How to give access to only a specific Teams channel or chat ?

Question

How to give access to only a specific Teams channel or chat ?

Clemens Ernstberger 20

Dear Community,
i am trying to setup an api access to the graph api in teams. For that i understood that giving ChannelMessage.Send.Group is only possible as a RSC permission https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent and giving access via app directly is only possible as delegate version https://learn.microsoft.com/en-us/graph/api/channel-post-messages?view=graph-rest-1.0&tabs=http . The goal is to send and read messages only in a specific Teams channel and not in the whole tenant.
For that i understood i would need RSC permissions for an app otherwise i would need a separate Identity in our tenant to use the delegate permissions. This should be a app only access to not manage any Identity's additionally so i created a basic manifest via https://dev.teams.microsoft.com/ and i was able to deploy this basic manifest:


{

  "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.27/MicrosoftTeams.schema.json",

  "version": "1.0.0",

  "manifestVersion": "1.27",

  "id": "secret",

  "name": {

    "short": "test",

    "full": "test"

  },

  "developer": {

    "name": "test",

    "websiteUrl": "https://test.com",

    "privacyUrl": "https://test.com",

    "termsOfUseUrl": "https://test.com"

  },

  "description": {

    "short": "test",

    "full": "this is for testing."

  },

  "icons": { "outline": "outline.png", "color": "color.png" },

  "accentColor": "#1A1A2E",

  "validDomains": [],

  "webApplicationInfo": { "id": "secret",

    "resource": "https://RscBasedStoreApp" },

  "authorization": {

    "permissions": {

      "resourceSpecific": [

        { "name": "ChannelMessage.Read.Group", "type": "Application" },

        { "name": "ChannelMessage.Send.Group", "type": "Application" },

        { "name": "ChatMessage.Read.Chat", "type": "Application" },

        { "name": "ChatMessageReadReceipt.Read.Chat", "type": "Application" },

        { "name": "TeamsActivity.Send.Group", "type": "Application" },

        { "name": "TeamsActivity.Send.Chat", "type": "Application" }

      ]

    }

  }

}

I was able to deploy it but when i tried to install the app in teams i got a generic error saying i would not have access to the chat. I assume since i did not defined a capability of the app it is not possible to add the app.
So i then tried to just add the tab capability with no valid endpoint since i only need the graph api access. That failed with another error message giving me the impression i have to have a full blown bot just to access messages in teams. Based on https://github.com/MicrosoftDocs/msteams-docs/issues/14043 i assume that others came to the same conclusion.
Please if someone found an easy way to just give only access to a specific teams channel to an app which then can use the graph api please let me know. Otherwise did anyone tried it out with a managed identity ? That one cost an office license which is also not ideal.

Thank you for the help.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi Clemens,

Thank you for the detailed explanation.

Based on your sharing, your understanding is generally correct as RSC is the appropriate permission model when an application needs app-only access to Teams resources without receiving access to the entire tenant.

However, I want to mention that the permissions ChannelMessage.Read.Group and ChannelMessage.Send.Group apply to a specific Team and the channels within that Team. There is currently no equivalent permission such as ChannelMessage.Read.Channel or ChannelMessage.Send.Channel that can restrict the application permission to only one standard channel.

This means that installing the Teams app in a Team grants the declared .Group permissions for that Team. Your application can still be configured to use only one specific channel ID, but that restriction would be enforced by your own application rather than by the Graph permission itself.

For this situation, the best option depends on whether you need the application do:

1/ If the application only needs to send messages

Use a Teams Workflow webhook:

Open the required Teams channel.
Create a Workflow that starts when a webhook request is received.
Configure the Workflow to post the received content to that channel.
Call the generated webhook URL from your application.

2/ If the application needs to read and send messages

Use ChannelMessage.Read.Group RSC for application-only reading.
Use a Teams bot or a Teams Workflow webhook for sending.
Install the app in the required Team.
Configure the backend to accept only the approved Team ID and channel ID.

If you want to use Graph for both reading and sending, unfortunately, there is currently no fully supported Graph-only, application-only method that can both read and send normal messages while being restricted by Microsoft Graph permissions to one individual Teams channel.

Hope this information helps you move forward smoothly. If you have any other question, please feel free to reach out on the comments of this post. I'll be happy to assist you further.

Thank you for your understanding and I hope your concern will get resolved soon.

If the answer is helpful, please click "Yes" and kindly upvote it.

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Clemens Ernstberger 20 Reputation points

2026-09-01T13:48:52.7333333+00:00

Dear @Hendrix ,
thanks for the elaborate and quick answer. To confirm it is not possible to use the graph api to send and read messages. Also for reading messages a webhook is needed which then needs to be managed in power automate.
Having all this in mind based on the docs i understood that a bot infra would also be needed in case sending is required cause the webhook from teams would also need an power automate flow which needs to be either tied to a user or bot account.
If i understood this correctly i can either host a bot infra and create a simple app or manage an additional identity with an office license and use delegate functionality.
Both are not cheap solutions in comparison to simple api call requests.
Hendrix 990 Reputation points Independent Advisor

2026-09-01T23:07:47.31+00:00

Hi Clemens,

Thank you for your response and I understand your concern. Compared with a straightforward app-only API integration, the available alternatives introduce additional infrastructure, ownership, or licensing requirements and as of now, I'm afraid that I myself cannot suggest a simpler supported method.

Therefore, if you are still looking for a better approach for this case, I suggest you should contact your IT administrator to open a support ticket with Microsoft Support. This route ensures you can reach out to a technical support engineer who is well-equipped and can initiate a remote session to review configurations, perform advanced troubleshooting and provide more targeted solutions than I do.

For guidance on how to request support in the admin center, please share this link with your IT admin: Get support - Microsoft 365 admin. 

If you are unsure who your IT administrator is, you can refer to this official Microsoft guide for assistance: How do I find my Microsoft 365 admin? - Microsoft Support.

I hope this points you in the right direction. I greatly appreciate your patience and understanding during this troubleshooting process.

Wishing you a great day ahead.