Can a Service Principal [App] be configured to send system messages in a Teams chat/channel using MS Graph API

Question

Can a Service Principal [App] be configured to send system messages in a Teams chat/channel using MS Graph API

Soumya Prateek Raul 90 Microsoft Employee

Can a Service Principal [App] be configured to send system messages in a Teams chat/channel using MS Graph API.

Any doc that i can follow to setup this flow

0 comments

Answer accepted by question author

Kudos-Ng 15,050 Microsoft External Staff Moderator

Hi Soumya Prateek Raul,

Thank you for posting your question in the Microsoft Q&A forum.

As far as I know, the Microsoft Graph API endpoints used to send messages to a Teams chat or channel currently support only delegated permissions, which require a user context (user login / user token). Application permissions (app‑only / Service Principal) are not supported for sending normal chat or channel messages. App‑only permissions are only allowed for importing messages during migration scenarios, not for sending live messages.

Because of this, it is unfortunately not possible to configure a Service Principal (app‑only identity) to send messages in the way you described.

At the moment, the only valid approach to send messages into a Teams chat or channel without relying on a user’s identity is to use a Bot application (Azure Bot / Bot Framework). However, the bot must be added to the chat or channel before it can send any messages there.

Reference: https://learn.microsoft.com/en-us/graph/api/chatmessage-post?view=graph-rest-1.0&tabs=http

I hope this clarifies the current limitations and helps you move forward.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Sayali-MSFT 5,771 Reputation points Microsoft External Staff Moderator

2026-01-09T06:32:56.56+00:00

Hi Soumya Prateek Raul,Could you please confirm if your issue has resolved with provided suggestions or still looking for any help?
Vinay Aggarwal 0 Reputation points Microsoft Employee

2026-01-09T06:39:42.81+00:00

Thanks,
Can you please help with the steps on how to send a chat message using user context with spn.
Soumya Prateek Raul 90 Reputation points Microsoft Employee

2026-01-12T04:12:15.9766667+00:00

@Sayali-MSFT , can you please answer Vinay's above question , we are working together on this query . Thanks!
Sayali-MSFT 5,771 Reputation points Microsoft External Staff Moderator

2026-01-12T08:43:29.04+00:00
Hello Vinay Aggarwal,
Microsoft Graph does not allow sending Teams chat or channel messages using application-only (SPN-only) tokens. The Graph endpoints that send messages require delegated permissions. The correct way to combine a Service Principal with a user context is the OAuth 2.0 On-Behalf-Of (OBO) flow.

Register an Azure AD application (Service Principal).

Configure delegated Microsoft Graph permissions: - Chat.ReadWrite - ChatMessage.Send - ChannelMessage.Send

Implement OAuth 2.0 On-Behalf-Of flow to exchange a user token for a delegated SPN token.

Use the delegated token to send chat messages via Microsoft Graph: POST https://graph.microsoft.com/v1.0/chats/{chat-id}/messages
Body: { "body": { "content": "Hello from SPN using user context!" } }

Reference Document-
1.https://learn.microsoft.com/en-us/graph/api/chatmessage-post?view=graph-rest-1.0&tabs=http#permissions-for-chat
2.https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/import-messages/import-external-messages-to-teams
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-12T15:01:26.4633333+00:00
Hi Soumya Prateek Raul,

Thanks for the follow‑up.

Building on Sayali’s point, the OAuth 2.0 On‑Behalf‑Of (OBO) flow is key because it’s how you exchange the incoming user token for a delegated Graph token; only then can you post messages with the user’s context. See the official OBO guidance: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-on-behalf-of-flow

Practical steps:

Implement user sign‑in to obtain the user access token (e.g., Authorization Code + PKCE) using the Microsoft code samples: https://docs.azure.cn/en-us/entra/identity-platform/sample-v2-code?tabs=apptype

Send that user token to your server (confidential client) and perform AcquireTokenOnBehalfOf to get the delegated Graph token.

Hope this helps.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-13T14:22:17.1166667+00:00

Hi Soumya Prateek Raul,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.
Soumya Prateek Raul 90 Reputation points Microsoft Employee

2026-01-19T03:21:25.3333333+00:00

Yep that answers the concerns . Thanks for the help

1 additional answer

Your answer

Sayali-MSFT 5,771 Reputation points Microsoft External Staff Moderator

2026-01-09T06:32:56.56+00:00

Hi Soumya Prateek Raul,Could you please confirm if your issue has resolved with provided suggestions or still looking for any help?
Vinay Aggarwal 0 Reputation points Microsoft Employee

2026-01-09T06:39:42.81+00:00

Thanks,
Can you please help with the steps on how to send a chat message using user context with spn.
Soumya Prateek Raul 90 Reputation points Microsoft Employee

2026-01-12T04:12:15.9766667+00:00

@Sayali-MSFT , can you please answer Vinay's above question , we are working together on this query . Thanks!
Sayali-MSFT 5,771 Reputation points Microsoft External Staff Moderator

2026-01-12T08:43:29.04+00:00

Hello Vinay Aggarwal,
Microsoft Graph does not allow sending Teams chat or channel messages using application-only (SPN-only) tokens. The Graph endpoints that send messages require delegated permissions. The correct way to combine a Service Principal with a user context is the OAuth 2.0 On-Behalf-Of (OBO) flow.

Register an Azure AD application (Service Principal).

Configure delegated Microsoft Graph permissions: - Chat.ReadWrite - ChatMessage.Send - ChannelMessage.Send

Implement OAuth 2.0 On-Behalf-Of flow to exchange a user token for a delegated SPN token.

Use the delegated token to send chat messages via Microsoft Graph: POST https://graph.microsoft.com/v1.0/chats/{chat-id}/messages
Body: { "body": { "content": "Hello from SPN using user context!" } }

Reference Document-
1.https://learn.microsoft.com/en-us/graph/api/chatmessage-post?view=graph-rest-1.0&tabs=http#permissions-for-chat
2.https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/import-messages/import-external-messages-to-teams
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-12T15:01:26.4633333+00:00

Hi Soumya Prateek Raul,

Thanks for the follow‑up.

Building on Sayali’s point, the OAuth 2.0 On‑Behalf‑Of (OBO) flow is key because it’s how you exchange the incoming user token for a delegated Graph token; only then can you post messages with the user’s context. See the official OBO guidance: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-on-behalf-of-flow

Practical steps:

Implement user sign‑in to obtain the user access token (e.g., Authorization Code + PKCE) using the Microsoft code samples: https://docs.azure.cn/en-us/entra/identity-platform/sample-v2-code?tabs=apptype

Send that user token to your server (confidential client) and perform AcquireTokenOnBehalfOf to get the delegated Graph token.

Hope this helps.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-13T14:22:17.1166667+00:00

Hi Soumya Prateek Raul,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.
Soumya Prateek Raul 90 Reputation points Microsoft Employee

2026-01-19T03:21:25.3333333+00:00

Yep that answers the concerns . Thanks for the help

Answer 1

AI answer

Yes, a Service Principal can be configured to send messages in a Teams chat or channel. To set this up, you would typically use Power Automate to create a flow that utilizes the Service Principal to send messages. Here are the general steps you would follow:

Create a Service Principal: Ensure that you have a Service Principal created in Azure Active Directory that can be used to authenticate and send messages.
Set Up Power Automate: Use Power Automate to create a flow that triggers based on your desired event (e.g., when a file is created).
Use the Microsoft Teams Connector: In your flow, use the Microsoft Teams connector to post messages. You can configure the flow to send messages as the Service Principal.
Share Connections: Make sure that the connections required for the flow are shared with the Service Principal application user.
Test the Flow: After setting up the flow, test it to ensure that messages are being sent correctly to the Teams chat or channel.

For detailed instructions, you can refer to the documentation on using Power Automate and the capabilities of Service Principals in managing flows.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Share via

Can a Service Principal [App] be configured to send system messages in a Teams chat/channel using MS Graph API

1 additional answer

Your answer