For IT admins
Approving Teamsly for your tenant
A user in your organisation tried to sign in to Teamsly and Microsoft asked for admin approval. This page is what you are approving. Two minutes to read, one click to grant — or run it yourself under your own app.
What Teamsly is
An open-source (AGPL-3.0) web and desktop client for Microsoft Teams. It talks only to the official Microsoft Graph API with the user’s own delegated token — the same data the user already sees in Teams, nothing more. Source: https://github.com/mayurrawte/teamsly.
What it stores
- No messages, files, or directory data are stored by Teamsly. Every request is proxied live to Graph.
- The user’s OAuth tokens live in an encrypted, HTTP-only session cookie in their browser. No server-side token store.
- Optional AI catch-up (off by default) sends the selected thread text to OpenAI when the user asks for a summary.
- No analytics SDKs. One anonymous counter records how often sign-in fails on the consent wall.
Full text: Privacy policy.
Permissions, and why
Teamsly asks incrementally: the first sign-in requests only what messaging needs; the rest is requested when a user opens that feature. Tenant-wide consent below covers all of them so users never see a prompt.
Requested at first sign-in
| User.Read | Your name, photo and email for the signed-in account. |
| User.ReadBasic.All | Names and photos of the people in your chats. |
| Team.ReadBasic.All | List the teams you belong to. |
| Channel.ReadBasic.All | List the channels in those teams. |
| ChannelMessage.Read.All | Read channel messages you can already see in Teams. |
| ChannelMessage.Send | Post to channels as you. |
| Chat.ReadWrite | Read and send your direct and group messages. |
Requested when a user opens Files
| Files.Read.All | Preview files shared with you (requested when you open Files). |
| Files.ReadWrite | Upload attachments (requested when you open Files). |
Requested when a user enables presence
| Presence.Read.All | Show who is online (requested when you enable presence). |
| Presence.ReadWrite | Set your own status (requested when you enable presence). |
Requested when a user opens Meetings
| Calendars.Read | List your meetings and join links (requested when you open Meetings). |
All permissions are delegated: Teamsly can never act without a signed-in user and never sees more than that user could see in Teams. No application permissions are requested.
Option A — approve the hosted app (one click)
Sign in as a Global Administrator, Privileged Role Administrator, or Cloud Application Administrator, then:
Grant tenant-wide consent to Teamsly →You can review or revoke it any time under Entra ID → Enterprise applications → Teamsly → Permissions.
Option B — run it under your own Azure app
Many organisations prefer this: register Teamsly as a first-party app in your tenant, grant the permissions above at registration time, and deploy the container. Users then never see a consent prompt and nothing leaves your infrastructure but Graph calls. The self-hosting guide walks through the registration, and docker compose up runs it.
Questions
Open an issue at https://github.com/mayurrawte/teamsly/issues or email mayur@shipthis.co.