Pia Chat Installation Pre-requisites

Pia Chat requires specific Microsoft Graph permissions to perform actions in Microsoft Teams. Some of these permissions are granted during onboarding while the others need to be granted to Pia if you wish to use Pia Chat. This article outlines the Graph scopes needed for a successful Pia Chat installation and explains how each permission is used within Teams.

Required MS Graph Delegate Permissions

Scopes	What they are used for
Directory.AccessAsUser.All	This permission allows Pia Chat to act exactly as the signed‑in user when accessing Microsoft Entra ID (Azure AD) directory resources. This scope required during tenant configuration so you will likely have this scope enabled during onboarding.
AppCatalog.ReadWrite.All	This permission is required for uploading Pia Chat in your Teams, updating versions and removing Pia Chat. This permission is newly required and must be assigned for Pia Chat Installation.
teams/user_impersonation	This permission enables Teams left-rail pinning feature i.e. allows Pia Chat to be pinned in the left menu in Teams which is recommended for best user experience as this allows easy access to Pia Chat.

Minimum roles your user must have

In addition to above permissions, the account you use to authorize must have at least the following Microsoft Entra roles.

Roles	What they are used for
Teams administrator	This role will give the user permissions to control how Microsoft Teams is configured, managed, and governed across the entire tenant Teams which is required to manage Pia Chat in Teams.
Application Administrator	This is a Microsoft Entra ID (Azure AD) role that gives the user the ability to fully manage enterprise applications and app registrations in your tenant.