An app owner asks to keep a Teams archiving integration. Which conversations can it read, and who controls the server that receives them? A permission review gives you the first answer. To get the second, inspect the integration’s active subscriptions.
In research published on 4 November, NetSPI demonstrated what can happen after an attacker gains control of an app with sufficient Microsoft Graph permissions. In its test, an application with the admin-consented Chat.Read.All permission created a subscription for Teams chat messages. Microsoft Graph delivered encrypted message content to the specified endpoint, where the recipient could decrypt it. Looking only for direct requests to read individual chats would miss that route.
Review the permission and the destination together
Ask the app owner to match each subscription to a business purpose, an approved destination and a named owner. Check whether the tenant collects GraphNotificationsActivityLogs and who would investigate an unexpected destination or renewal. If a subscription cannot be explained, investigate it before renewing approval.
Microsoft’s documentation explains how rich change notifications include encrypted resource data, the certificate information a receiving app needs and how Teams message subscriptions specify a notification endpoint.
Checks for an approved Teams integration
- Confirm the Graph permissions granted to the application and why each is needed.
- List the active subscriptions and identify the resource, destination, application and owner.
- Compare every destination with the supplier architecture and the organisation’s approval record.
- Review subscription creation, renewal and notification activity for unexpected changes.
- Investigate an unexplained subscription before renewing the application’s approval.
For the wider review of external access, identity controls and applications inside Teams, read The fake help desk in Teams: why configuration matters.
Sources
- NetSPI: You’ve Got (Graph) Mail — Leveraging Microsoft Graph API Change Notifications for Data Exfiltration
- Microsoft Learn: Set up Microsoft Graph change notifications with resource data
Bring Teams application evidence into view
OpenGates, embedded in MobSTR, supports the application-assessment part of a Teams review through manifest, configuration, permission and data-handling analysis. Tenant administrators still need to review active Graph subscriptions, destinations and audit evidence in Microsoft 365.