What it does

Microsoft Graph is the programmatic way into Teams data — teams, channels, chats, messages, members, meetings, recordings and transcripts. Change notifications let an app subscribe to those resources and get a webhook call when something changes, instead of polling.

Key facts

• Supported change notification resources: callRecording, callTranscript, channel, chat, chatMessage, conversationMember, team and teamsAppInstallation.
• Subscriptions can be tenant-wide (for example every channel message via /teams/getAllMessages, every chat message via /chats/getAllMessages) or resource-specific (one channel, one chat, one meeting).
• Learn states a maximum subscription lifetime of 60 minutes for Teams resources, renewable while the caller still has access. Your app has to renew continuously.
• Notifications can include resource data. If they do, the payload is encrypted and you must supply an encryption certificate in the subscription. Without resource data, you get metadata and fetch the object with a GET.
• Teams APIs stopped being metered from 25 August 2025. The model parameter (A/B) is now ignored and no billing setup is needed. Exceptions: Teams meeting AI insights APIs need a Microsoft 365 Copilot licence, and DLP PATCH APIs need a licence with the Microsoft Communications DLP service plan.
• Some Teams APIs are protected APIs: all use application permissions and need a separate request to Microsoft on top of consent. Requests are reviewed weekly (Wednesdays) with deployment on Fridays or Mondays. Sending a message isn't a protected API.
• Resource-specific consent (RSC) lets an app request permissions scoped to a single team, chat or meeting instead of tenant-wide application permissions.
• App-specific subscription paths exist for chats and meetings where the app is installed, which narrows scope considerably.

When to use / skip

Use change notifications when you need near-real-time reaction to Teams activity: a compliance or archiving tool, a bot that reacts to channel messages without being @mentioned, provisioning automation that responds to new teams, or a contact-centre or CRM integration that picks up meeting transcripts or recordings when they're ready. Polling the same APIs is slower, heavier on throttling and harder to scale.

Skip it for low-frequency automation — a daily report of team membership or a nightly export is a scheduled job calling Graph directly. And if all you need is "post a message when X happens", that's Workflows, not a Graph integration.

Configuration decisions

• Tenant-wide subscription with application permissions, or RSC/app-specific scope. Narrower is far easier to get through a security review.
• With or without resource data — with is fewer round trips but means certificate management and decrypting payloads.
• Hosting for the notification endpoint and how it handles validation, retries and bursts.
• Renewal strategy for 60-minute subscriptions, including what happens if the renewal job fails overnight.
• Whether the API you need is protected, and building the access request lead time into the plan.
• Licensing for the exceptions: Copilot for meeting AI insights, Communications DLP for policy-violation PATCH.

Gotchas

• Older design documents and quotes still budget for metered API costs (Model A/B). That billing ended in August 2025 — strip it from estimates, but check the AI insights exception.
• A missed renewal means a gap in notifications, not an error. Reconcile with a periodic delta or export query if completeness matters.
• Protected API access is a manual process with a weekly cadence. Submit early — it's often the long pole on a compliance integration.
• Tenant-wide getAllMessages subscriptions are exactly what security teams worry about. Expect scrutiny and have a data-handling statement ready.
• Encrypted resource data needs a certificate that's rotated. Expiry breaks decryption silently from the user's point of view.
• Recording and transcript notifications only fire if recording or transcription actually happened — meeting policy decides that, not your app.
• Graph throttling applies per app and per tenant. Bursty fetch-after-notify patterns hit it under load.

Consultant notes

• Start every Graph integration conversation with "which permissions, at what scope?" — it shapes the whole security review.
• Prefer RSC where the integration only needs data from teams, chats or meetings the app is installed in.
• Keep a short register of production subscriptions: resource, scope, owner, certificate expiry, renewal job.
• For transcript-driven integrations (CRM call notes, contact-centre wrap-up), confirm meeting transcription policy first; it's in the meetings workstream.
• Treat Copilot meeting insights APIs as a Copilot licensing question and route it accordingly.

---

Worth revisiting if Microsoft changes Teams subscription lifetimes or reintroduces metering on any Teams Graph APIs