Microsoft Teams Development

Question

Hello,

Our Azure application is configured with the following Microsoft Graph application permissions:

• Chat.Read.All
• Chat.ReadWrite.All

Admin consent has already been granted for these permissions.

The app runs as a backend service using application permissions. When calling:

GET https://graph.microsoft.com/v1.0/chats/{chat-id}/messages

we receive the following response:

403 Forbidden – InsufficientPrivileges

According to Microsoft documentation, Teams chat APIs accessed via application permissions are classified as Protected APIs and require explicit Microsoft approval.

Could someone please confirm the process to request Protected API access for this application, or advise on how to escalate this request to the Teams Graph approval team?

Any guidance would be greatly appreciated.

Thank you!

Answer 1

Hello Ian Cooke,

As discussed offline, Reading 1:1 chat messages within your tenant now works with application permissions (Chat.ReadWrite.All), as you confirmed.

For sending messages, you have implemented delegated auth using the OAuth Authorization Code flow where each user signs in once, store their tokens, and messages send as the user.

Regarding the group chat that was originally failing with 403 AclCheckFailed this was a cross-tenant chat. The participants include members from both tenants. As Application permissions are scoped to the app's home tenant, so accessing chats with external tenant participants is not possible.

Granted Chat.ReadWrite.All Application type API permission to the Microsoft Entra ID application:

Generated access token using client credential flow:

Make sure to generate the scope as https://graph.microsoft.com/.default

Using the above token, I am able to successfully call the API:

GET https://graph.microsoft.com/v1.0/chats/ChatID/messages

Answer 2

Unfortunately, I can’t see a way to make this work externally. It functions well within our own tenant, and we’ll continue building out the rest of the system internally — calendar, mail, and the broader integrations all look fine.

However, group chat with users outside our tenant doesn’t appear to be viable, so we’ll treat that as a closed route for now. Not ideal, but not a major issue either.