Permissions

Seamless automates tasks that Microsoft 365 administrators would otherwise perform manually or with the help of scripts. To do this, Seamless uses Microsoft Graph and SharePoint permissions that are granted as part of the admin consent. Below we show how these permissions are used and which security principles apply.

Application and delegated permissions

Seamless uses two permission types:

• Application: Seamless performs tasks in the background without a signed-in user, for example during provisioning or in scheduled jobs.
• Delegated: Seamless performs actions in the context of the signed-in user, for example in the Admin Center or in the Teams app. Seamless can only access resources and perform actions that the user is authorized for.

Admin consent

During activation, a Global Administrator grants admin consent once for the entire Microsoft 365 tenant. The Seamless enterprise application is then provisioned in Microsoft Entra ID. Users do not receive any additional permissions as a result.

The Seamless Admin Center and the Teams app use the same enterprise application. This reduces security risks, simplifies the central management of permissions and allows all access to be fully revoked in one place.

New permissions (consent update)

If a new Seamless feature requires additional permissions, renewed admin consent by a Global Administrator is required.

You can see the current status in the Admin Center under Settings → More → Consents. There you grant consent again with Update consent. Alternatively, you can do this directly in Microsoft Entra ID.

Microsoft Graph (19)

Claim value and type	Permission	Purpose
TeamMember. ReadWriteNonOwnerRole.AllApplication	Add and remove members with non-owner role for all teams	Provisioning: add users to the group and channels
User.ReadWrite.AllApplication	Read and write all users’ full profiles	User sign-in and guest management
ChannelSettings.Read.AllApplication	Read the names, descriptions, and settings of all channels	Display a team’s channels
Directory.ReadWrite.AllApplication	Read and write directory data	Provisioning: allow or block guest access to the group
Group.ReadWrite.AllApplication	Read and write all groups	Create teams, list and change groups
Team.ReadBasic.AllApplication	Get a list of all teams	Display team settings in the detail view
AppRoleAssignment. ReadWrite.AllApplication	Manage app permission grants and app role assignments	Assign and remove the Seamless admin role in the Admin Center
InformationProtectionPolicy. Read.AllApplication	Read all published labels and label policies for an organization.	Read and display sensitivity labels
Tasks.ReadWrite.AllApplication	Read and write all users’ tasks and tasklists	Read existing Planner plans and provide them as templates in the Teams app
AuditLog.Read.AllApplication	Read all audit log data	Determine guests’ last sign-in and who invited them
Sites.FullControl.AllApplication	Have full control of all site collections	Provision, configure and manage SharePoint sites and libraries
AuditLog.Read.AllDelegated	Read audit log data	Determine guests’ last sign-in
Channel.ReadBasic.AllDelegated	Read the names and descriptions of channels	Teams app: display a team’s channels
Directory.ReadWrite.AllDelegated	Read and write directory data	Teams app: invite guests on behalf of the user
Files.ReadWrite.AppFolderDelegated	Have full access to the application’s folder (preview)	Store user settings
Notes.Read.AllDelegated	Read all OneNote notebooks that user can access	Teams app: quick access to OneNote notebooks
Sites.ReadWrite.AllDelegated	Edit or delete items in all site collections	Configure access permissions at SharePoint level
Team.ReadBasic.AllDelegated	Read the names and descriptions of teams	Teams app: display the user’s teams
TeamMember.ReadWrite.AllDelegated	Add and remove members from teams	Teams app: owners manage members

Office 365 SharePoint Online (2)

Claim value and type	Permission	Purpose
Sites.FullControl.AllApplication	Have full control of all site collections	Provisioning: set up sites, set permissions and create content
AllSites.FullControlDelegated	Have full control of all site collections	Admin Center: site provisioning

Remove the Seamless enterprise application

1. Sign in to the Microsoft Entra admin center.
2. Open Enterprise applications.
3. Select the Seamless application.
4. Open Properties.
5. Click Delete.

After deletion, Seamless can no longer access your Microsoft 365 tenant. Your configurations in Seamless are retained. If you add the enterprise application again through admin consent, everything is available unchanged.

Next steps

Integration and extensionsSeamless API and webhooks

Learn more

Activate SeamlessSign-up, admin consent and permissions