Adding a Team using Microsoft Graph API, App vs. Delegated Permissions

[Mary F Harvey]

We discovered an interesting issue when trying to create a team via the 1.0 Graph API as described in this article: https://docs.microsoft.com/en-us/graph/teams-create-group-and-team.  We were using and access token with Application Permissions for Group.ReadWrite.All to create the group and then add the team to the group.  We need to use Application Permissions in order to create more than 250 groups without requiring a Global Admin account. 

We are able to successfully create the new team, but were always getting the "Cannot retrieve files" message when clicking on the Files tab in the Teams client.  After a second or two, clicking on the Files tab showed the empty folder successfully.  It didn't matter how long we waited to click on the Files tab, that message would be displayed and then go away the next time we clicked on the Files tab.  This caused other issues for us as we were trying to add a custom SPFx tab as part of the team provisioning, and it would always fail when we tried to set it up as the channel in SharePoint could not be found.  If we clicked the Files tab to get the General folder created and then tried to set up the SPFx tab, it would succeed.

With additional research, we found that when using Application Permissions to add the team, the General folder never gets added to the Shared Documents library in SharePoint until someone clicks on the Files tab.  However, if we used Delegated permissions to add the team to the group, the General folder is automatically provisioned after a second or so.

If anyone else runs into this issue, you will need to use Application permissions to create the group and then use Delegated permissions to add the team.

Cheers!

[#2]

Hi @Mary F Harvey These Create a Teams using Graph API supports admin permissions. Global admins and Microsoft Teams service admins can access groups that they are not a member of. 

You need to give Application and Delegate permissions both

[#3]

@Trinetra-MSFT , yes, we are aware of that and in fact are using a Teams Admin service account for other tasks.  But we are prevented from creating a global admin service account for security reasons, and according to this article (see https://docs.microsoft.com/en-us/microsoftteams/limits-specifications-teams) each Teams Admin account is limited to creating a maximum of 250 teams.  As a result, we have to use App Permissions to create the groups (as there are a lot of them).  But there seems to be a bug when adding a team to the group using app permissions and so we use a Teams Admin account to add the team with delegated permissions.

[#4]

Let me check this once I will get back to you soon

[#5]

We need to click on Files Tab once when a Team is created by Graph API. This is By Design