---
title: Microsoft Teams
slug: authentication-guides/microsoft-teams
docTags: 
createdAt: 2026-01-19T20:12:49.428Z
---

# Introduction

This guide explains how to authenticate the Microsoft Teams connector in Swimlane using one of the following authentication methods:

- OAuth 2.0 Client Credentials (Application permissions)
- OAuth 2.0 Password Grant (Delegated permissions)
- OAuth 2.0 Refresh Token Grant (Delegated permissions with MFA)

You will create an Azure app, assign permissions, collect the required identifiers, and configure the connector inside Swimlane.

# Prerequisites

## Azure Access Requirements

- Register applications in Azure Active Directory
- Assign API permissions (Application + Delegated)
- Grant admin consent
- View tenant and directory information
- Create client secrets

## Required Credentials

- Client ID
- Client Secret
- Tenant ID
- Token URL
- Scope
- (For delegated auth) Username and Password
- (For refresh token flow) Refresh Token

# Authentication Methods Overview

## OAuth 2.0 Client Credentials

Used for non-MFA accounts and for most server-to-server automations.

You will need:

- Client ID
- Client Secret
- Tenant ID
- Token URL (must include Tenant ID)
- Scope(s)

## OAuth 2.0 Password Grant (Delegated)

## Used when the connector must act on behalf of a user.

You will need:

- Username
- Password
- Client ID
- Client Secret (optional)
- Token URL
- Scope(s)

## OAuth 2.0 Refresh Token Grant (Delegated + MFA)

Use when the Teams or Microsoft 365 account has MFA enabled.

You will need:

- Client ID
- Client Secret
- Refresh Token
- Tenant ID
- Redirect URI (added during Azure App Registration)

# Azure Setup

## Register the application

1. Go to **Azure Portal > Azure Active Directory > App registrations**.
2. Click **New registration**.
3. Enter an application name.
4. Select Accounts **in this organizational directory only**.
5. Click **Register**.

## Assign API permissions

1. Open **API permissions**.
2. Click **Add a permission**.
3. Select Microsoft Graph.
4. Add the required permissions based on your Microsoft Teams actions:
   - ChannelMember.ReadWrite.All
   - TeamMember.ReadWrite.All
   - Channel.Create
   - Channel.Create.Group
   - Directory.ReadWrite.All
   - Group.ReadWrite.All
   - Team.Create
   - Teamwork.Migrate.All
   - Click Add permissions.
   - Click Grant admin consent for your organization.

## Create a Client Secret

1. Navigate to **Certificates & secrets**.
2. Click **New client secret**.
3. Add description and expiration.
4. Click **Add**.
5. Copy and save the secret value.

## Collect required identifiers

- Client ID
- Tenant ID

## Password Grant Requirements

- oauth2\_username → Azure username
- oauth2\_password → Azure password

:::hint{type="info"}
If MFA is enabled, use **Refresh Token Flow** instead.
:::

## Refresh Token Flow Setup

1. Add a Redirect URI (Platform: Web) during registration.
2. Assign Delegated Permissions.
3. Use the Swimlane-provided Python script to generate a refresh token.

# Connector Configuration in Swimlane

1. Log into** Turbine**.
2. Click **ORCHESTRATION.**
3. Click **Assets**.
4. Click the **+ **icon to create a new asset.
5. Select Microsoft Teams from the **Asset Type** list.
6. Fill in the **Asset Settings **and **Asset Input** as shown as per your authentication method:

## Configuration - Client Credentials

| **Field**      | **Description**   | **Required** |
| -------------- | ----------------- | ------------ |
| url            | API endpoint      | Required     |
| token\_url     | Token URL         | Required     |
| client\_id     | Client ID         | Required     |
| client\_secret | Client Secret     | Required     |
| scope          | Permission scopes | Required     |
| verify\_ssl    | SSL verification  | Optional     |
| http\_proxy    | Proxy details     | Optional     |

Fields with \* marks are required.  

**Token URL format:**

[https://login.microsoftonline.com/{tenant\_id}/oauth2/v2.0/token](https://login.microsoftonline.com/\{tenant_id}/oauth2/v2.0/token)

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/-eAds-5Qou0MdBrdp069p-20260121-060830.png)

## Configuration - Password Grant (Delegated Authentication)

| **Field**        | **Description**  | **Required/Optional** |
| ---------------- | ---------------- | --------------------- |
| url              | API endpoint     | Required              |
| token\_url       | Token URL        | Required              |
| oauth2\_username | Username         | Required              |
| oauth2\_password | Password         | Required              |
| client\_id       | Client ID        | Required              |
| client\_secret   | Client Secret    | Optional              |
| scope            | Delegated scopes | Required              |
| verify\_ssl      | SSL verification | Optional              |
| http\_proxy      | Proxy details    | Optional              |

Fields with \* marks are required.  

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/jv7Hsb3md67LQ7rg1jnlY-20260121-060830.png)

## Configuration - Refresh Token Grant (Delegated + MFA)

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/TX_wt-w8ylaKB24z1EZ63-20260121-060830.png)

| **Field**      | **Description**  | **Required/Optional** |
| -------------- | ---------------- | --------------------- |
| url            | API endpoint     | Required              |
| tenant\_id     | Tenant ID        | Required              |
| cl\_id         | Client ID        | Required              |
| cl\_secret     | Client Secret    | Required              |
| refresh\_token | Refresh Token    | Required              |
| verify\_ssl    | SSL verification | Optional              |
| http\_proxy    | Proxy details    | Optional              |

Fields with \* marks are required.  

7. Click **Create.**

# Troubleshooting

**Error: 403 Forbidden**

**Occurs when:**

- Missing Graph or Teams permissions
- Missing admin consent
- Incorrect tenant or token URL
- Using Application permissions where Delegated is required

**Fix:**

- Re-grant admin consent
- Verify permissions
- Ensure token URL includes the correct tenant ID

You have successfully authenticated the Microsoft Teams Connector using one of the supported OAuth flows.