Provisioning a Teams Chat Service Account

Provision a service account for Microsoft Teams (Chat) to allow Cloud App Security to run advanced threat protection and data loss prevention scanning on messages and files in protected private chats.

Important:

Cloud App Security protects the Teams and Chat services in Microsoft Teams separately.

As Microsoft's licensing models for Teams APIs impose usage restrictions and licensing requirements on API calls, you need to use your own app registered with Azure AD and select an applicable licensing model when provisioning Teams Chat. For details about the licensing models, see Microsoft Documentation.

The following table summarizes the licensing models and the supported Cloud App Security protection under each model.

Model	Licensing and Payment Requirements	Supported Cloud App Security Protection
Model A	An appropriate Microsoft 365 E5 license Payment to Microsoft when the API usage exceeds the upper limit	Scan messages and files. Block or pass messages and files upon detecting risks.
Model B	Payment to Microsoft for each API call No license required	Scan messages and files. Pass messages and files upon detecting risks. Note: Blocking messages or files is not supported.
Evaluation Mode	No license or payment required	Scan messages and files. Block or pass messages and files upon detecting risks. Note: As this model provides limited API calls, Cloud App Security can scan and take action on only a limited number of messages and files.

Important:

If you have already provisioned Teams Chat in the old way without creating your own app, Evaluation Mode applies. Trend Micro recommends that you update the provisioning to have access to all the licensing models and continued Cloud App Security protection by performing the following:

Go to Administration > Service Account, locate your Teams Chat service account, click Protect with Your Own App, and complete the provisioning by referring to the operations in this topic.

Private chat files are stored in the sender's OneDrive folder. If you have also provisioned a OneDrive service account, when the user sending or uploading a file is selected as a policy target respectively, Cloud App Security applies the corresponding policies for Teams Chat and for OneDrive to this file.

The steps outlined below detail how to provision a service account for Teams Chat from Dashboard.

Log on to the Cloud App Security management console.
Hover over Teams Chat and click Provision.
The Provision Service Account for Teams Chat screen appears.
Create an app in Azure AD for protecting Teams Chat.
For details, see Creating an Azure AD App for Teams Chat Protection.
Specify the app ID and secret, and click Grant Permission.
Cloud App Security uses the secret to obtain an access token from Microsoft.
Note:
- If for some reason the access token becomes invalid after the provisioning, go to Administration > Service Account to create a new access token for the service account. For more information, see Service Account.
- If the secret becomes invalid or you want to change to another app after the provisioning, go to Administration > Service Account, locate your Teams Chat service account, and click Update Secret or Change App to start replacing the secret or changing to another app. The subsequent procedure is the same as the provisioning described in this topic.
Specify your Office 365 Global Administrator credentials and click Sign in.
The Microsoft authorization screen appears.
Click Accept to grant Cloud App Security permission to use the Graph API to access your Teams Chat related service data.
Go back to the Cloud App Security management console and select a Microsoft licensing model.

Note: To change the protection mode after provisioning, see Configuring Microsoft Licensing Model Settings for Teams Chat.
Click Done.
Cloud App Security then updates the Teams Chat data in your organization. The time required depends on how much data you have in Teams Chat.
Hover over the ring icon in the upper-right corner of the management console.
If the message "Teams Chat protected." appears on the Notifications screen, the provisioning is successful.