Oct 9, 2026
OAuth access overview
Teamdash connects to Microsoft 365 through the Microsoft Entra ID enterprise application Teamdash, application (client) ID 49f6d4dd-4680-4cab-9090-a981b16de093. This is the application that appears under Enterprise applications in your Microsoft Entra admin center once a user has consented. The application uses delegated permissions only: it acts on behalf of the signed-in user and holds no application-level access to your tenant.
Every Microsoft connection asks for these base permissions:
openid
profile
offline_access
The Graph permissions on top of those depend on which capabilities the user selects when connecting the Microsoft 365 integration. Teamdash requests only the scopes for the selected capabilities, so a user who enables email sync alone is never asked for calendar access.
Capability | Graph permissions requested |
Interview scheduling | Calendars.ReadWrite (or Calendars.ReadBasic with read-only calendar access), User.Read, User.ReadBasic.All (optional), Place.Read.All (optional) |
Email sync | Mail.Read |
Video calls | OnlineMeetings.ReadWrite; with AI transcripts also Calendars.ReadWrite and OnlineMeetingRecording.Read.All |
The Microsoft 365 integration
One Microsoft 365 integration per user replaces the three separate Microsoft integrations Teamdash offered before. When connecting it, the user picks one or more capabilities:
Interview scheduling: calendar events, availability and meeting rooms through the Outlook calendar.
Email sync: emails exchanged with candidates appear on their profiles.
Video calls: interviews and quick calls through Microsoft Teams.
The integration holds one Microsoft account. A user can hold one active Microsoft 365 integration, and it must be reconnected with the same Microsoft account.
The earlier integrations (Microsoft Calendar schedule, MS Office messages sync and Microsoft Teams calls) are now marked as legacy. Existing ones keep working, but new ones cannot be created. Users who still hold them see an in-app offer to migrate; the migration connects a Microsoft 365 integration with the same capabilities in one consent flow and then retires the legacy integrations. See the appendix for the legacy permissions.
Interview scheduling permissions
Interview scheduling writes interviews into the connecting user's Outlook calendar, so it asks for calendar write access by default.
Permission | Purpose | When requested |
Calendars.ReadWrite | Create, update and cancel interview events in the user's calendar; read availability | Default |
Calendars.ReadBasic | Read availability only | Instead of Calendars.ReadWrite when "Read-only calendar access" is selected |
User.Read | Read the signed-in user's profile and list meeting rooms through the user's own room finder | Always |
User.ReadBasic.All | Look up other users in the organization for scheduling | Unless "Skip User.ReadBasic.All" is selected |
Place.Read.All | List every meeting room in organizations with more than 100 rooms | Only when "More than 100 meeting rooms" is selected |
Read-only calendar access. With this option Teamdash reads availability and meeting rooms but never writes to the Outlook calendar. Interviews go out as Teamdash's own calendar invitations by email, as before, and changes made in Outlook are not synced back. This option cannot be combined with AI transcripts, because recorded interviews are set up through calendar events Teamdash writes.
Email sync permissions
Email sync asks for one Graph permission: Mail.Read. Teamdash reads the connected user's mailbox and never sends, moves or deletes mail through this permission.
Shared mailboxes are not available on the Microsoft 365 integration.
Video calls permissions
Video calls ask for OnlineMeetings.ReadWrite, which lets Teamdash create Microsoft Teams meeting links for interviews and quick calls.
When AI transcripts are enabled, Teamdash sets recorded interviews up as calendar events and reads the meeting recordings afterwards. This adds:
Calendars.ReadWrite
OnlineMeetingRecording.Read.All
AI transcripts are enabled per account by Teamdash support, and they cannot be combined with read-only calendar access. Storing the video recordings in Teamdash is a separate option under video calls that adds no permissions.
Admin consent and migrating from the legacy integrations
Microsoft asks for consent for exactly the permissions of the selected capabilities. If your organization requires admin approval for delegated permissions, the user sees Microsoft's admin approval request on connecting and an administrator must approve it before the integration works.
Migrating from a legacy integration triggers a new consent, because the Microsoft 365 integration asks for permissions the legacy ones did not:
Interview scheduling asks for Calendars.ReadWrite, where the legacy Microsoft Calendar schedule integration had Calendars.Read. Calendars.ReadWrite is a new permission even for organizations that already admin-consented the legacy one.
Users who choose read-only calendar access ask for Calendars.ReadBasic, which an existing Calendars.Read or Calendars.ReadWrite consent already covers.
Administrators who pre-approve permissions can grant the Teamdash application the capability permissions listed above in Microsoft Entra under Enterprise applications before users migrate. Review and revoke procedures are described in Microsoft's enterprise applications documentation.
Technical details
Authentication method: Microsoft Graph API with OAuth 2.0 delegated access. Teamdash stores the user's refresh token and renews access tokens as needed.
Security protocol: HTTPS/TLS for every call in both directions.
Data flow:
Interview scheduling with calendar write access is two-way. Teamdash creates, updates and cancels interview events in the connecting user's Outlook calendar. Interviewers are invited as native attendees by Outlook; candidates receive Teamdash's own calendar invitations by email and are listed in the event body as links to their Teamdash profiles. Teamdash subscribes to change notifications for the user's calendar, so Microsoft notifies Teamdash when an event is moved, deleted or declined in Outlook, and Teamdash applies the change to the interview. The subscription is renewed daily.
Interview scheduling with read-only calendar access is one-way. Teamdash reads availability and rooms, and interviews are delivered as Teamdash calendar invitations by email.
Email sync is one-way. Teamdash polls the mailbox and attaches messages whose From header contains a candidate's email address to that candidate's profile.
Video calls are one-way. Teamdash creates the Teams meeting and, with AI transcripts enabled, subscribes to recording notifications and downloads the recording of that meeting.
Data types exchanged: emails; calendar events with their subject, body, time, location, attendees and attendee responses; free/busy availability; meeting room lists; Microsoft Teams join links; meeting recordings when AI transcripts are enabled.
Inbound webhooks: Microsoft delivers calendar and recording change notifications to Teamdash's public webhook endpoints. The notifications carry only identifiers; Teamdash then reads the changed event through Graph with the user's token.
Appendix: legacy integrations
These integrations can no longer be created, but existing connections keep their permissions until they are migrated.
Legacy integration | Graph permissions |
Microsoft Teams calls | OnlineMeetings.ReadWrite; with AI transcripts also Calendars.ReadWrite and OnlineMeetingRecording.Read.All |
Microsoft Calendar schedule | Calendars.Read, User.Read, User.ReadBasic.All (optional), Place.Read.All (optional, over 100 rooms) |
MS Office messages sync | Mail.Read; Mail.Read.Shared when a shared mailbox is configured |
All three also use openid, profile and offline_access. The legacy calendar integration never writes to the calendar: interviews are delivered as Teamdash calendar invitations by email, one way.