Question 1

Which Graph permissions are needed?

Accepted Answer

The connector requests ChannelMessage.Read.All, Team.ReadBasic.All, and User.Read as a minimum. Admins can grant additional scopes such as OnlineMeetings.Read or Files.Read.All if you want Ana to reach meeting transcripts or shared files. All scopes require tenant admin consent in Azure AD.

Question 2

Does Ana honor conditional access policies?

Accepted Answer

Yes. Because Ana authenticates through Entra ID with the user's identity when per-user OAuth is enabled, any conditional access policy — MFA, device compliance, IP ranges — applies automatically. Admins do not need to configure TextQL separately to enforce these policies.

Question 3

How is the Graph token handled?

Accepted Answer

Tokens are encrypted in TextQL's credential vault and injected at the network layer by our egress proxy. Ana's Python sandbox only sees a helper function and never the token value itself. Token refresh happens transparently outside the sandbox.

Question 4

Can Ana post to Teams?

Accepted Answer

Yes, with appropriate write scopes. By default the connector is read-only. Admins can enable ChannelMessage.Send to let Ana post messages, notify on-call channels, or create cards from analysis. Write access is audit-logged separately.

Question 5

Which Microsoft tenants are supported?

Accepted Answer

Any Microsoft 365 or Entra ID tenant that allows third-party app consent. Government clouds (GCC, GCC High, DoD) are supported with separate endpoint whitelisting. Contact TextQL for sovereign cloud configurations.