Almanac
Microsoft/teamsMicrosoft 365

Consultant-focused KB for Microsoft Teams: implementation notes, gotchas and configuration decisions beyond the official docs — across chat and collaboration, meetings, webinars and town halls, Teams Phone, PSTN connectivity (Direct Routing, Operator Connect, Calling Plans, Teams Phone Mobile), auto attendants, call queues and contact centre integration, Teams Rooms and devices, apps and extensibility, Copilot in Teams, administration and governance, security and compliance, network and call quality, and licensing — plus cross-cutting decision guides.

teams/07-apps-and-extensibility/feature-apps-resource-specific-consent.md
feature-apps-resource-specific-consent.mdv1 · history
CurrentApplies to AllUpdated 3 hours agoSource Microsoft Learn ↗

What it does

Resource-specific consent scopes an app's Graph permissions to the team, chat, meeting or user personal scope where it's installed, rather than the whole tenant. The person installing it consents to the permissions at install time, so tenant admins aren't pulled into every request.

Key facts

  • Developers declare RSC permissions in the app manifest. Declaring doesn't grant anything: consent happens when an authorised user installs the app in the target resource.
  • Consent is all or nothing. Users can't accept some requested permissions and refuse others.
  • Two modes. App-only needs manifest v1.6 or later and covers teams, chats and meetings. Delegated needs manifest v1.12 or later, covers teams, chats, meetings and users, and is always on at tenant level.
  • Any member of a team or chat can grant delegated RSC permissions. Only administrators or resource owners can grant app-only ones.
  • A small set of low-risk activity-feed permissions (TeamsActivity.Send.Group, .Chat, .User) are always consented on install, and TeamsActivity.Send is always enabled at tenant level.
  • A team supports a maximum of 16 RSC permission declarations per app.
  • Channel permissions extend to every channel in the team except private and shared channels, where a user has to add the app explicitly.
  • RSC permissions don't show in the Entra admin center. To see them, check the install dialog or app information in the Teams client.
  • Tenant controls differ by object: Graph-based controls for chats and meetings, Entra admin centre controls for teams.
  • Custom apps must come from the same organisation they're installed in, and webApplicationInfo.id must be registered there. Otherwise you get the WebApplicationInfoIdOfSideloadedAppMustBeInTheSameTenantAsUser error.

When to use / skip

Use it for any app that only needs data from the teams, chats or meetings it's installed in: meeting-side panels, bots that read channel messages, tab apps that manage their own team. It makes the security review short and the install story simple.

Skip it when you genuinely need tenant-wide reach, such as compliance archiving or cross-tenant reporting. That's still tenant-level application permissions and an admin conversation.

Configuration decisions

  • Application or delegated permission for each capability. Delegated behaves as the signed-in user; application can do things the user can't, such as deleting a tab.
  • Declare through Developer Portal or edit the manifest directly. Your manifest version decides which format you use (authorization.permissions.resourceSpecific from v1.12, applicationPermissions before).
  • Which scopes you support. Team and chat permissions can sit in the same manifest if the app installs in both.
  • Whether your admin has policies that block user consent, and who owns the install in each environment.

Gotchas

  • A grant in team A says nothing about team B. Verify per resource using the permissionGrants endpoints for the team, chat or user, and match clientAppId to webApplicationInfo.id, not the top-level manifest id.
  • Inspecting grants needs its own delegated permission in Graph Explorer (for example TeamsAppInstallation.ReadForTeam). An error there doesn't mean your app's grant is missing.
  • Changing permissions in a later manifest triggers an update and consent flow. Test it, because users who skip the update keep the old grants.
  • Application RSC calls can do more than the user who consented could. Check the resource owner's intent before shipping anything that writes.
  • Learn restructured this section in late October 2026. The old "grant RSC permissions" article is gone and replaced by a "declare RSC permission requirements" article, so older bookmarks and runbooks will redirect.

Consultant notes

  • Put the RSC permission list into the design document before build starts. Someone always asks later why the app can read every message in a channel.
  • Test consent in a tenant with your customer's real app permission and custom app upload policies. Dev tenants are far more permissive.
  • For bots that read all messages, call out ChannelMessage.Read.Group and ChatMessage.Read.Chat explicitly in the privacy notice for users.
  • Keep a simple register of which apps hold which RSC permissions, since the Entra admin centre won't give you one.

Worth revisiting after the next Teams platform release or any change to the manifest permission schema

Was this accurate?
Related
Microsoft Graph APIs and Change Notifications for Teams07-apps-and-extensibilityApp Centric Management and App Availability in Teams07-apps-and-extensibilityApp Setup Policies and Custom App Upload in Teams07-apps-and-extensibilityCopilot in Teams chats and channels, and the Channel Agent08-copilot-and-ai-in-teamsInformation barriers in Teams10-security-and-compliancePrivate channel vs shared channel vs a separate team13-decision-guides