> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/getting-started/teams-setup/teams-permissions.md).

# Teams Permissions

The Microsoft Graph permissions Herd requests when you connect Microsoft Teams, what each one is used for, and which are optional.

Herd connects to Microsoft Teams through a single Microsoft Entra application. A Global Administrator grants these permissions once, from the consent prompt shown during [Teams Setup](/herd-security-docs/getting-started/teams-setup.md). You can review or revoke them at any time in the Microsoft Entra admin center under **Enterprise applications → Herd → Permissions**.

## Required

Herd cannot deliver training to Teams without these.

| Permission                                  | Type        | Why Herd needs it                                                                                                                                                                |
| ------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `User.Read.All`                             | Application | Syncs your employee list (name, email, manager) so Herd knows who to train and who reports to whom.                                                                              |
| `TeamsAppInstallation.ReadWriteForUser.All` | Application | Installs the Herd app for each employee so Herd can message them. Without it, every employee would have to find and install the app manually before they could receive anything. |
| `AppCatalog.Read.All`                       | Application | Locates the Herd app in your tenant's app catalog. Required for the installation step above.                                                                                     |
| `User.Read`                                 | Delegated   | Signs employees in and powers the Herd tabs inside Teams.                                                                                                                        |

## Recommended

Herd works without these, with the limitations noted.

| Permission            | Type        | What you lose without it                                                                                                                                                                                                                                                          |
| --------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Directory.Read.All`  | Application | Confirms which users have been deleted from your directory so their assignments and reminders stop. Herd already removes users who disappear from your main user list, so offboarding still works without this permission. Granting it adds a second check against deleted items. |
| `Files.ReadWrite.All` | Application | Uploads training videos to SharePoint so they display a preview thumbnail inside Teams. Without it, videos still play normally but show a generic placeholder image instead of a preview.                                                                                         |

## Optional, by feature

Grant only the features you plan to use.

| Permission               | Type        | Feature it enables                                                                                                                                                                          |
| ------------------------ | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Sites.Read.All`         | Application | **Policy library.** Lets you browse and select SharePoint sites and document libraries when connecting your policies. Without it, the folder picker cannot list your sites.                 |
| `Group.Read.All`         | Application | **Group targeting.** Syncs your Entra groups so you can assign training by group rather than user by user.                                                                                  |
| `GroupMember.Read.All`   | Application | **Group targeting.** Reads who belongs to each group, so group assignments stay current as people move teams.                                                                               |
| `SecurityAlert.Read.All` | Application | **Phishing report detection.** Reads Microsoft Defender alerts so Herd can recognize and credit employees who report genuine phishing emails. Without it, real-world reports go undetected. |

## How Herd uses this access

* **Directory access is read only.** Herd reads user and group records. It never creates, edits, or deletes them.
* **Only two permissions allow writes, and both are narrow in practice.** One installs the Herd app for an employee. The other writes training videos into a dedicated SharePoint folder.
* **Herd does not request access to mailboxes, calendars, or the contents of chats and channel messages.**
* **`Files.ReadWrite.All` and `Sites.Read.All` are broad by Microsoft's design**, as Microsoft Graph offers no narrower equivalent. Herd uses them only for the training video folder and for the SharePoint locations you choose when configuring your policy library.

{% hint style="info" %}
If your security review needs more detail on any permission above, contact your Herd representative and we will walk through the specific API calls behind it.
{% endhint %}