Microsoft Teams
Connect Microsoft Teams to catch up on chats and channels, post and reply, read meeting transcripts, find people, and manage teams and shifts.
You register an app in the Microsoft Entra admin center, copy its Application (client) ID and a client secret Value into PopMCP, tick what PopMCP may do in Teams, then sign in with your work or school Microsoft account and approve access.
App review before this connector works
Microsoft reviews nothing: an app you register in the Microsoft Entra admin center can sign in straight away. Your organization is the gate. Reading chats and meetings, ticked by default, needs an administrator wherever Microsoft manages consent, and channel messages, team management, transcripts, Shifts and apps always need one.
- Typical wait
- None for teams, channels, your chat list, sending messages, people and presence. The other options wait until a Microsoft 365 administrator approves the app once.
- Cost
- Free. Registering an app and the calls PopMCP makes as you cost nothing. It needs a work or school account on Microsoft 365 with Teams; personal Microsoft accounts and Teams (free) cannot use Teams through Microsoft Graph.
- Blocked until approved
- Any option your administrator has not approved: Microsoft stops the whole sign-in with Need admin approval while one ticked option waits. The always-included part works without an administrator, unless your organization only lets admins approve apps at all.
- Works meanwhile
- Register the app, add PopMCP's Redirect URI, create the client secret and connect with only the options you can approve yourself (untick Read chats and meetings if Microsoft asks for an admin). Reconnect with more options ticked once the admin approves.
Where to apply: No application. An administrator of your organization (Global Administrator or Cloud Application Administrator) opens the app in the Microsoft Entra admin center (Entra ID, App registrations, your app, API permissions), adds the Microsoft Graph delegated permissions of the options you need and selects Grant admin consent. Or the administrator connects Teams in PopMCP once with those options ticked and checks Consent on behalf of your organization, or approves your request under Enterprise apps, Admin consent requests when your organization uses that workflow.
- Microsoft's consent is all or nothing: one ticked option that needs an administrator stops the whole sign-in until it is approved.
- Copy the client secret's Value, not its Secret ID. The Value is shown only once, right after you create the secret.
- Client secrets expire (24 months at most). When yours expires the connection stops: create a new secret and reconnect with it.
- Add the Redirect URI under Authentication as a Web platform, not as a Single-page application or Mobile and desktop one. An app registered as Single tenant only also needs its Directory (tenant) ID in the connect form.
- Teams limits how fast one app may read and post in the same team, chat or channel. Past that Microsoft answers 429 with a wait time, and PopMCP tells the AI how long to hold off.
- Change notifications on Teams chats and channels last at most an hour unless the subscription has a lifecycle notification URL, and then up to about three days before they must be renewed.
- Setup time
- 5 min
- Auth
- OAuth authorization
- API base URL
- https://graph.microsoft.com/v1.0
- Rate limits
- Teams throttles by app, by app per tenant, by team, chat or channel, and by user. Reading or posting messages is limited to 1 request a second per chat or channel, and listing chats to 1 a second per user and 20 a second per app per tenant. Microsoft answers 429 with a wait time. PopMCP's own fair use holds a one-click connection to 120 Teams requests a minute and an account to 600.
Before you begin
- A work or school Microsoft account on Microsoft 365 with Teams. Personal Microsoft accounts and Teams (free) cannot use Teams through Microsoft Graph.
- A Microsoft Entra tenant you can register apps in: your organization's (members can register apps unless an admin turned that off, and the Application Developer role always can).
- PopMCP's Redirect URI from the connect form: https://app.popmcp.com/api/providers/microsoft/callback
- For channel messages and files, team management, meeting transcripts and recordings, Shifts, or apps and tabs: a Microsoft 365 administrator who approves the app once. Reading chats and meetings needs one too in organizations where Microsoft manages consent.
Get your credentials
Open App registrations
Go to entra.microsoft.com and sign in. If you belong to several tenants, use the Settings icon in the top bar to switch to the one that should own the app. Open Entra ID > App registrations and select New registration.
App registrations
| Display name | Application (client) ID | Created on | Certificates & secrets |
|---|---|---|---|
| Marketing siteSingle tenant only | 4c5d****-****-****-****-****8e21 | 3/14/2026 | Current |
Owned applications lists the apps you registered yourself.
Register the app
Enter a Name people will recognize, such as PopMCP: Microsoft shows it when asking for access. Under Supported account types pick Multiple Entra ID tenants, then select Register. Teams works only with work or school accounts, so personal accounts are not needed. Single tenant only works too for your own organization, but then the app's Directory (tenant) ID goes into PopMCP as well.
Register an application
The user-facing display name for this application.
Add PopMCP's Redirect URI
On the new app, open Authentication under Manage. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, enter https://app.popmcp.com/api/providers/microsoft/callback exactly as PopMCP shows it, and select Configure.
PopMCP | Authentication
Choose Web, not Single-page application or Mobile and desktop: the address must match character for character.
Create a client secret
Open Certificates & secrets, stay on Client secrets and select New client secret. Enter a description such as PopMCP, choose when it expires (24 months at most; Microsoft recommends less than 12) and select Add. Copy the Value column straight away: Microsoft never shows it again. The Secret ID beside it is not the secret.
PopMCP | Certificates & secrets
| Description | Expires | Value | Secret ID |
|---|---|---|---|
| PopMCP | 4/24/2027 | Kq8~****************************3fZaCopy this one | 7d1e****-****-****-****-****0b9c |
Copy the Application (client) ID
Open Overview and copy the Application (client) ID. You only need the Directory (tenant) ID if you chose Single tenant only.
PopMCP
Overview
- Display name
- PopMCP
- Application (client) ID
- 2f6c****-****-****-****-****a91d
- Directory (tenant) ID
- 72f9****-****-****-****-****1db4
- Client credentials
- 0 certificate, 1 secret
- Redirect URIs
- 1 web, 0 spa, 0 public client
The Application (client) ID is a GUID. A value with a tilde in it is a client secret.
Get an administrator's approval (only if needed)
Teams, channels, your chat list, sending messages, people and presence need no administrator. Read chats and meetings (ticked by default) needs one in organizations where Microsoft manages consent, and the other options always do. An administrator (Global Administrator or Cloud Application Administrator) opens API permissions on the app, selects Add a permission > Microsoft Graph > Delegated permissions, adds the permissions listed for the options you want (for example Chat.Read, OnlineMeetings.Read and ChannelMessage.Read.All) and selects Grant admin consent for the organization. Or the administrator connects Teams in PopMCP once with those options ticked and checks Consent on behalf of your organization on Microsoft's page.
PopMCP | API permissions
| API / Permissions name | Type | Admin consent required | Status |
|---|---|---|---|
| Microsoft GraphUser.Read | Delegated | No | Granted for Contoso |
| Microsoft GraphChat.Read | Delegated | No | Not granted for Contoso |
| Microsoft GraphOnlineMeetings.Read | Delegated | No | Not granted for Contoso |
| Microsoft GraphChannelMessage.Read.All | Delegated | Yes | Not granted for Contoso |
Admin consent required shows Microsoft's default. Your organization's consent settings can still send a No permission to an administrator.
Fill in PopMCP and sign in
In PopMCP put the ID in Application (client) ID and the secret's Value in Client secret Value (the Directory (tenant) ID under More options only for a Single tenant only app). Under What PopMCP may do in Teams keep Read chats and meetings ticked to read chats and meetings, and tick any option your administrator approved. Select Sign in with Microsoft, pick your work or school account and select Accept. If Microsoft says Need admin approval, untick the options marked as needing approval and sign in again, or ask your administrator first.
Connect in PopMCP
Open your workspace, choose Microsoft Teams in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Application (client) IDtext | Only for your own app. In the Microsoft Entra admin center (entra.microsoft.com) open Entra ID, App registrations, New registration, pick Multiple Entra ID tenants under Supported account types (or Single tenant only, and fill in the Directory (tenant) ID below) and select Register, then copy the Application (client) ID from Overview. |
| Client secret Valuesecret | In the app registration open Certificates & secrets, Client secrets, New client secret, then Add, and copy the Value column right away (it is shown once). Stored encrypted and used only on our server.Encrypted with AES-256-GCM on save and never shown again. |
| Directory (tenant) IDtext | Only for an app registered as Single tenant only. Copy it from the app's Overview page. |
| What PopMCP may do in Teamschecklist | Teams, channels, chat lists, sending messages, people and presence are always included. Tick what else you need; options marked as needing approval only work after a Microsoft 365 administrator approves PopMCP for your organization. |
https://app.popmcp.com/api/providers/microsoft/callbackIn your app registration open Authentication, select Add Redirect URI, choose Web, enter this exact URL and select Configure. It must match exactly, or Microsoft refuses the sign-in. Every Microsoft connector uses this same URL.
PopMCP verifies the credential against Microsoft Teams immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions to request
PopMCP asks Microsoft Teams for exactly the permissions you tick in the connect form. Unticked permissions leave their tools listed but failing, so keep the defaults unless you have a reason to narrow them.
Microsoft Teams grants exactly what you tick. 0 of 6 are on by default.
Other
chats_meetingsRead chats and meetingsRead your chats and messages, and your Teams meetings with their attendance. Many organizations need an administrator to approve this.channel_messagesRead channel messages and filesRead the posts and replies in your channels and list the files in them. A Microsoft 365 administrator has to approve this.teams_adminManage teams, channels and membersSee and change team and channel members, settings and tags, create and delete channels, and restore deleted chats. A Microsoft 365 administrator has to approve this.meeting_recordingsMeeting transcripts and recordingsRead the transcripts and recordings of your Teams meetings (and Teams Premium virtual appointments). A Microsoft 365 administrator has to approve this.shiftsShifts schedulesRead and manage Shifts: shifts, open shifts, time off, swap requests and time cards. A Microsoft 365 administrator has to approve this.appsTeams apps and tabsSee and manage the apps and tabs in your teams and chats, the organization's app catalog and activity notifications. A Microsoft 365 administrator has to approve most of this.
Verify it worked
PopMCP shows Microsoft Teams as Connected under your sign-in address, with how many teams you are in, and teams_recent_chats lists your chats, newest first, with their latest message.
Troubleshooting
"The app's redirect URI does not match"
Why: Microsoft answered AADSTS50011: PopMCP's callback is not registered as a Web redirect URI on the app, or differs by a character.
Fix: Open **Authentication**, select **Add Redirect URI**, choose **Web**, enter `https://app.popmcp.com/api/providers/microsoft/callback` and select **Configure**, then connect again.
"Microsoft did not accept the app's client secret"
Why: The **Secret ID** was pasted instead of the secret's **Value** (AADSTS7000215), or the Value was cut short when copying.
Fix: Under **Certificates & secrets** create a new client secret, copy its **Value** right away and paste it into PopMCP.
"The app's client secret has expired"
Why: Client secrets last at most 24 months (AADSTS7000222).
Fix: Create a new client secret under **Certificates & secrets** and reconnect Microsoft Teams with its Value.
"Your app is registered for one organization only"
Why: A Single tenant only app was used without its tenant (AADSTS50194).
Fix: Copy the **Directory (tenant) ID** from the app's **Overview**, enter it under **More options** in PopMCP and connect again.
Microsoft says **Need admin approval**
Why: An option you ticked needs an administrator (Read chats and meetings where Microsoft manages consent; the other options always), or your organization lets only admins approve apps (AADSTS65001 or AADSTS90094). Microsoft's consent is all or nothing, so one such option stops the whole sign-in.
Fix: Untick the options marked as needing approval and connect again, or ask an administrator to grant admin consent for those permissions (see the approval step), then connect with them ticked.
"Microsoft Teams works with work or school accounts only"
Why: You signed in with a personal Microsoft account (Outlook.com, Hotmail, Live or Teams free). Microsoft offers no Teams access through Microsoft Graph for those.
Fix: Connect again and sign in with the work or school account your organization gave you.
"Microsoft signed in but would not list your teams"
Why: A permission was declined on the consent screen, your organization still has to approve the app, or the account has no Teams license.
Fix: Connect again and approve every permission, ask your administrator to approve the app, or ask them to assign a license that includes Teams.
A tool answers "This needs ChannelMessage.Read.All, which comes with Read channel messages and files"
Why: The connection was made without that option, so PopMCP refuses before asking Microsoft. Other tools name their own option the same way.
Fix: Reconnect Microsoft Teams with the named option ticked under **What PopMCP may do in Teams**. Options marked as needing approval work once an administrator approves them.
"Not approved yet (ask a Microsoft 365 administrator)" on the connection
Why: You ticked an option, but the token Microsoft issued does not carry its permissions yet.
Fix: Ask an administrator to grant admin consent for the permissions of that option, then reconnect.
429 Too Many Requests
Why: Teams limits each app per tenant, per team, chat or channel, and per user: for example 1 message a second per chat or channel, and listing chats about once a second per user.
Fix: Wait the time Microsoft gives and try again. teams_recent_chats, teams_read_chat, teams_read_channel and teams_batch_read do in one call what would otherwise take many.