> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Teams *Lumos has a dedicated Microsoft Teams connector that manages Teams licenses, team membership, and channel membership through an Entra app registration you create. For managing the rest of your Microsoft 365 / Entra ID environment (directory users, groups, roles, and non-Teams license management), use the separate Microsoft 365 / Entra ID integration. You can connect both.* ## After this article You'll be able to connect Microsoft Teams to Lumos to sync licensed Teams users, teams, channels, and license assignments, and to provision Teams users from Lumos. Provisioning covers inviting new users, assigning and removing licenses, team roles, and channel roles, enabling and disabling accounts, and deleting users. ## Capabilities | Functionality | Type | Sync | Provision | Description | | - | - | - | - | - | | Users | Account | Yes | Yes | Users holding a license that includes Microsoft Teams. Lumos can invite, enable, disable, and delete them (see below) | | Licenses | Permission | Yes | Yes | Subscribed license SKUs that include the Teams service plan. Lumos can assign and remove them | | Team Roles | Permission | Yes | Yes | Membership in a team as owner, member, or guest | | Channel Roles | Permission | Yes | Yes | Membership in a channel as owner, member, or guest | Teams and channels sync as resources, so access is scoped per team and per channel. **Provisioning behavior:** * **Create:** Lumos invites the user by email through Microsoft's invitation API. The person receives an invitation email that redirects to Lumos, and the account is created as a Member. Lumos then sets the user's usage location (the Country Code field, `US` by default), which Microsoft requires for license assignment, and assigns the requested license. Create requires exactly one License entitlement. * **Assign a license:** Lumos verifies the SKU is enabled, includes a provisioned Microsoft Teams service plan, is assignable to users, and has an available seat, then assigns it. Removing a license uses the same Graph action. * **Team role:** Lumos adds the user to the team with the requested role (owner, member, or guest). If they're already a team member, Lumos updates their role instead. Removing the team role removes the user from the team, and removing a membership they don't have is a safe no-op. * **Channel role:** the user must already be a member of the parent team, otherwise the assignment fails. Lumos adds the user to the channel with the requested role or updates their existing channel role. Removal takes them out of the channel, and removing a membership they don't have is a safe no-op. * **Enable or disable (activate and deactivate):** Lumos flips the user's `accountEnabled` property. Enabled maps to Active in Lumos and disabled maps to Suspended. * **Delete:** Lumos soft-deletes the user, then permanently removes them from the Entra deleted items list. This is not reversible from Lumos. **Last Login and Last Activity:** Lumos reads each user's sign-in activity from Microsoft Graph. Interactive sign-ins populate Last Login and non-interactive sign-ins populate Last Activity. Microsoft throttles this report at 10 requests per minute per app per tenant, so large tenants take longer to sync activity. ## Required plan and roles * **Microsoft role:** the connection must be set up by a Microsoft Entra admin (Global Administrator or Privileged Role Administrator) who can register an application and grant tenant-wide admin consent. * **Credential model:** Lumos authenticates as an app registration you create in your tenant, using its Client ID, Client Secret, and your Tenant ID. Access uses Microsoft Graph application permissions, so the connection isn't bound to any individual user. * **Graph application permissions** (granted on the app registration you create in Phase 1): * `LicenseAssignment.ReadWrite.All` * `User.Invite.All` * `User.ReadWrite.All` * `User.DeleteRestore.All` * `Team.ReadBasic.All` * `TeamMember.Read.All` * `TeamMember.ReadWriteNonOwnerRole.All` * `ChannelSettings.Read.All` * `ChannelMember.ReadWrite.All` * `AuditLog.Read.All` ## Read-only access vs provisioning **Is read-only possible?** Not as a documented mode. The permission set above includes the write permissions used for provisioning, and there is no separate read-only credential documented for this card. **What full provisioning requires.** An app registration with a client secret and the Graph application permissions listed above, with admin consent granted by a Global Administrator or Privileged Role Administrator. Follow the steps below. **Watch out for.** Client secrets expire on the schedule you pick when creating them, and the connection stops working when they do, so plan the rotation. The connector also requires at least one enabled license on the tenant that includes a provisioned Microsoft Teams service plan, and it refuses to connect without one. ## Instructions **Phase 1: Register an application in Entra** 1. Go to the [Microsoft Entra admin center](https://entra.microsoft.com/) and open **App registrations** in the **Entra ID** section. 2. Click **New registration**, choose a name, and under **Supported account types** select **Single tenant only**. 3. Under **Redirect URI**, select **Web** and enter `https://app.lumosidentity.com/integrations/ics_oauth2_callback`. 4. Click **Register** and copy the **Application (client) ID**. **Phase 2: Create a client secret** 1. In the **Manage** section, click **Certificates & secrets**, then **New client secret**. 2. Fill out the **Description**, choose an **Expiration** period, and copy the secret's **Value**. After it expires you'll need to create a new client secret and reconnect. **Phase 3: Configure API permissions** 1. In the **Manage** section, go to **API permissions → Add a permission → Microsoft Graph → Application permissions** and add the permissions listed in **Required plan and roles** above. 2. Click **Grant admin consent for \** and confirm. **Phase 4: Connect in Lumos** 1. Find the Microsoft Teams card in your Lumos integrations (reconnect an existing card or add a new one). 2. **Tenant ID:** in the Entra admin center, open **Tenant properties** in the **Entra ID** section and copy the Tenant ID. 3. Enter the **Client ID** and **Client Secret** from your app registration. 4. Click **Connect**. Lumos completes an admin-consent flow against your tenant, then authenticates with the client credentials. ## API Endpoints Used The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them. ## Lumos notifications in Microsoft Teams The Microsoft Teams card above manages Teams licenses, teams, and channels. To also send Lumos notifications to people in Teams, install the Lumos Teams app. 1. Make sure the [Microsoft 365 / Entra ID](/integrations/library/microsoft-365-azure-ad-entra-id) integration is connected. 2. Send your Teams admin the Lumos Teams app package, [LumosTeams.zip](/files/LumosTeams.zip), and have them install it for the users who should get notifications. They can install it for the whole company or a small test group first. 3. Wait for the app to finish installing. 4. In Lumos, go to **Settings → Notifications**, enable **Microsoft Teams**, and click **Save Changes**. Microsoft Teams enabled in Lumos notification settings To request and approve access from Teams once the app is installed, see [Access Requests in Microsoft Teams](/kb/appstore/access-requests-in-microsoft-teams). ## Troubleshooting **Connecting fails with "Couldn't find an enabled license that contains provisioned Microsoft Teams".** The connector validates that your tenant has at least one enabled license SKU with a provisioned Teams service plan. Check your subscriptions in the Microsoft 365 admin center before reconnecting. **License assignment fails with "License does not have available seat".** The SKU has no remaining seats. Free up or purchase seats, then retry. **Channel role assignment fails with "User is not found in the team".** Channel membership requires team membership first. Assign the team role, then retry the channel role. **A user is missing from the sync.** Lumos syncs users who hold a license that includes Microsoft Teams. Users without a Teams-eligible license don't appear on this card. They may still appear in the Microsoft 365 / Entra ID integration. **Activity data syncs slowly.** Microsoft Graph throttles the sign-in activity report at 10 requests per minute per app per tenant. Lumos batches users into the fewest possible requests and backs off automatically. **The connection stopped working after some months.** Client secrets expire on the schedule chosen when they were created. Create a new client secret in the app registration and reconnect in Lumos. **Does disabling a user immediately sign them out of Teams?** No. Microsoft doesn't revoke active session tokens when `accountEnabled` is set to false. The user stays signed in until their current token expires. Revoke their sessions in Entra directly if you need immediate sign-out. **Which integration manages Office 365 licenses like E3/E5/Copilot?** Broad Office 365 license management is handled by the separate Office365 integration. This card manages license assignment for SKUs that include the Microsoft Teams service plan.