Breaking changes for Microsoft Teams beta APIs – permissions for installing personal apps, removing unused properties from code snippets

Nick Kramer (TEAMS)

At the end of July, we will make the following changes to the beta endpoint. APIs on the v1.0 endpoint are not affected. Changes include:

  • Different permissions for app installations for a user – To improve security by running with least privilege, we have created new permission scopes for /users/{id}/teamwork/installedApps, and are dropping support for overly broad permissions. See below for details.
  • Removing redundant data from code snippets inside chatMessages – In order to simplify the developer experience and reduce payload size, we are removing some unused properties from code snippets. See below for details.

Different permissions for /users/{id}/teamwork/installedApps

We are removing support for User.Read.All, User.ReadWrite.All, Directory.Read.All, and Directory.ReadWrite.All permissions from these APIs:

GET /users/{id}/teamwork/installedApps
POST /users/{id}/teamwork/installedApps
DELETE /users/{id}/teamwork/installedApps/{id}
POST /users/{id}/teamwork/installedApps/{id}/upgrade

Instead, use one of these permissions:

  • TeamsAppInstallation.ReadForUser (delegated)
  • TeamsAppInstallation.ReadWriteForUser (delegated)
  • TeamsAppInstallation.ReadForUser.All (application)
  • TeamsAppInstallation.ReadWriteForUser.All (application)

Removing redundant data from code snippets inside chatMessages

Some chatMessages have code snippet cards inside them, embedded in the content property of an attachment. That content itself has a bunch of properties, we are removing some properties that are redundant.

For example, GET /teams/{id}/channels/{id}/messages/{id} returns something like this, we are simplifying the bolded part:

    “@odata.context”: “$metadata#teams(‘bdb7bcda-9c3b-4341-b9a9-f52bf9a23407’)/channels(‘’)/messages/$entity”,
    “id”: “1584126765017”,
    “replyToId”: null,
    “etag”: “1584126765017”,
    “messageType”: “message”,
    “createdDateTime”: “2020-03-13T19:12:45.017Z”,
    “lastModifiedDateTime”: null,
    “deletedDateTime”: null,
    “subject”: null,
    “summary”: null,
    “importance”: “normal”,
    “locale”: “en-us”,
    “webUrl”: “”,
    “policyViolation”: null,
    “from”: {
        “application”: null,
        “device”: null,
        “conversation”: null,
        “user”: {
            “id”: “…”,
            “displayName”: “…”,
            “userIdentityType”: “aadUser”
    “body”: {
        “contentType”: “html”,
        “content”: “<div><div>Test</div>\n\n<div>&nbsp;</div>\n\n<div><attachment id=\”8c984810e000471c80fe624a2755444f\”></attachment></div>\n</div>”
    “attachments”: [
            “id”: “8c984810e000471c80fe624a2755444f”,
            “contentType”: “application/”,
            “contentUrl”: null,
            “content”: “{\r\n  \”observers\”: [],\r\n  \”type\”: \”application/\”,\r\n  \”cardButtons\”: [],\r\n  \”tapButton\”: null,\r\n  \”cardSender\”: null,\r\n  \”replyChainId\”: \”\”,\r\n  \”conversationId\”: \”\”,\r\n  \”alwaysExpand\”: false,\r\n  \”viewOnly\”: false,\r\n  \”clientMessageId\”: \”\”,\r\n  \”serverMessageId\”: \”\”,\r\n  \”messageType\”: \”\”,\r\n  \”isInputExtension\”: false,\r\n  \”hasMentions\”: false,\r\n  \”handler\”: \”codeSnippetDialog_496bb293-6fa6-42c3-a2d8-521fcbd8afff\”,\r\n  \”editable\”: true,\r\n  \”id\”: \”8c984810e000471c80fe624a2755444f\”,\r\n  \”name\”: \”\”,\r\n  \”language\”: \”Text\”,\r\n  \”lines\”: 1,\r\n  \”cardClientId\”: \”8c984810e000471c80fe624a2755444f\”,\r\n  \”wrap\”: false,\r\n  \”codeSnippetUrl\”: \”$value\”\r\n}”,
            “name”: null,
            “thumbnailUrl”: null
    “mentions”: [],
    “reactions”: []

Here’s what that bolded part looks like today when reformatted to be readable:

    “name”: “”,
    “language”: “Text”,
    “lines”: 8,
    “wrap”: false,
    “codeSnippetUrl”: “$value” ,

    “observers”: [], // going away

    “type”: “application/”, // going away
    “cardButtons”: [], // going away
    “tapButton”: null, // going away
    “cardSender”: null, // going away
    “replyChainId”: “”, // going away
    “conversationId”: “”, // going away
    “alwaysExpand”: false, // going away
    “viewOnly”: false, // going away
    “clientMessageId”: “”, // going away
    “serverMessageId”: “”, // going away
    “messageType”: “”, // going away
    “isInputExtension”: false, // going away
    “hasMentions”: false, // going away
    “handler”: “codeSnippetDialog_c4f35431-2b9b-4158-aef4-b377bdc82357”, // going away
    “editable”: true, // going away
    “id”: “ddd76144c464484ba8c1f42975cfe1ac”, // going away
    “cardClientId”: “ddd76144c464484ba8c1f42975cfe1ac”  // going away

Here’s what it will look like after we remove the redundant fields:

{ “name”: “”, “language”: “Text”, “lines”: 8, “wrap”: false, “codeSnippetUrl”: “$value” }

Tell us what you think

We welcome your feedback. If you have further questions, you can reach out to us on StackOverflow.

-Microsoft Teams

Feedback usabilla icon