Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Resource-specific consent (RSC) is the permissions model for Teams that scopes certain agent and app permissions to the resources - teams, chats, meetings, and user personal scopes - where users install them. Resource-based access boundaries empower users to make their own decisions about agent and app access to their resources without requiring explicit consent from administrators or affecting owners of other resources.
RSC is based on two concepts:
- Resource-scoped permissions: RSC permissions are a category of Microsoft Graph permissions for agents and apps that extend only to the teams, chats, meetings, and user personal scopes where they are installed. Developers declare up front which RSC permissions their agents and apps need, like the ability to read all messages in a chat, or add members to a team.
- User consent: Installing an agent or app requires granting it the RSC permissions it needs. Users, not just administrators, can install agents and apps themselves because they can grant RSC permissions in the teams, chats, and meetings where they work.
Requesting and obtaining RSC permissions
Developers declare which RSC permissions an agent or app needs in its app manifest. See Grant RSC permissions to your app for more information.
When a user attempts to install the agent or app, Teams presents them with a one-time request to grant the RSC permissions it needs. If the user consents and proceeds with the installation, the permissions granted extend only to the team, chat/meeting, or user where they installed it.
A user's ability to grant RSC permissions can be subject to administrator and resource owner policies. Installing an agent or app requires consenting to all of its RSC permissions requests: users can't grant or deny permissions individually.
RSC permissions are not declared or displayed in the Entra admin center. If you want to know the RSC permissions associated with an app, see the app installation or app information dialog within the Teams client.
Access scenarios: delegated and app-only
As with other Microsoft Graph permissions, each RSC permission supports either delegated access, app-only access, or both. For more information about delegated and app-only access scenarios in the Microsoft Graph authorization model, see Access scenarios.
Any member of a team or chat can grant delegated RSC permissions when installing an agent or app there, but only administrators or resource owners can grant app-only RSC permissions.
RSC-based data access APIs
Microsoft Graph SDK, Teams SDK, and Microsoft TeamsJS client library support fine-grained data access through RSC. The supported modes and resource types vary across the API surfaces.
| RSC mode | Supported SDKs | App manifest version | Resource types | RSC-related controls for the entire tenant | Who can consent to RSC permissions? |
|---|---|---|---|---|---|
| App-only | • Microsoft Graph • Teams SDK |
>=v1.6 | Teams, chats, and meetings | • Microsoft Graph-based controls for chats and meetings • Microsoft Entra admin center-based controls for Teams |
• Team: A team owner or member • Chat: A chat member • Meeting: A meeting organizer or presenter |
| Delegated | Microsoft Teams Client | >=v1.12 | Teams, chats, meetings, and users | Always on | Any user authorized to install an app in the specific scope. |
Basic RSC permissions
The Microsoft privacy and security teams have reviewed a limited set of RSC permissions and deemed them low risk. Any user can consent to these permissions at any time when they install and use an app. The following low-risk basic permissions are always consented to upon installation.
| Permission name | Action | Supported access scenarios |
|---|---|---|
TeamsActivity.Send.Group |
Send activity feed notifications to users in this team. | App-only |
TeamsActivity.Send.Chat |
Send activity feed notifications to users in this chat. | App-only |
TeamsActivity.Send.User |
Send activity feed notifications to the user. | App-only |
Additionally, the TeamsActivity.Send RSC application permission is always enabled at the tenant level. App users don't need administrator consent to use it.
RSC permissions for teams and channels
These RSC permissions apply at the team scope. When an agent or app is installed in a team, its channel-related RSC permissions automatically extend to all of the team's channels except private and shared channels. Channel-related RSC permissions only extend to private and shared channels in which a user has explicitly added the agent or app.
| Permission name | Action | Supported access scenarios |
|---|---|---|
Channel.Create.Group |
Create channels in this team. | App-only |
Channel.Delete.Group |
Delete this team's channels. | App-only |
ChannelMeeting.ReadBasic.Group |
Read the basic properties of the channel meetings in this team. | App-only |
ChannelMeetingParticipant.Read.Group |
Read the participant information including name, role, ID, join and left time of channel meetings associated with this team. | App-only |
ChannelMeetingRecording.Read.Group |
Read the recordings of all channel meetings associated with this team. | App-only |
ChannelMeetingNotification.Send.Group |
Send notifications in all the channel meetings associated with this team. | App-only |
ChannelMessage.Read.Group |
Read and receive all of this team's channel messages. See Configure an agent to receive all messages in group chats and channels. | App-only |
ChannelMessage.Send.Group |
Send messages to this team's channels. | App-only |
ChannelSettings.Read.Group |
Read the names, descriptions, and settings of this team's channels. | App-only |
ChannelSettings.ReadWrite.Group |
Update the names, descriptions, and settings of this team's channels. | App-only |
TeamsActivity.Send.Group |
Send activity feed notifications to users in this team. | App-only |
TeamsAppInstallation.Read.Group |
Read the apps that are installed in this team. | App-only |
TeamMember.Read.Group |
Read this team's members. | App-only |
TeamSettings.Read.Group |
Read this team's settings. | App-only |
TeamSettings.ReadWrite.Group |
Read and write this team's settings. | App-only |
TeamsTab.Create.Group |
Create tabs in this team. | App-only |
TeamsTab.Delete.Group |
Delete this team's tabs. | App-only |
TeamsTab.Read.Group |
Read this team's tabs. | App-only |
TeamsTab.ReadWrite.Group |
Manage this team's tabs. | App-only |
ChannelMeetingActiveSpeaker.Read.Group |
Reading the participants who are sending audio into the channel meetings associated with this team. | Delegated |
ChannelMeetingAudioVideo.Stream.Group |
Stream audio-video content of channel meetings associated with this team. | Delegated |
ChannelMeetingIncomingAudio.Detect.Group |
Detect incoming audio in channel meetings associated with this team. | Delegated |
ChannelMeetingStage.Write.Group |
Show content on the meeting stage of channel meetings associated with this team. | Delegated |
InAppPurchase.Allow.Group |
Show and complete in-app purchases for users in this team. | Delegated |
LiveShareSession.ReadWrite.Group |
Allows the app to create and synchronize Live Share sessions for this team and get access related information, such as name and role, about this team's roster and any associated meetings. | Delegated |
MeetingParticipantReaction.Read.Group |
Read reactions of participants in channel meetings associated with this team. | Delegated |
ChannelMember.ReadWrite.Group |
Read and write the members of this team's channels. | App-only |
ChannelMember.Read.Group |
Read the members of this team's channels. | App-only |
File.Read.Group |
Read information about the files and folders associated with this team’s channels. | App-only |
RSC permissions for chats and meetings
The only RSC permission relevant to chats in personal scope is ChatMessageReadReceipt.Read.Chat.
If a chat has a meeting or a call associated with it, the relevant RSC permissions apply to those resources.
| Permission name | Action | Supported access scenarios |
|---|---|---|
Calls.AccessMedia.Chat |
Access media streams in calls associated with this chat or meeting. | App-only |
Calls.JoinGroupCalls.Chat |
Join calls associated with this chat or meeting. | App-only |
ChatSettings.Read.Chat |
Read this chat's settings. | App-only |
ChatSettings.ReadWrite.Chat |
Read and write this chat's settings. | App-only |
ChatMessage.Read.Chat |
Read and receive all of this chat's messages. See Configure an agent to receive all messages in group chats and channels. | App-only |
ChatMessageReadReceipt.Read.Chat |
Read the ID of the last seen message in this chat. | App-only |
ChatMember.Read.Chat |
Read this chat's members. | App-only |
Chat.Manage.Chat |
Manage this chat. | App-only |
TeamsTab.Read.Chat |
Read this chat's tabs. | App-only |
TeamsTab.Create.Chat |
Create tabs in this chat. | App-only |
TeamsTab.Delete.Chat |
Delete this chat's tabs. | App-only |
TeamsTab.ReadWrite.Chat |
Manage this chat's tabs. | App-only |
TeamsAppInstallation.Read.Chat |
Read the apps that are installed in this chat. | App-only |
TeamsActivity.Send.Chat |
Send activity feed notifications to users in this chat. | App-only |
OnlineMeetingTranscript.Read.Chat |
Read the transcripts of the meeting associated with this chat. | App-only |
OnlineMeeting.ReadBasic.Chat |
Read basic properties of meetings associated with this chat, such as name, schedule, organizer, join link, and start or end notifications. | App-only |
OnlineMeetingRecording.Read.Chat |
Read the recordings of the meetings associated with this chat. | App-only |
OnlineMeetingNotification.Send.Chat |
Send notifications in the meetings associated with this chat. | App-only |
InAppPurchase.Allow.Chat |
Show and complete in-app purchases for users in this chat and any associated meetings. | Delegated |
LiveShareSession.ReadWrite.Chat |
Allows the app to create and synchronize Live Share sessions for this chat and get access related information, such as name and role, about this chat's roster and any associated meetings. | Delegated |
MeetingStage.Write.Chat |
Show content on the meeting stage of meetings associated with this chat. | Delegated |
MeetingParticipantReaction.Read.Chat |
Read the reactions of participants in meetings associated with this chat. | Delegated |
OnlineMeetingIncomingAudio.Detect.Chat |
Detect incoming audio in meetings associated with this chat. | Delegated |
OnlineMeetingActiveSpeaker.Read.Chat |
Read the participants who are sending audio into the meetings associated with this chat. | Delegated |
OnlineMeetingAudioVideo.Stream.Chat |
Stream audio-video content of meetings associated with this chat. | Delegated |
OnlineMeetingParticipant.Read.Chat |
Read participant information, including name, role, ID, joined and left times, of meetings associated with this chat. | Delegated or app-only |
OnlineMeetingParticipant.ToggleIncomingAudio.Chat |
Toggle incoming audio for participants in meetings associated with this chat. | Delegated |
RSC permissions for users (personal scope)
| Permission name | Action | Supported access scenarios |
|---|---|---|
CameraStream.Read.User |
Read the user's camera stream. | Delegated |
InAppPurchase.Allow.User |
Show and complete in-app purchases. | Delegated |
MicrophoneStream.Read.User |
Read the user's microphone stream. | Delegated |
MeetingParticipantReaction.Read.User |
Read the user's reactions while participating in a meeting. | Delegated |
OutgoingVideoStream.Write.User |
Modify the user's outgoing video. | Delegated |
TeamsActivity.Send.User |
Send activity notifications to the user. | App-only |
TeamsAppInstallation.Read.User |
Read the apps that are installed in the user's personal scope. | App-only |