TeamsAppInstallation.ReadWriteAndConsentSelfForTeam

Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams' data.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the TeamsAppInstallation.ReadWriteAndConsentSelfForTeam permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	-	4a6bbf29-a0e1-4a4d-a7d1-cef17f772975
DisplayText	-	Allow the Teams app to manage itself and its permission grants in teams
Description	-	Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams' data.
AdminConsentRequired	Yes	Yes

Graph Methods

• API [v1.0]
• API [beta]
• PowerShell [v1.0]
• PowerShell [beta]

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /teams/{id}/installedApps/{id}
	GET /teams/{team-id}/installedApps
	POST /teams/{team-id}/installedApps
	POST /teams/{team-id}/installedApps/{app-installation-id}/upgrade

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

• team
• teamsApp
• teamsAppInstallation
• teamsAppPermissionSet
• teamworkBot

Graph reference: team

Property	Type	Description
id	string	The unique identifier of the team. The group has the same ID as the team. This property is read-only, and is inherited from the base entity type.
classification	string	An optional label. Typically describes the data or business sensitivity of the team. Must match one of a pre-configured set in the tenant's directory.
classSettings	teamClassSettings	Configure settings of a class. Available only when the team represents a class.
createdDateTime	dateTimeOffset	Timestamp at which the team was created.
description	string	An optional description for the team. Maximum length: 1024 characters.
displayName	string	The name of the team.
funSettings	teamFunSettings	Settings to configure use of Giphy, memes, and stickers in the team.
guestSettings	teamGuestSettings	Settings to configure whether guests can create, update, or delete channels in the team.
internalId	string	A unique ID for the team that has been used in a few places such as the audit log/Office 365 Management Activity API.
isArchived	Boolean	Whether this team is in read-only mode.
memberSettings	teamMemberSettings	Settings to configure whether members can perform certain actions, for example, create channels and add bots, in the team.
messagingSettings	teamMessagingSettings	Settings to configure messaging and mentions in the team.
specialization	teamSpecialization	Optional. Indicates whether the team is intended for a particular use case. Each team specialization has access to unique behaviors and experiences targeted to its use case.
summary	teamSummary	Contains summary information about the team, including number of owners, members, and guests.
tenantId	string	The ID of the Microsoft Entra tenant.
visibility	teamVisibilityType	The visibility of the group and team. Defaults to Public.
webUrl	string (readonly)	A hyperlink that will go to the team in the Microsoft Teams client. This is the URL that you get when you right-click a team in the Microsoft Teams client and select **G