> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-teams.md).
# Microsoft Teams
Use Microsoft Teams data with Cortex Cloud.
This connector includes the following capabilities and sub-capabilities (if applicable):
* **Data Security:** Scan and protect Microsoft Teams data across channel messages, chats, and shared files. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
To configure this connector, follow these steps:
#### Prerequisite
#### Global Administrator access to the Azure portal
Sign in to the [Microsoft Azure portal](https://portal.azure.com/) as a Global Administrator. Use the [Create a Microsoft Entra ID](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-new/create-a-microsoft-entra-id.md) page to obtain the following values:
* **Tenant ID:** Directory ID for your Microsoft Teams tenant.
* **Client ID:** Application ID generated during app registration.
* **Client Secret:** Client secret generated for the registered application.
### Configure the Microsoft Teams connector
#### Task 1: Select services
1. In Cortex Cloud, navigate to **Settings** → **Data Sources & Integrations**.
2. Select **+ Add new**.
3. On the **Add Data Sources or Integrations** page, search for **Microsoft Teams**, then hover over it. The new Microsoft Teams connector description reads “Microsoft Teams integration for data security across channel messages, chats, and shared files | Microsoft Teams integration for security posture management.”
4. Select **Add**.
5. Set up your Microsoft Teams instance by following the wizard steps in the following tabs.
Capabilities tab
1. Enter a unique name for the new connector instance.
2. **Data Security** is selected automatically to scan and protect Microsoft Teams data across channel messages, chats, and shared files.
3. Select **Next**.
Connection tab
1. On the **Connection** page, enter the **Tenant ID**, then select **Apply**.
2. After the Tenant ID is validated, enter the **Client ID** and **Client Secret** in their respective fields.
3. Select **Test** to validate the connection settings.
4. If the connection is successful, the wizard displays a green **Verified** status indicator.
{% hint style="info" %}
**Note**
If validation fails because of incorrect field values, close the wizard and restart the workflow. The current wizard session cannot be reused after a validation failure.
{% endhint %}
5\. Select **Next** to proceed.
Summary tab
1. On the **Summary** page, verify that each selected capability displays a **Connected** status.
2. If validation succeeds, the wizard displays a **Verification Success** message.
3. Select **Create Instance** to create the Microsoft Teams connector.
#### Task 2: Post-verification (optional)
After onboarding is complete, verify asset discovery and data security findings.
**Verify discovered assets**
1. Go to **Inventory** > **All Assets**.
2. Filter the asset list by setting **Provider** to **Microsoft Teams**.
3. Verify that Cortex discovers the following supported asset types:
* **Microsoft Teams Workspace:** Mapped to Active Directory (AAD) Groups containing Public, Private, or Shared Channels.
**Verify policy findings**
1. Select a OneDrive or other supported asset to open the details panel.
2. Review the **Overview** tab for asset health and other details.
3. Go to **Findings** to review detected security findings, including:
* **Sensitive Content Detections:** Sensitive data matches, such as financial data, health records, credentials, API tokens, credit card numbers, and personally identifiable information (PII), detected in files stored in Microsoft Teams chat messages and conversations.
* **Insecure Sharing and External Exposure:** Sensitive information shared in Microsoft Teams chats or conversations with external or guest users.
{% hint style="info" %}
**Note**
* Any user addition to or removal from a Microsoft Teams group chat may take up to **6 hours** to be reflected.
* ACLs for messages sent before a user is added to or removed from a Microsoft Teams group chat are not updated to reflect the membership change.
* After onboarding a connector, Cortex Cloud may take **24 hours to 7 days** to fully process the data and generate findings. If you attempt to re-onboard the same connector using the same credentials during this transition period, previously generated findings and other data may temporarily reappear.
{% endhint %}
### Exposure definitions
Microsoft Teams Workspace content is classified into three exposure categories:
* **Restricted:** Documents shared with one or more users outside the organization.
* **External**: Documents shared with one or more users outside the organization.
* **Organization-wide:** Documents shared with all members of the organization, such as through a “People in your organization” link or tenant-wide permissions.
Microsoft Teams Personal Workspace content is classified into four exposure categories:
* **External**: Documents shared with one or more users outside the organization.
* **Restricted:** Documents shared with Internal Users.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-teams.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.