When AB Projects is installed, Microsoft shows your administrator a consent screen listing permissions. The list looks long, but every entry maps to a feature you can see in the product — and most of it is delegated access, meaning the app acts as you and can never do more than you already can.
What is Microsoft Graph, and what do the permissions power?
Microsoft Graph is Microsoft 365's built-in API — the official doorway apps use to work with Teams, Outlook, and your profile. AB Projects uses it for four things:
Channel linking & roster sync
Connecting a project to the right Teams channel and automatically adding channel members to the project — see Adding or Removing Members.
Task cards & comment sync
Posting task cards and comments into the channel thread, and syncing replies in that thread back to the task.
Calendar scheduling
Creating an Outlook calendar event for a task when you choose to time-block it, and scheduling meetings.
Sign-in (SSO)
Password-free sign-in with your Microsoft 365 account — see SSO and Microsoft Login.
The permission list, explained
Delegated = the app acts as the signed-in user, limited to what that user can already do. Application = used by the AB Projects bot without a signed-in user, for background work like syncing thread replies.
| Permission | Type | Why AB Projects needs it |
|---|---|---|
User.Read | Delegated | Sign-in and reading your basic Microsoft 365 profile. Required by any app that uses Microsoft sign-in. |
openid, profile, email | Delegated | Standard sign-in scopes: authenticate you, and read your name, avatar, and email address so tasks and comments are attributed to the right person. |
offline_access | Delegated | Lets the app refresh its access in the background (e.g. calendar sync) without asking you to sign in again every time a token expires. |
Team.ReadBasic.All | Delegated | Reads the names of the Teams teams you belong to, so a project can be linked to the correct team. |
Channel.ReadBasic.All | Delegated | Reads basic channel names so the right channel can be picked during tab setup and shown correctly. |
Group.Read.All | Delegated | Reads the Microsoft 365 groups behind your teams — used for project ↔ channel linking and the automatic roster sync that adds channel members to the project. |
ChannelMessage.Send | Delegated | Posts the task card to the linked channel when a task changes or a comment is added (including @mentions of members you pick). |
ChannelMessage.ReadWrite | Delegated | Reads and posts channel messages so task comments and updates land in the task's own Teams thread. |
ChannelMessage.Read.All | Delegated | Reads messages in channels where the app is used, to relate thread activity to the corresponding task. |
ChannelMessage.Read.All | Application | Lets the bot read replies in a task's Teams thread without a signed-in user, so those replies can be synced back to the task as comments. |
Calendars.ReadWrite | Delegated | Creates and updates an Outlook calendar event for a task when you choose to sync it (time-blocking). Requested at sign-in so no extra consent prompt appears later. |
Teamwork.Migrate.All | Application | Supports Teams message import/migration via background jobs — infrastructure-level capability, not a user-facing feature. |
Notes for administrators
- Delegated access can't exceed the user. Most rows above act as the signed-in person — if they can't see a channel, neither can the app.
- Application permissions are for the bot. They cover posting task activity to channels and syncing thread replies back to tasks when no one is interactively signed in.
- Calendar writes are opt-in per task. The app only touches your calendar when you explicitly sync a task or schedule a meeting from one.
- You stay in control. Permissions can be reviewed or revoked at any time in Microsoft Entra ID; consent may be required once per organization at first sign-in (see SSO and Microsoft Login).
In short: the permissions exist so tasks, Teams channels, and your calendar stay in sync — nothing here reads your mail or files, and the consent screen in Entra ID is always the definitive list.