Go1 Microsoft Teams app: Security permissions explained

When installing the Go1 Microsoft Teams app, permissions are required to access the full functionality of the app. In order to gain access to full functionality, contact your Microsoft Admin (typically a member of your IT team) to approve the following:

Here are the considerations and impact of these permissions within the Teams app:

• Microsoft is responsible for the exact wording of the permissions.

• All permissions require your Microsoft Admin to grant access, except “Sign in and read user profile”; Teams Admins can grant permissions at the ‘application’ level, but not consent on behalf of other users at a higher level.

• Granting application-level permissions grants consent to Go1’s Microsoft application ID

• Go1 uses the same Microsoft application ID to interact with Microsoft for Teams and for Graph Connectors, so the permissions need to include everything. See below to learn more.

How do we leverage your permissions?

• Read all users' full profiles
  Used to identify the teams you own, as part of setting up a Learning Tab via the set up team command

• Read and write files in all site collections
  Used to allow the App to save files you upload into your channel, and allow the App to use those files as part of its Learning Tab

• Read all groups
  Used to identify the teams you own, to help you set up Learning Tabs for those

• Read and write tabs in Microsoft Teams
  Used to identify if you’ve already had a Learning Tab created

• Create channels
  Used to help you create a channel as part of setting up a Learning Tab via the set up team command

• Read the names, descriptions, and settings of all channels
  Used to identify channels you are a part of, as part of setting up a Learning Tab via the set up team command

• Manage Teams apps for all teams
  Used to identify if the App is already installed, as part of setting up a Learning Tab via the set up team command

• Read the members of all chats
  Used to identify who owns the chat, so we can restrict editing of the Learning Tab in the private chat to the chat owner

• Sign in and read user profile
  Used to access names and email addresses, to automatically created an associated Go1 account for your team
  
  

1. Sign in and read user profile / Read all users’ full profiles

This permission allows the Go1 app to understand who teams owners are within your organization. By reading a user’s profile, the Go1 app can see which teams a user is associated with. Team owners can:

• Add Learning tabs to a team where they are a team owner using the Go1 chat bot

• Manage the banner image and learning content delivered through each Learning tab

2. Read and write files in all site collections

In order to upload files from your computer to your Learning tab as a team owner, the Go1 app needs to be able to read files.

In order to upload content from the Files tab, if you have moved files to this repository, the Go1 app needs to write files.

Any files uploaded will be stored on the

3. Read and write all groups

When the Go1 app is added to a team, a learning tab is created. Each learning tab has sections replicating the ‘channels’ available within a team (see ‘finance’ or ‘Leadership’ in the image above, for an example). This requires the Go1 app to read groups.

As a team owner, if you want to create a new channel and replicate this concurrently within the learning tab, select “Add section for channel” option. This action requires the Go1 app to write groups.

4. Read and write items in external data sets

Go1 has developed a Microsoft Graph Connector which can be used to export learning content from Go1 to Microsoft Search. This means learners can find training resources while they are in Office.com, Sharepoint or Bing. This feature is currently in beta. Please contact [email protected] if you would like to learn more.

To use the Go1 Graph Connector, Go1 needs permission to create external items in the Graph API. This permission is only used if your organization has enabled the Graph Connector.

FAQs

Please find the common list of questions regarding the Go1 Microsoft Teams App and permissions below:

Does the Go1 Microsoft Teams App need delegated or administrator level permissions?

The Go1 Microsoft Teams App currently uses both delegated and application permissions - as a result, it needs to be approved for both.

As a result - the customers Microsoft Administrator to install it to approve the higher application level permissions for the App.

Can the Go1 Microsoft Teams App use delegated permissions instead?

No - the Go1 Microsoft Teams App cannot currently operate without full application level permissions

We are exploring enhancements to move more of the App to delegated permissions, but do not have an ETA for that.

What happens if the full ‘Application’ level permissions are not accepted?