Configure Microsoft 365 in TEDI

Connect Microsoft 365 so TEDI can poll a Teams channel and an Outlook folder, route new messages into Control Panel chat, and send auto-replies. Configuration lives in the desktop app under Settings → Microsoft 365. Ongoing inbound polling is owned by the TEDI Windows Service—closing the desktop window does not stop it.

Who should do this

• Someone who can create an app registration in Microsoft Entra ID (Azure AD) for your tenant.
• A TEDI operator on the Vista workstation who can open Settings and complete device-code sign-in.
• Someone with access to the target Teams team/channel and the Outlook mailbox TEDI should use.

Before you start

• TEDI is installed, licensed, and the desktop app opens. See TEDI Initial Setup if License or Database is not ready.
• The TEDI Windows Service (TEDI Runner) is Running.
• You have a dedicated work/school Microsoft 365 user with Teams + Exchange Online (see Prepare a Microsoft 365 account for TEDI if you still need to create the account or pick a license).
• You can sign in to the Microsoft Entra admin center (or Azure portal) with permission to register apps and grant admin consent if your tenant requires it.
• You know which Team and channel TEDI should watch, and which mailbox folder (usually Inbox).
• For auto-replies (not just inbound capture), a chat model must be configured later in Settings → LLM.

How Microsoft 365 works in TEDI

• One Entra public client app registration (no client secret).
• One shared Microsoft account sign-in for Teams and Outlook, completed with a device code in the Settings panel.
• Three panels on the Microsoft 365 tab: Microsoft account, Teams, and Outlook.
• You can also complete this during optional onboarding (Microsoft 365 step). Prefer SMTP-only email? Skip Microsoft 365 and use Settings → Email instead.

Step 1: Register an Entra ID app

TEDI authenticates with Microsoft Graph using MSAL device code flow. Create a public client app—not a confidential web app with a secret.

1. Open the Microsoft Entra admin center (or Azure portal → Microsoft Entra ID).
2. Go to App registrations → New registration.
3. Set:

• Name— for example TEDI Graph.
• Supported account types— Accounts in this organizational directory only (single-tenant), or Accounts in any organizational directory (multitenant), depending on your policy. Match this choice when you decide whether to fill Tenant id in TEDI.
• Redirect URI— leave blank for device code; TEDI does not need a web redirect URI.

4. Select Register.
5. On the app Overview page, copy:

• Application (client) ID— required in TEDI as Client id.
• Directory (tenant) ID— use this in TEDI as Tenant id when the app is single-tenant.

6. Open Authentication. Under Advanced settings, set Allow public client flows to Yes, then save. This is required for device-code sign-in.
7. Open API permissions → Add a permission → Microsoft Graph → Delegated permissions (not Application permissions). Add:

• Team.ReadBasic.All
• Channel.ReadBasic.All
• ChannelMessage.Read.All
• ChannelMessage.Send
• Mail.Read
• Mail.Send
• User.Read
• ChannelMember.Read.All— email the channel roster (audience team). Typically needs admin consent.
• User.ReadBasic.All— resolve another user’s email when the asker is not the signed-in Microsoft account (audience you). Typically needs admin consent.

8. Select Grant admin consent for your organization and confirm the permissions show as granted. ChannelMember.Read.All and User.ReadBasic.All typically require admin consent.

Do not create a client secret. TEDI never asks for a secret and does not use confidential-client credentials.

Add all of the delegated permissions listed above. After Entra admin consent, use Refresh permissions in TEDI (same account) so the token includes every scope. Until then, TEDI may ask the operator to type an email address or cannot expand the full channel roster.

Expected outcome: You have a public client Application (client) ID, public client flows enabled, and all delegated Graph permissions above granted (with admin consent where required).

Entra notes

• After you add or change Graph scopes, grant admin consent in Entra first. Then in TEDI use Refresh permissions (keeps the same account) so device-code consent updates the token. Test connection alone can still succeed even when some listed scopes are missing from the token—check the permission status list and Refresh until every row is green. Use Switch Account only when you need a different Microsoft user.
• Sign in during Test connection or Refresh permissions with the Microsoft account that has access to the Team/channel and mailbox TEDI should use.

Step 2: Choose (or create) a Team and channel in Microsoft Teams

TEDI does not install a Teams app or create a team for you. In Microsoft Teams, you pick any Team and channel the signed-in account can access—or create ones dedicated to TEDI. Common operator names (examples only): Team TEDI Runner, channel Ask TEDI.

1. In Microsoft Teams, open (or create) the Team you want TEDI to watch.
2. Open (or create) the channel where operators will post messages for TEDI (for example Ask TEDI).
3. Confirm the Microsoft account you will use for Test connection is a member of that Team.

Expected outcome: In Teams you can see the Team and channel (for example TEDI Runner → Ask TEDI). You will select them later in TEDI with Load teams from Microsoft—you do not need to copy Graph IDs by hand.

Step 3: Open Settings → Microsoft 365

1. Launch the TEDI desktop app.
2. Open Settings.
3. Select the Microsoft 365 tab. Description: connect Microsoft account auth, Teams channel defaults, and Outlook mail inbound polling.

During first-run onboarding, the optional Microsoft 365 step uses the same editor. Preferred for Teams, Outlook, and delivery; skip if you only want plain SMTP email.

Expected outcome: You see three panels: Microsoft account, Teams, and Outlook.

Step 4: Fill Microsoft account

Shared sign-in for Teams and Outlook. First connection shows a device code in this panel—open the Microsoft link, enter the code, then wait for verification.

1. In Microsoft account, set:

• Client id (required) — paste the Entra Application (client) ID. Placeholder style: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.
• Tenant id (optional)— paste the Entra Directory (tenant) ID when the app is single-tenant. Leave blank to use the default multi-organization work/school authority.

Buttons on this panel:

• Save settings— writes Microsoft account, Teams, and Outlook values and reloads runner config.
• Test connection— starts or completes device-code sign-in when needed, and verifies Graph access. May succeed even if some listed permissions are still missing from the token—use the status list below to confirm every scope is green.
• Refresh permissions— forces a new device-code consent for the full delegated scope set without clearing the token cache, so the same account (for example tedi@) is preferred. Use after Entra admin consent when you added scopes. Does not change which account is signed in.
• Switch Account— clears the cached Microsoft account so the next Test connection can pick a different user.

Under the buttons, TEDI lists each delegated permission that should be added, with status:

• Green (Granted)— present on the current access token.
• Red (Missing)— signed in, but that scope is not on the token. Add it in Entra, grant admin consent, then use Refresh permissions.
• Gray (Unknown)— not signed in yet (complete Test connection or Refresh permissions).

All listed permissions should be added. Admin consent in Entra must succeed before Refresh permissions can grant a missing scope to the signed-in user.

Step 5: Fill Teams

After Test connection succeeds, pick the Team and channel from Microsoft. TEDI does not offer free-text Graph ID fields—use the dropdowns only.

1. In the Teams panel:

• Select Load teams from Microsoft (next to Reset Teams inbound at the bottom of the panel). If you are already signed in, TEDI may load teams automatically when you open the tab; use the button to refresh or retry.
• Choose Team (for example TEDI Runner). TEDI fills the optional team display name.
• Choose Channel (for example Ask TEDI). TEDI fills the optional channel display name.

2. Optionally adjust:

• Team display name (optional)— friendly label only (placeholder example: Operations).
• Channel display name (optional)— friendly label only (placeholder example: General).

3. Set polling options:

• Inbound poll interval (seconds)— how often TEDI checks the channel. Default 30; minimum 5.
• Skip replies from author names (comma-separated)— display names whose channel posts should not trigger another auto-reply. Default TEDI.
• Check Enable inbound polling (Teams channel → Control Panel chat → auto-reply) when you want Teams inbound active.

4. Select Save settings (on the Microsoft account panel). Both Team and Channel must be selected first.
5. Use Reset Teams inbound only when you need to re-snapshot existing channel messages. The next poll baselines current history; post a new message or thread reply afterward to trigger TEDI.

If Load teams fails with a sign-in message, complete Test connection first, then try again. The signed-in account must be a member of the Team you want to select.

Step 6: Fill Outlook

1. In the Outlook panel, set:

• Default folder path (required) — usually Inbox.
• Default account (optional)— mailbox UPN if needed (placeholder example: user@company.com). Sign in during Test connection as this mailbox user when possible.
• Inbound poll interval (seconds)— default 30; minimum 5.
• Process mail from these addresses (required for any processing) — add each trusted sender with Add Email. Outlook inbound is deny by default: an empty list means TEDI ignores every sender, even when inbound polling is enabled. The signed-in Microsoft 365 mailbox is always skipped automatically so TEDI does not reply-loop to itself.
• Check Enable inbound polling (Inbox mail → Control Panel chat → auto email reply) when you want Outlook inbound active.

2. Use Reset Outlook inbound only to re-snapshot existing Inbox mail. Send new mail afterward to trigger TEDI.

Upgrade note: After this allowlist change, sites that already had Outlook inbound enabled will stop processing mail until you add sender addresses and save. That is intentional for safety when TEDI can reach financial data.

Step 7: Save settings, Test connection, and Refresh permissions

1. Select Save settings. Wait for a success message such as Microsoft 365 settings saved and runner config reloaded.
2. Select Test connection.

• If Client id is empty, TEDI shows: Enter a Graph client id before continuing.
• On first use (or after Switch Account), the panel shows a device-code prompt: open https://microsoft.com/devicelogin, enter the displayed code, and complete Microsoft sign-in. Keep TEDI open while it waits (up to several minutes).

3. Sign in with the work/school account that should read the channel and mailbox and send replies.
4. Wait until the panel reports success (for example Microsoft 365 connection verified.). If sign-in times out, finish the device-code prompt and select Test connection again.
5. Check the permission status list under the Microsoft account buttons. Every row should be green. If any are red, confirm Entra admin consent, then select Refresh permissions, complete the device-code prompt with the same account, and confirm those rows turn green.

Expected outcome: Connection verified and a Microsoft account is cached for Graph. Status on the Microsoft 365 tab no longer shows Microsoft client id required. Every permission on the Microsoft account card shows green after Entra consent and Refresh permissions.

Step 8: Confirm status and smoke-test inbound

1. Read the status items on the Microsoft 365 tab. Healthy inbound looks like:

• Teams inbound active · every 30s (interval matches your poll seconds).
• Outlook inbound active · every 30s.

2. If you see Auto-reply needs a chat model — configure in Settings → LLM, open Settings → LLM and configure a chat model before expecting automatic replies.
3. Confirm the Windows Service is still Running—inbound polling continues even if you close the desktop window.
4. Smoke-test:

• Teams— post a new message (or reply) in the configured channel from an account that is not skipped by author names.
• Outlook— send a new message to the watched folder from an address that is not skipped.

5. Confirm the message appears in Control Panel chat and, with LLM configured, that TEDI can auto-reply.

Expected outcome: Teams and/or Outlook inbound show active; a new post or email is picked up after the poll interval.

Pending inbound after a start (Process or Clear)

When the TEDI runner or Windows Service starts, inbound does not immediately reply to messages that piled up while it was off. If any unseen Teams or Outlook messages are waiting, TEDI holds inbound processing until you confirm in the desktop app.

• A Pending Microsoft 365 inbound dialog appears when the desktop connects and a backlog exists. Choose Process pending (reply/run as usual), Clear pending (mark as seen, no reply), Review… (open Settings), or Cancel (leave held).
• In Settings → Microsoft 365 → Pending inbound you can refresh the list, Dismiss individual messages, Clear pending, or Process pending.
• Closing the desktop does not clear the hold. The Windows Service keeps inbound held until someone confirms Process or Clear in the desktop app.
• If there is no backlog at start, inbound arms automatically and new posts after that are handled without a prompt.

Refresh permissions, Switch Account, and reset baselines

• Refresh permissions— updates Graph consent for new delegated scopes without changing account. Prefer this after adding or changing Graph permissions in Entra (admin consent required first). The permission list should show every scope green afterward.
• Switch Account— clears the cached Microsoft account. Confirm the dialog, then run Test connection again and complete device-code sign-in with the new user. Not required merely to pick up new scopes for the same user.
• Load teams from Microsoft— refreshes the Team/Channel dropdowns from Graph (same row as Reset Teams inbound). Use after Test connection, or to retry if the list is empty.
• Reset Teams inbound / Reset Outlook inbound — re-snapshot existing messages so only activity after the reset triggers TEDI. Use when changing channels/folders or recovering from a stuck baseline—not on every save. This is different from Clear pending, which only marks the current unseen backlog as seen without wiping the whole baseline.

Field reference

Panel	Field	Required?	What to enter
Microsoft account	Client id	Yes	Entra Application (client) ID
Microsoft account	Tenant id (optional)	No	Entra Directory (tenant) ID for single-tenant apps
Teams	Team	Yes (for Teams inbound)	Select after Load teams from Microsoft
Teams	Channel	Yes (for Teams inbound)	Select after choosing a Team
Teams	Team / Channel display name (optional)	No	Friendly labels; filled automatically when you pick from the dropdowns
Teams	Inbound poll interval (seconds)	No	Default 30; minimum 5
Teams	Skip replies from author names	No	Comma-separated display names; default TEDI
Teams	Enable inbound polling…	—	Checkbox to turn Teams inbound on or off
Pending inbound	List / Dismiss / Process / Clear	—	Review unseen Teams and Outlook messages after a start; dismiss individuals or process/clear the backlog
Outlook	Default folder path	Yes	Usually Inbox
Outlook	Default account (optional)	No	Mailbox UPN
Outlook	Inbound poll interval (seconds)	No	Default 30; minimum 5
Outlook	Process mail from these addresses	Yes (to process any mail)	Exact emails via Add Email list; empty = ignore all senders; signed-in mailbox always skipped
Outlook	Enable inbound polling…	—	Checkbox to turn Outlook inbound on or off

Setup checklist

• Entra app registered as a public client; Allow public client flows = Yes
• All delegated Graph permissions added (Teams + Mail + User.Read + ChannelMember.Read.All + User.ReadBasic.All); admin consent granted; Refresh permissions completed so every scope shows green on the Microsoft account card
• No client secret created or pasted into TEDI
• Target Team and channel exist in Microsoft Teams; sign-in account is a member
• Settings → Microsoft 365: Client id (and Tenant id if single-tenant) filled
• Test connection completed with device-code sign-in
• Load teams from Microsoft; Team and Channel selected
• Outlook folder filled; Outlook allowlist filled with trusted sender emails; inbound polling enabled as needed
• Save settings succeeded
• Status shows Teams and/or Outlook inbound active
• After a service restart with a backlog, Process or Clear pending inbound (or dismiss individuals) before expecting replies
• LLM configured if you need auto-reply
• Smoke-test with a new Teams message and/or new email

Common mistakes

• Public client flows left Off— Device-code Test connection fails until Authentication → Allow public client flows is Yes.
• Pasting a client secret— TEDI has no secret field. Use Application (client) ID only.
• Trying to paste Graph IDs by hand— The Teams panel has no free-text ID fields. Use Load teams from Microsoft, then select Team and Channel.
• Load teams before Test connection— Load teams needs a signed-in Microsoft account. Complete Test connection first.
• Skipping Save settings— Test connection needs Client id; Team/Channel and Outlook values must be saved for inbound to use them.
• Inbound checkboxes off— Status will show Teams or Outlook inbound disabled until you enable polling.
• Empty Outlook allowlist— Inbound can show as ready while still ignoring every sender. Add trusted addresses under Process mail from these addresses and save.
• Expecting auto-reply without LLM— Status warns: configure a chat model in Settings → LLM.
• Device-code timeout— Complete https://microsoft.com/devicelogin promptly, then select Test connection again if needed.
• Wrong Microsoft account— Use Switch Account, then Test connection with the mailbox/Teams user that has access.
• Some permissions still red after Entra change— Admin consent in Entra is required first. Then use Refresh permissions (not only Test connection) with the same account so the token includes every listed scope (including ChannelMember.Read.All and User.ReadBasic.All).
• Assuming closing TEDI stops inbound— The Windows Service continues polling; use Services.msc to stop the runner if you need inbound off entirely.
• Surprised by a backlog after restart— That is expected. Confirm Process or Clear (or dismiss individuals) before TEDI replies; do not rely on Reset baseline for a one-time backlog clear.

Next steps

• Prepare a Microsoft 365 account for TEDI— Create the work/school user and assign a Teams + Exchange license if you have not already.
• TEDI Initial Setup— Finish license, database catalog, and service readiness if you have not already.
• Getting Started with TEDI— Orient to Command Center, desktop vs Windows Service.
• Monitoring and Troubleshooting TEDI— Service status, logs, and support checks when inbound is quiet.