And a Microsoft 365 administrator > must consent for the organization (see below). Your AI > ([Claude](https://docs.consile.ai/en/connect/connect-claude.md) or [ChatGPT](https://docs.consile.ai/en/connect/connect-chatgpt.md)) can > be added before or after. > [!NOTE] > > The connection applies to your whole Consile account. All users with access to Teams > in Consile read through the Microsoft user that is connected. They see that user's > teams and channels and also the user's own chats, even if a colleague connected it. > Anyone on the team can connect an agreement that is not connected yet. Only an > administrator can reconnect it or disconnect it, because that changes the connection > for everyone. If an administrator reconnects with a different Microsoft account, it > replaces the existing connection. ## Choose the right Microsoft user The Microsoft user you log in with decides what your AI can see: the teams and channels the user is a member of, and the user's own 1:1 chats, group chats and meeting chats. All colleagues with access to Teams in Consile read through the same user. So do not connect with an account whose chats your colleagues should not be able to read. Consider an account that is a member of the teams your AI should read, but is not used for private conversations. ## Administrator consent Teams asks Microsoft for the permission `ChannelMessage.Read.All`, so your AI can read posts and replies in the channels. Microsoft only lets an administrator grant that permission, and the consent is given for the whole organization. This happens once. Without that consent, Teams cannot be connected: Consile refuses a connection that is missing the permission instead of storing an access that can only read chats. If a user without those rights tries to connect, Microsoft stops at a page saying that an administrator's approval is required (*Need admin approval*). The user cannot continue from there. There are two ways to give the consent: **1. The administrator connects (easiest)** An administrator who may consent for the organization at Microsoft (for example a Global Administrator) follows the steps under [How to connect](#how-to-connect). On Microsoft's consent screen, the administrator ticks *Consent on behalf of your organization* and accepts. The consent is then given for the whole organization, and the agreement is connected with the administrator's account. **2. The user requests approval** If your organization has turned on Microsoft's admin consent workflow, the user can send a request for approval from Microsoft's page. The administrator approves it in the Microsoft Entra admin center. Then the user tries to connect again from the Consile portal. > [!NOTE] > > Which administrator roles may consent, and whether the admin consent workflow is > turned on, depend on your own setup at Microsoft. If Microsoft still stops the user > after the consent has been given, connect with the administrator's account, or write > to [support@consile.dk](mailto:support@consile.dk). ## How to connect **1. Open the connector in the portal** Go to Teams in the [portal](https://app.consile.ai). Click **Connect now** at the top of the page, or **Connect** next to the agreement on the **Connections** card. The portal calls each connection to the system an agreement. Right after the purchase, the **Connect Teams** button on the **Subscription activated** page takes you to that page. If you have not accepted Consile's terms yet, you are asked to do so first. **2. Authorise access** In the **Connect Microsoft** step, the portal shows the six permissions Consile asks Microsoft for: `Team.ReadBasic.All`, `Channel.ReadBasic.All`, `ChannelMessage.Read.All`, `Chat.Read`, `User.Read` and `offline_access`. Click **Authorise access**. You are sent to Microsoft's login. **3. Log in with your work account** Log in with the Microsoft work or school account that should be connected. Microsoft refuses a login with a personal Microsoft account. **4. Confirm with Microsoft** Microsoft shows the permissions Consile is asking for. If you are an administrator and the consent has not been given before, tick *Consent on behalf of your organization*. Confirm to continue. You are then sent back to the portal. > [!TIP] > > The portal shows **Teams is connected**, and the agreement shows as > **Connected**. On the connector's page, the agreement is named after the > connected user, for example ` (name@example.com)`. Your AI can now read the > user's teams, channels and chats. If you have not already added the address > `https://mcp.consile.ai/teams/mcp` in your AI, do it now. > [!TIP] > > The connection is shared by the whole company, so colleagues do not have to connect > Teams again. An administrator gives them access under **Team**, and each colleague > adds the address in their own AI and logs in with their own Consile login. See > [Team](https://docs.consile.ai/en/portal/team.md). ## What exactly am I approving? > [card] Read-only > > All the permissions are read permissions. Consile has no write tools for Teams and > only sends read requests. Your AI cannot write, reply or delete anything. > `offline_access` gives the renewable access that keeps the connection alive. > [card] Microsoft Graph only > > The approval applies to Microsoft's shared API for Microsoft 365. If one of the > permissions Consile asks for is missing, or the approval contains permissions for > services other than Microsoft Graph, the connection is refused. > [card] Encrypted per customer > > Consile stores the access encrypted with a key that applies only to your account, > and never logs it. The messages are not stored. The access is renewed > automatically in the background. > [card] Your AI never sees it > > Your AI is never given the access itself, only answers to your questions. ## The access is renewed, but the connection can stop Consile renews the access automatically, so you do not have to reconnect during normal use. > [!WARNING] > > If the renewal fails, or Microsoft refuses the access (for example because Consile > has been removed in your Microsoft organization, or the consent for channel messages > has been withdrawn), your AI is told that the connection must be set up again from > the Consile portal. The portal can still show **Connected**, because the stored > access is still there. How an administrator reconnects: * If the agreement says **Access revoked**, click **Reconnect**, and follow the steps above. * Otherwise: click the menu (the three dots) next to the agreement on the **Connections** card, choose **Disconnect**, and confirm with **Disconnect**. Then click **Connect**, and follow the steps above. * You can also ask your AI for a new connection link. Ask in the connector that belongs to the agreement (for example `teams-2`), so the link connects exactly that agreement. > [!NOTE] > > If your AI is instead told that Teams answered 403, the connected user cannot see > that team, channel or chat, or your organization has not consented to the permission > the lookup needs. Reconnecting does not help. Ask a Microsoft 365 administrator for > help. ## If the connection fails If the approval does not succeed, the portal shows **Connection was not completed** and a technical reason. The most common ones: * `unknown`: Microsoft did not grant all the permissions Teams requires. For Teams, this is typically because the consent for `ChannelMessage.Read.All` is missing. Have an administrator give the consent (see [Administrator consent](#administrator-consent)), and try again. If the reason comes back after the consent has been given, write to support. * `token_exchange_failed`: Microsoft did not send back a valid approval, typically because you cancelled at Microsoft. Try again, and approve the access. * `unexpected_scope`: the approval contained permissions for services other than Microsoft Graph. Try again. * `no_refresh_token`: Microsoft did not return renewable access. Try again. * `state_expired`, `invalid_state` or `state_unknown_or_consumed`: more than 10 minutes passed, or the same approval was used twice (for example with the browser's back button). Start over in the portal. If you are stuck on Microsoft's page about administrator approval, you do not get back to the portal. See [Administrator consent](#administrator-consent). Click **Try again** to get back to the connector's page, and start over with **Connect now** or **Connect**. If that does not help, write to [support@consile.dk](mailto:support@consile.dk) and include the technical reason. ## Multiple Microsoft users One agreement is one Microsoft user's Teams. There are two reasons to add another agreement: * **Another Microsoft user.** Your AI should be able to read teams, channels or chats that another user has access to. * **Another Microsoft organization.** Connect the new agreement with a work account in the other organization. That organization must also give administrator consent. **1. Add an agreement** Open Teams in the portal. On the **Connections** card, an administrator clicks **Add agreement (149.50 kr/mo.)**. The agreement is added to the existing subscription and charged pro rata for the rest of the period. **2. Connect the agreement** When the new agreement is ready (typically after a few seconds), click **Connect** next to it and complete the steps above with the other Microsoft user. **3. Add the address in your AI** Each agreement has its own address, for example `https://mcp.consile.ai/teams-2/mcp`. Copy it from the card, and add it as an extra connector in your AI. If you connect a new agreement with the same Microsoft user as an existing agreement, the page after the connection says *Note: This account was already connected as another portal, so that connection was refreshed instead. The new slot is still free.* The word portal here means agreement. Connect the new agreement with another user. Under [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md#one-more-agreement-in-a-system) and in [the free edition](https://docs.consile.ai/en/portal/free-edition.md), other rules apply to adding an agreement. The **Connections** card shows what applies to you. An administrator removes an agreement with the menu next to it: choose **Remove the agreement**, and confirm with **Remove agreement**. If you remove an agreement that is not the last one, the last agreement moves up into the free slot and takes its address (for example `https://mcp.consile.ai/teams-2/mcp` instead of `https://mcp.consile.ai/teams-3/mcp`). You must update the address in your AI. You remove the last agreement by cancelling the subscription under **Subscription**. ## Revoke access You can remove the access again at any time: * **In the portal:** an administrator clicks the menu (the three dots) next to the agreement on the **Connections** card, chooses **Disconnect** and confirms with **Disconnect**. The stored access is deleted at Consile right away. The subscription continues until an administrator cancels it under **Subscription**. If you have several agreements, an administrator can also remove an agreement entirely with **Remove the agreement**. Its access is then deleted too. * **At Microsoft:** the consent stays in your Microsoft organization until you remove it yourselves. If you also want to remove it, an administrator does so under **Enterprise apps** in the Microsoft Entra admin center. Shortly after, the connector stops working, but the portal can still show it as **Connected** until you disconnect it in the portal. * **When the subscription ends:** if you cancel Teams under **Subscription**, Consile automatically deletes the stored access when the subscription ends. If a payment is only late, the tools do not work in the meantime, but the stored access is kept, so the connection works again without a new approval once the payment is in place. More about data processing in [Security & data](https://docs.consile.ai/en/essentials/security-and-data.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.