Microsoft Graph Permissions for the Channels Integration
When a Microsoft 365 administrator consents to the Channels integration during setup, Newforma Konekt requests the following permissions from Microsoft Graph on behalf of the application. All permissions are read-only. The integration never writes to, modifies, or deletes anything in your Microsoft 365 tenant.
Permissions
Read the names and descriptions of all channelsChannel.ReadBasic.All
Allows Newforma Konekt to list the channels available in a team when you are linking a channel to a project. Only the channel name and ID are read — no message content is accessed.
Read the members of all channelsChannelMember.Read.All
Required to create the subscription that delivers real-time message updates to Newforma Konekt. Without this permission, live message syncing cannot be established.
Read all channel messagesChannelMessage.Read.All
Allows Newforma Konekt to retrieve messages, replies, edits, and deletions from a linked channel. Also required to register the webhook that delivers new messages in real time.
Read all users’ basic profilesUser.ReadBasic.All
Allows Newforma Konekt to display the name and avatar of the user who posted a message. Only basic profile information is accessed: name, email, and photo URL.
Get a list of all teamsTeam.ReadBasic.All
Allows Newforma Konekt to display a searchable list of teams when you are linking a channel to a project.
Read cross-tenant basic informationCrossTenantInformation.ReadBasic.All
Allows Newforma Konekt to authenticate correctly when your organization operates across multiple Microsoft 365 tenants.
Read files in all site collectionsFiles.Read.All
Allows Newforma Konekt to generate download links for file attachments shared in Teams messages. Attachments are hosted in SharePoint or OneDrive. No files are modified or deleted.
Read items in all site collectionsSites.Read.All
Allows Newforma Konekt to locate the SharePoint site hosting an attachment before generating a download link. Used in conjunction with Files.Read.All. No site content is modified or deleted.
Read all groupsGroup.Read.All
Required by the Microsoft Graph API to list teams and resolve team membership. No group content is modified or deleted.
Sign in and read user profileUser.Read (delegated)
Required by Microsoft to authenticate the administrator and read their basic profile during the consent flow. Required by Microsoft for any application that participates in the Azure AD consent process.
Summary
| Permission | Why it is needed |
|---|---|
Channel.ReadBasic.All | List channels for project linking |
ChannelMember.Read.All | Required to register real-time message subscriptions |
ChannelMessage.Read.All | Read and sync messages, replies, and edits |
User.ReadBasic.All | Resolve the sender’s display name on each message |
Team.ReadBasic.All | List teams for integration setup |
CrossTenantInformation.ReadBasic.All | Support cross-tenant scenarios |
Files.Read.All | Download file attachments shared in Teams messages |
Sites.Read.All | Locate the SharePoint site hosting an attachment |
Group.Read.All | Underlying Graph API dependency for Teams operations |
User.Read | Authenticate during the admin consent flow |