# How to use Teams API as a User using Application Credentials
## Phase 1: Register the Application in Microsoft Entra ID
1. **Create the App Registration**
- Navigate to **App registrations** in the Microsoft Entra admin center.
- Click **New registration** (or verify current details if editing an existing one).
- Enter a **Name** for your application.
- Under **Supported account types**, select "Accounts in this organizational directory only" (Single tenant).
- Once created, go to the **Overview** page.
- **Copy and save** the **Application (client) ID** and **Directory (tenant) ID**. You will need these later.
2. **Configure Authentication (Redirect URI)**
- Go to the **Authentication** blade in the left menu.
- Click **Add a platform** and select **Web**.
- In the **Redirect URIs** field, enter your application's callback URL, it will follow this pattern: `https://credentials-{environment}.mindflow.io/oauth2/callback`.
- Ensure the URI matches exactly what your application expects for the OAuth handshake.
3. **Generate a Client Secret**
- Navigate to **Certificates & secrets** in the left menu.
- Click **New client secret**.
- Enter a **Description** (e.g., "New client secret") and select an expiration period.
- Click **Add**.
- **Important:** Copy the **Value** of the secret immediately. It will be hidden after you leave this page.
## Phase 2: Add API Permissions
You must configure the app to have **Delegated** permissions so it can act on behalf of a signed-in user.
1. **Add Permissions**
- Navigate to **API permissions** in the left menu.
- Click **+ Add a permission**.
- Select **Microsoft Graph**.
- Choose **Delegated permissions**.
- Search for and select the following permissions:
| **Permission Name** | **Type** | **Description** | **Admin Consent Required** |
| ---------------------------------- | --------- | --------------------------------------- | -------------------------- |
| **Channel** | — | — | — |
| `Channel.ReadBasic.All` | Delegated | Read names and descriptions of channels | No |
| `ChannelMember.Read.All` | Delegated | Read members of channels | **Yes** |
| `ChannelMessage.Read.All` | Delegated | Read user channel messages | **Yes** |
| `ChannelMessage.ReadWrite` | Delegated | Read and write user channel messages | **Yes** |
| `ChannelMessage.Send` | Delegated | Send channel messages | No |
| **Chat** | — | — | — |
| `Chat.Create` | Delegated | Create chats | No |
| `Chat.Read` | Delegated | Read user chat messages | No |
| `Chat.ReadWrite` | Delegated | Read and write user chat messages | No |
| `ChatMember.Read` | Delegated | Read members of chats | **Yes** |
| `ChatMember.ReadWrite` | Delegated | Add/remove members from chats | **Yes** |
| `ChatMessage.Read` | Delegated | Read user chat messages | No |
| `ChatMessage.Send` | Delegated | Send user chat messages | No |
| **Group & Team** | — | — | — |
| `Group-Conversation.Read.All` | Delegated | Read group conversations | **Yes** |
| `Group-Conversation.ReadWrite.All` | Delegated | Read/write group conversations | **Yes** |
| `Team.ReadBasic.All` | Delegated | Read names/descriptions of teams | No |
| `TeamMember.Read.All` | Delegated | Read members of teams | **Yes** |
| **User & Access** | — | — | — |
| `User.Read` | Delegated | Sign in and read user profile | No |
| `offline_access` | Delegated | Maintain access to data | No |
1. **Grant Admin Consent**
- After adding the permissions, you will see a status warning "Not granted for [Your Org]" for permissions requiring admin consent.
- Click the **Grant admin consent for [Your Organization]** button to approve these permissions for the tenant.
- The status should change to "Granted for [Your Organization]" with a green checkmark.
## Phase 3: Configure Credentials in Application
Now, connect your external application (e.g., Mindflow) to the Azure app you just created.
1. **Create New Credential**
- In your application, navigate to the credential creation page.
- **Service:** Select `Microsoft Graph - Teams`.
- **Credential Name:** Give it a recognizable name.
- **URL:** `https://graph.microsoft.com/v1.0`.
2. **Enter OAuth Details**
- **Client ID:** Paste the **Application (client) ID** from Phase 1.
- **Client Secret:** Paste the **Secret Value** from Phase 1.
- **Authorization URL:** `https://login.microsoftonline.com/{tenant—id}/oauth2/v2.0/authorize`.
- **Access Token URL:** `https://login.microsoftonline.com/{tenant—id}/oauth2/v2.0/token`.
- **Callback URL:** Ensure this matches the Redirect URI set in Phase 1 (e.g., `https://credentials-{environment}.mindflow.io/oauth2/callback`).
- Now, the Application is set. From now on, users from this Microsoft tenant will be able to create a credential more easily, by just sign in into that app. **No need for multiple Entra App.**
3. Sign in the App
- Now, as the user who wants to use Teams as themselves, create a new credential.
- Select Teams
- Here, you should see **Sign in with Microsoft Graph - Teams**.
- Click on this and you will be redirected to a Microsoft login page. Log in with the appropriate user account.
- Upon success, you should see a message like "Authorization Successful!".
- Now, your user credential is set. Upon running, it will use your identity to perform actions on the target resources, in this instance Teams, with the scopes attributed in the first steps of this tutorial.
## Phase 4: Verify Connection
- To test that newly created credential, head on to Flows and create a Flow.
- Create and run a test action, such as "List teams" from Teams API.
- Check the logs for a **200 OK** status code, confirming the permission setup is correct and the token is valid.
