TeamsAppInstallation.ReadWriteSelfForTeam.All

Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the TeamsAppInstallation.ReadWriteSelfForTeam.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	9f67436c-5415-4e7f-8ac1-3014a7132630	-
DisplayText	Allow the Teams app to manage itself for all teams	-
Description	Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.	-
AdminConsentRequired	-	-

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /teams/{team-id}/installedApps/{app-installation-id}
	GET /teams/{id}/installedApps/{id}
	GET /teams/{team-id}/installedApps
	GET /teams/{team-id}/permissionGrants
	POST /teams/{team-id}/installedApps
	POST /teams/{team-id}/installedApps/{app-installation-id}/upgrade

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /teams/{team-id}/installedApps/{app-installation-id}
	GET /teams/{id}/installedApps/{id}
	GET /teams/{team-id}/installedApps
	GET /teams/{team-id}/permissionGrants
	POST /teams/{team-id}/installedApps
	POST /teams/{team-id}/installedApps/{app-installation-id}/upgrade

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgTeamInstalledApp
	Get-MgTeamPermissionGrant
	New-MgTeamInstalledApp
	Remove-MgTeamInstalledApp
	Update-MgTeamInstalledApp

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaTeamInstalledApp
	Get-MgBetaTeamPermissionGrant
	New-MgBetaTeamInstalledApp
	Remove-MgBetaTeamInstalledApp
	Update-MgBetaTeamInstalledApp

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: resourceSpecificPermissionGrant

Property	Type	Description
clientId	string	ID of the Microsoft Entra app that has been granted access. Read-only.
clientAppId	string	ID of the service principal of the Microsoft Entra app that has been granted access. Read-only.
deletedDateTime	dateTimeOffset	Not used.
id	string	The unique identifier of the resource-specific permission grant. Read-only.
resourceAppId	string	ID of the Microsoft Entra app that is hosting the resource. Read-only.
permissionType	string	The type of permission. Possible values are: `Application`, `Delegated`. Read-only.
permission	string	The name of the resource-specific permission. Read-only.

Graph reference: team

Property	Type	Description
id	string	The unique identifier of the team. The group has the same ID as the team. This property is read-only, and is inherited from the base entity type.
classification	string	An optional label. Typically describes the data or business sensitivity of the team. Must match one of a pre-configured set in the tenant's directory.
classSettings	teamClassSettings	Configure settings of a class. Available only when the team represents a class.
createdDateTime	dateTimeOffset	Timestamp at which the team was created.
description	string	An optional description for the team. Maximum length: 1024 characters.
displayName	string	The name of the team.
funSettings	teamFunSettings	Settings to configure use of Giphy, memes, and stickers in the team.
guestSettings	teamGuestSettings	Settings to configure whether guests can create, update, or delete channels in the team.
internalId	string	A unique ID for the team that has been used in a few places such as the audit log/Office 365 Management Activity API.
isArchived	Boolean	Whether this team is in read-only mode.
memberSettings	teamMemberSettings	Settings to configure whether members can perform certain actions, for example, create channels and add bots, in the team.
messagingSettings	teamMessagingSettings	Settings to configure messaging and mentions in the team.
specialization	teamSpecialization	Optional. Indicates whether the team is intended for a particular use case. Each team specialization has access to unique behaviors and experiences targeted to its use case.
summary	teamSummary	Contains summary information about the team, including number of owners, members, and guests.
tenantId	string	The ID of the Microsoft Entra tenant.
visibility	teamVisibilityType	The visibility of the group and team. Defaults to Public.
webUrl	string (readonly)	A hyperlink that will go to the team in the Microsoft Teams client. This is the URL that you get when you right-click a team in the Microsoft Teams client and select **G

Graph reference: teamsApp

Property	Type	Description
displayName	string	The name of the catalog app provided by the app developer in the Microsoft Teams zip app package.
distributionMethod	teamsAppDistributionMethod	The method of distribution for the app. Read-only.
externalId	string	The ID of the catalog provided by the app developer in the Microsoft Teams zip app package.
id	string	The app ID generated for the catalog is different from the developer-provided ID found within the Microsoft Teams zip app package. The **e

Graph reference: teamsAppInstallation

Property	Type	Description
consentedPermissionSet	teamsAppPermissionSet	The set of resource-specific permissions consented to while installing or upgrading the teamsApp.
id	string	A unique ID (not the Teams app ID).

Table of Contents

TeamsAppInstallation.ReadWriteSelfForTeam.All

Graph Methods

Resources