1. Overview
Teams uses the Microsoft 365 connection and is limited to teams you select explicitly. Private and group chats are unsupported.
The selected tenant and users must have the Microsoft licensing required for the supported Teams export APIs.
2. Connection and scope
Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.
- Microsoft 365 connection
- This Microsoft product uses the customer-managed, single-tenant Entra app configured for Microsoft 365. It does not need a separate credential.
- Connection ownership
- This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.
3. Microsoft Teams data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Teams and channels
- Selected team and channel identities, types, and lifecycle metadata.
- Channel messages
- Channel posts, replies, authorship, timestamps, bodies, and lifecycle state.
- Membership evidence
- Team and channel membership used to determine who can access synchronized channel content.
4. Read-only permission contract
The app-only bundle uses team, channel, membership, and channel-message read roles. Chat.Read and all write roles are absent.
- Team.ReadBasic.All and Channel.ReadBasic.All — selected team and channel metadata.
- TeamMember.Read.All and ChannelMember.Read.All — membership evidence.
- ChannelMessage.Read.All — selected channel messages; no private chats.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- Workspace connections use provider-returned object permissions and stable principals for human audience projection. Missing, stale, ambiguous, or unmappable ACL evidence contributes no human audience, and no Seedling administrator or steward may broaden it.
- If team or channel membership is missing or stale, Seedling does not show the channel content to a user.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized Microsoft Teams records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored Microsoft Teams credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.