Begin Scanning a Microsoft Teams App

Learn how to add the Microsoft Teams app so that SaaS Security API can protect the assets on them from data exfiltration and malware propagation.
To connect Microsoft Teams to SaaS Security API and begin scanning assets, you need to:
  • Plan to add the Office 365 app—either before or after you add the Microsoft Teams app, if you haven’t already done so. SaaS Security API depends on Office 365 app to scan Microsoft Teams attachments. In doing so, you must meet the onboarding requirements for Office 365 app.
    Additionally, enable activity monitoring during the course of onboarding the Office 365 app. You must turn on auditing in Office 365 to record user and admin activity. This feature isn’t enabled by default. SaaS Security API needs audit logs to search and report on activity and to perform forward scans. If you don’t turn on auditing, you’ll observe missing functionality related to user and administrator activity for Microsoft Teams, including activity related to channel creation.
  • Ensure that you have an Office 365 account with Global Administrator role permissions.
  • Grant SaaS Security API access to Microsoft Teams.
  • Add the Microsoft Teams app to SaaS Security API, providing SaaS Security API information about your Microsoft Teams account.
For information on which automated remediation capabilities SaaS Security API supports with Microsoft Teams, refer to Supported Content, Remediation and Monitoring.

Add Microsoft Teams App

In order for SaaS Security API to scan assets, you must consent to specific permissions during the course of adding the Microsoft Teams app.
  1. Establish communication between SaaS Security API and Microsoft Teams.
    1. Go to and log out of Office 365 to ensure that you are not logged in as a user other than an account with Global Admin role permissions.
    2. Log in to Office 365 using an account that has the Global Admin role permissions:
  2. Add the Microsoft Teams app.
    1. From the
      , click
      Add a Cloud App
    2. Select
      Microsoft Teams
    3. Select Connect to Microsoft Teams Account.
    4. Enter the login credentials for the account with Global Admin role privileges on the Microsoft Online page to which SaaS Security API redirects you.
    5. Review and
      the permissions requested.
      SaaS Security API requires these permissions to scan your assets on Microsoft Teams.
      After authentication, SaaS Security API adds the new Microsoft Teams app to the Cloud Apps list as
       n, where n is the number of Microsoft Teams app instances that you connected to SaaS Security API. For example, if you added one Microsoft Teams app, the name displays as
      MicrosoftTeams 1
      . You’ll specify a descriptive name soon.

Customize Microsoft Teams App

After you add the Microsoft Teams app, customize the app to make use of capabilities that are unique to this app or that differentiate this app instance from others.
  1. (
    ) Give a descriptive name to this app instance.
    1. Select the MicrosoftTeams n link on the Cloud Apps list.
    2. Enter a descriptive
      to differentiate this instance of Microsoft Teams from other instances you are managing.
    3. Click
      to save your changes.
  2. Next Step
    : Proceed to Identify Risks.

Identify Risks

When you add a new cloud app, then enable scanning, SaaS Security API automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
  1. Start scanning the new Microsoft Teams app for risks.
    1. Select
      Cloud Apps & Scan Settings
    2. In the Cloud Apps row that corresponds to the new M app, select
      Start Scanning
  2. During the discovery phase, as SaaS Security API scans files and matches them against enabled policy rules:
    • Verify that SaaS Security API displays assets.
      Attachments display under Office 365 as outlined in FAQs for Microsoft Teams App.
    • Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
  3. (
    ) Modify match criteria for existing policy rules.
  4. (
    ) Add new policy rules.
    Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
  5. (
    ) Configure or edit a data pattern.
    You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

FAQs for Microsoft Teams App

What content does SaaS Security API scan for Microsoft Teams?
How does SaaS Security display Microsoft Teams attachments?
SaaS Security API web interface displays the attachment as a SharePoint or OneDrive asset, not as a Microsoft Teams asset.
If your assets are not displaying as expected, there are known reasons as outlined in Fix Office 365 Quarantine Issues.
Does SaaS Security API support quarantine for Microsoft Teams channel messages and direct chats?
Does SaaS Security API block sensitive content in channel messages?
SaaS Security API cannot currently prevent users from posting sensitive content in messages to a channel, but automatic remediation is supported for User Quarantine as outlined in Remediation Support on SaaS Security API.
With automatic remediation (User Quarantine), the following occurs automatically for the message that contains the sensitive content:
  • It’s is hidden in the channel and, therefore, cannot be shared further.
  • The user who posted the message can view the asset and observe that it’s flagged due to sensitive content.
  • The incident generated for this asset automatically closes after the aforementioned automatic remediation actions.
Can SaaS Security web interface display connection information (for example, IP address and OS version) for meeting participants who are not Microsoft users or who were not logged in under their accounts?
No. SaaS Security web interface can only display information provided by Microsoft's logs/events.

Recommended For You