Microsoft Teams | Alephant Documentation

What it indexes

The Microsoft Teams connector indexes channel conversations from Teams resolved from the configured display-name hints. Each root channel message and its replies become one searchable document. It does not index one-to-one or group chats outside Team channels.

Setting	Indexing effect
Teams	Enter one or more Team display-name hints. Safe names use an OData lookup; names with special characters use paginated client-side filtering, and an OData failure also falls back to it. The fallback can match when at least 70% of the significant requested words are present.
Authority Host	Microsoft identity host used to obtain the application token.
Graph API Host	Microsoft Graph host used to list Teams, channels, messages, replies, members, and users.

The current runtime requires at least one Team name. Leaving the list empty returns no Teams and therefore indexes no content, even though older Admin form help text says an empty list indexes all Teams. Because the fallback is flexible, a display-name hint is not an exact allowlist and can resolve additional Teams.

Prerequisites

Create a Microsoft Entra application registration in the source tenant.
Grant administrator consent for application permissions sufficient to list Teams and channels, read channel messages and replies, enumerate channel members, and resolve member identities.
Record the application client ID, client secret, and directory (tenant) ID.
Prepare at least one intended Team display name as a lookup hint. Display names are used instead of IDs, are not guaranteed to be unique, and may match flexibly during client-side fallback.
Government cloud deployments must use the matching Microsoft authority and Graph API hosts.

Credentials

Method	OpenCore credential values	Notes
Microsoft application client secret	`teams_client_id: <CLIENT_ID>`, `teams_client_secret: <CLIENT_SECRET>`, `teams_directory_id: <DIRECTORY_ID>`	The connector uses the client-credentials flow with the configured Graph environment.

OAuth is not implemented for the Microsoft Teams indexing connector. Create and rotate the application secret through your organization’s normal credential process.

Configure in OpenCore

In the Admin panel, open Connectors, choose Microsoft Teams, and create the application credential.
Enter at least one Team display-name hint. Treat these values as discovery hints rather than a strict allowlist because the client-side fallback accepts a 70% significant-word match.
Leave the commercial authority and Graph hosts unchanged unless the tenant is in a supported government cloud.
Choose the document access mode your deployment exposes. Before selecting Auto Sync Permissions, account for the standard-channel Public behavior described below.
Set refresh and pruning options, create the connector, and run the initial index attempt.
Review every Team and channel actually resolved by the first index before attaching the document set to an Agent.

Permissions

When Auto Sync Permissions is available and selected, it is not complete Team-membership enforcement. Standard channels (membershipType: standard) are globally Public to all OpenCore users, so source Team membership is not enforced for those channels. Only non-standard channels are restricted to the member email identities that Microsoft Graph returns; members whose email cannot be resolved are omitted from that access list.

When Auto Sync Permissions is unavailable or not selected, source Team and channel membership is not enforced automatically in search. Use Private with explicit OpenCore user groups for restricted Teams, or Public only when every OpenCore account may search all indexed channel threads.

Verify

Confirm credential validation can access the Teams endpoint.
Run the first index attempt and inspect every Team actually resolved during the first index, including any Team not anticipated from the configured hints.
Search for a channel root message and text from one of its replies.
Confirm chats outside Team channels are absent, and review the resolved Team scope for unexpected flexible matches.
If Auto Sync Permissions is selected, confirm a standard channel is searchable by an OpenCore user outside the source Team, then test allowed and denied users only against a non-standard channel.

Troubleshooting

Symptom	Check
Validation returns 401	Verify the client ID, client secret, directory ID, authority host, and secret expiration.
Validation or indexing returns 403	Grant and consent the Microsoft Graph application permissions needed by the endpoint that failed.
The index attempt contains no Teams	Add at least one Team display name; an empty list produces no runtime matches.
A Team with `&` or parentheses is not found	Review the display-name hint and paginated client-side lookup; the search stops after its safety limit.
An unexpected Team is indexed	Client-side fallback accepts a case-insensitive match containing at least 70% of the significant words. Narrow the hint, rerun indexing, and review every resolved Team.
A user outside the source Team can search a standard channel	This is the current Auto Sync behavior: standard channels become globally Public in OpenCore. Use a stricter OpenCore access mode or avoid indexing that content if this exposure is unacceptable.
A restricted user cannot search an allowed channel	Verify Graph returns that channel member with an email or resolvable user principal name, then rerun permission sync.
Government cloud authentication fails	Use matching authority and Graph hosts from the same Microsoft environment.