{ "schema": "aaes/capability-pack/1", "provider": "teams", "version": "1.0.0", "description": "Read Microsoft Teams channel messages, replies and chat messages through Graph v1.0; reply in a channel thread and send in an existing chat with a delegated user token.", "notes": "TEAM_ID, CHANNEL_ID, MESSAGE_ID and CHAT_ID in the endpoint paths are placeholders. Before enabling, substitute the concrete team, channel, root message and chat each registration may reach; never enable the literal placeholders. The host stays graph.microsoft.com. The connector dials the registered path and ignores a caller's path or query, so each reply registration is bound to one channel thread (one MESSAGE_ID) and each chat registration to one chat: replying in another thread or chat is a new registration under the deployment's change control.\n\nThis pack adds to microsoft365. microsoft365.teams.channel_message.send posts a new top-level channel message; this pack adds reading channel messages and their replies, replying inside an existing channel thread, and reading and sending messages in an existing one-on-one or group chat. It declares its own resources (teams-channel-thread and teams-chat), so it installs beside microsoft365 without a resource-id conflict; teams-channel-thread names the same channel locator as microsoft365's teams-channel resource.\n\nEvery capability uses one delegated Microsoft Graph access token under secret-ref-msgraph-delegated-token, the same reference and contract as microsoft365's Teams channel post. Microsoft documents application permissions for channel replies and chat sends only for message import (Teamwork.Migrate.All, migration), so ordinary sending needs a delegated user. The least delegated permissions Microsoft lists are ChannelMessage.Read.All for channel messages and replies, ChannelMessage.Send for channel replies, Chat.Read for chat messages and ChatMessage.Send for chat sends. Consent only the permissions for the capabilities you enable. A delegated token acts as one signed-in user within that user's own access, so chat reads reach only chats that user can read, and every message the agent sends appears as that user.\n\nReads can also run app-only: Microsoft lists ChannelMessage.Read.Group and ChatMessage.Read.Chat (resource-specific consent) as the least application permissions for these reads. This pack does not register that variant; a deployment that wants it registers its own copy with a separate application-token reference.\n\nChannel replies and chat sends declare send at the minimum R3 tier. Send is one of the designated irreversible actions: recipients may have read a message even if it is later deleted, and on supported AAES-mediated execution paths the call needs approval by an authorized person. That does not cover bypass or observation-only paths. The request body is the caller's chatMessage JSON and is not restricted by this pack: mentions, attachments, cards and importance are whatever the body says. Microsoft's terms forbid using Teams as a log file; only send messages people will read.\n\nChannel message lists return root messages without replies, 20 per page by default; replies are listed per root message. Chat message lists allow at most 50 per page. Caller query parameters do not change the dialed URL, so paging tokens and $top values must be bound into the registration by change control. Collection responses can be incomplete and this pack supplies no automatic pagination. Message bodies can embed hostedContents URLs on graph.microsoft.com; fetching them is not registered.\n\nExcluded, checked against the chatMessage method inventory: getting a single message or reply by id, top-level channel posts (in microsoft365), reply with quote, policyViolation updates, soft delete and undo, set and unset reaction, hosted content list and download, the getAllMessages APIs for chats and channels, chat message delta, change-notification subscriptions, and the /me and /users chat-message routes. Also excluded: creating chats, file attachments, adaptive-card actions, message import (Teamwork.Migrate.All), channel, team and membership management, meetings and calls, beta APIs and sovereign-cloud hosts. Only the five listed Graph v1.0 operations are registered.\n\nOpen custody review, pending owner: the delegated token's issuance (authorization-code flow and who signs in), audience and consented permissions, renewal ownership and refresh-token custody, revocation delay, executor access, custody-source errors, logs, memory and crash handling, bypass paths, and live tenant verification. Documentation review and synthetic fixtures do not close that review.\n\nAAES has not been certified by Microsoft; the endpoints here are configuration to review and test, and the vendor has not endorsed it.", "credential": { "secret_ref_id": "secret-ref-msgraph-delegated-token", "custody": "customer_vault", "inject": "header", "inject_name": "Authorization", "note": "Store the complete Authorization header value, 'Bearer ', where is a delegated Microsoft Graph access token for one signed-in user, obtained with the authorization-code flow and renewed by an external process that owns any refresh token. Never store a refresh token, ID token, client secret, certificate, authorization code or token-response JSON. Access-token lifetime varies; the external process uses the issued expiry and replaces the stored value before it lapses. An expired or revoked value fails closed at the provider. Resolve the value only at execution; the custody source must never put material in its errors, and the deployment must keep the value out of logs, traces and crash dumps. This is the same reference and contract as microsoft365.teams.channel_message.send." }, "capabilities": [ { "capability_id": "teams.channel.messages.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/teams/TEAM_ID/channels/CHANNEL_ID/messages", "method": "GET", "connector": "http", "actions": [ "read" ], "resource_id": "teams-channel-thread", "description": "List the root messages of one channel, without replies. Message bodies, senders and mentions are personal data, so the read is pii. TEAM_ID and CHANNEL_ID are placeholders.", "requires_review": true }, { "capability_id": "teams.channel.replies.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/teams/TEAM_ID/channels/CHANNEL_ID/messages/MESSAGE_ID/replies", "method": "GET", "connector": "http", "actions": [ "read" ], "resource_id": "teams-channel-thread", "description": "List the replies to one channel message. Reply bodies and senders are personal data, so the read is pii. TEAM_ID, CHANNEL_ID and MESSAGE_ID are placeholders.", "requires_review": true }, { "capability_id": "teams.channel.reply.send", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/teams/TEAM_ID/channels/CHANNEL_ID/messages/MESSAGE_ID/replies", "method": "POST", "connector": "http", "actions": [ "send" ], "resource_id": "teams-channel-thread", "description": "Reply in one channel thread as the signed-in user. A sent reply may be read before any deletion, so send carries the minimum R3 tier and needs human approval. The reply carries the user's identity, so the capability is pii. TEAM_ID, CHANNEL_ID and MESSAGE_ID are placeholders.", "requires_review": true }, { "capability_id": "teams.chat.messages.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/chats/CHAT_ID/messages", "method": "GET", "connector": "http", "actions": [ "read" ], "resource_id": "teams-chat", "description": "List the messages in one existing chat. Chat messages and participants are personal data, so the read is pii. CHAT_ID is a placeholder.", "requires_review": true }, { "capability_id": "teams.chat.message.send", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/chats/CHAT_ID/messages", "method": "POST", "connector": "http", "actions": [ "send" ], "resource_id": "teams-chat", "description": "Send a message in one existing chat as the signed-in user. A sent message may be read before any deletion, so send carries the minimum R3 tier and needs human approval. This cannot create a chat. CHAT_ID is a placeholder.", "requires_review": true } ], "resources": [ { "resource_id": "teams-channel-thread", "kind": "channel", "locator": "https://graph.microsoft.com/v1.0/teams/TEAM_ID/channels/CHANNEL_ID", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "teams-chat", "kind": "channel", "locator": "https://graph.microsoft.com/v1.0/chats/CHAT_ID", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" } ], "review": { "state": "draft", "date": "2026-10-29", "sources": [ "https://learn.microsoft.com/en-us/graph/api/channel-list-messages?view=graph-rest-1.0 (retrieved 2026-10-29)", "https://learn.microsoft.com/en-us/graph/api/chatmessage-list-replies?view=graph-rest-1.0 (retrieved 2026-10-29)", "https://learn.microsoft.com/en-us/graph/api/chatmessage-post-replies?view=graph-rest-1.0 (retrieved 2026-10-29)", "https://learn.microsoft.com/en-us/graph/api/chat-list-messages?view=graph-rest-1.0 (retrieved 2026-10-29)", "https://learn.microsoft.com/en-us/graph/api/chat-post-messages?view=graph-rest-1.0 (retrieved 2026-10-29)", "https://learn.microsoft.com/en-us/graph/api/resources/chatmessage?view=graph-rest-1.0 (retrieved 2026-10-29)" ], "reviewer_id": "aaes-eng" } }