使用服务帐户凭据对 Microsoft Graph 进行 OAuth2 身份验证

Question

I would like to create a webservice capable of automatically sending messages in Microsoft Teams. I tried authenticating as an application , but currently Microsoft does not support granting application permissions to send messages in Teams, so the only choice here is to authenticate using a service account with real credentials (Unless there is another way?). This method only specifies using user interaction to log in as a user.

I would like to use a service account teamchatbot@domain.com to authenticate with Microsoft Graph in order to send messages on Microsoft Teams. (similar to this but since I'm not accessing a resource it is a little different.) Is there a way I can silently obtain an access token on behalf of the service account in order to send messages?

Answer 1

It seems that you have a misunderstanding.

Your scene is actually the same as this post .

You should use Resource Owner Password Credentials to call Microsoft Graph API to send messages.

Based on permissions , you need the Group.ReadWrite.All delegated permission. So you need to add this permission into your Azure AD app firstly.

Don't forget to click on "Grant admin consent for {your tenant}" after you add this permission.

Then you can get an access token like this:

You can see that https://graph.microsoft.com/Group.ReadWrite.All has been included in the response.

Now you could use this access token to call POST /teams/{id}/channels/{id}/messages .

Answer 2

There are a few other ways I can think of.

1) One is that you can create a Bot using the Microsoft Bot Framework , and once that bot is installed to the particular team, it can send "pro-active" messages (ie not a message in response to a user's message, but rather whenever you need).

Essentially, when you bot is added to the team, you get access to a specific event in your bot (OnMembersAdded for a general bot, and there's now a new event just for Teams). See more on this in my answer on Detect bot application open event . In this event, you get the information you need for later, which you can store in a database or wherever, and then create the message as if it's your bot posting to the channel. You can see more on that at Programmatically sending a message to a bot in Microsoft Teams .

This option above is a lot of work, but useful if there's other functionality you want from a bot (eg the ability to receive messages from the users)

2) Another, and even more simple way, is to create an incoming webhook directly to the channel. Here's a post on doing this using PowerShell, so you can do that for simple testing and extrapolate from there for Node.

Of course, things like Flow (Power Automate) are an option too, but you're already writing code so one of the above is probably easier.

Hope that helps