Roles required in the setup of the Microsoft Teams integration

Gene Shtilkind — Wed, 23 Jun 2021 19:10:27 GMT

Purpose

The setup of the Microsoft Teams integration often requires collaboration across various groups within an organization. The goal of this document is to clarify the roles and responsibilities of each party involved.

Who is involved?

There are, at minimum, 4 different roles required in enabling the integration between your ServiceNow instance and your Microsoft Teams tenant.

Typically, in a large organization, there will be 3 individuals involved. 1 will be the ServiceNow System Administrator, another will be an Azure AD administrator who is assigned the external_app_install_admin role in ServiceNow, and the third will be a Teams administrator.

In a smaller organization, there may be one administrator on the ServiceNow side (System Administrator) and one administrator on the Microsoft side, who has both an administrator role in Azure AD and the Teams administrator role.

ServiceNow Roles

admin (System Administrator) – "admin" is the System Administrator role within ServiceNow. In this scenario, the System Administrator is involved in multiple parts of the process, including identifying the individuals to help with the integration setup, assigning the external_app_install_admin role, and configuring the Teams integration within the ServiceNow instance.

external_app_install_admin - This is a scoped administration role with very limited privileges. This role enables a user to connect the ServiceNow instance to an external system, in this case, Microsoft Teams.

Azure AD Roles

A user must have one of the following roles in Azure AD and the external_app_install_admin role in ServiceNow, in order to complete the connection and authorization portions of the setup experience.

Note: The actual time required to click through the Connection and Authorization steps is minimal (just a few minutes); however, the individual who is assigned an administrator role in Azure and the external_app_install_admin role may have less experience with ServiceNow than the System Administrator and will have questions about the integration. It will expedite the setup process if the System Administrator carves out time to sit with the external_app_install_admin as they work through the setup, to answer any questions.

Microsoft Teams Roles

Teams administrator – This user will be responsible for uploading the application manifest into the Microsoft Teams tenant and can assign custom app policies. One step in the setup requires creation of a custom app policy. Additionally, custom app policies can be used to restrict which users have access to the ServiceNow for Teams application, enabling testing as well as limited rollouts, targeting a specific region or a specific set of users, before doing a global rollout.

Roles Chart

	ServiceNow	Azure AD	Teams
Admin (System administrator)	X
External_app_install_admin	X
Application Administrator		X
Cloud Application Administrator		X
Global Administrator		X
Privileged Role Administrator		X
Teams Administrator			X

Setup Steps

ServiceNow System Administrator installs the required applications/plugins.
ServiceNow System Administrator identifies the appropriate users with the Microsoft Application administrator role and the Teams administrator role.
The System Administrator assigns the external_app_install_admin role to the Microsoft Application Administrator.
The System Administrator should provide a link to the page where the Azure AD Application Administrator can establish the connection between the instance and tenant, and then, subsequently, authorize the apps. Link: https://www.{instance-name}.service-now.com/nav_to.do?uri=%2Fsn_now_azure_app_installer.do
The Azure AD Administrator will connect the ServiceNow instance to their Teams tenant.
The Azure AD Administrator will review and authorize each of the multi-tenant apps.
Once the Azure AD Application Administrator has completed the connection and authorization steps, the System Administrator will configure and download the manifest.
The System Administrator will share the manifest with the Teams administrator.
The Teams Administrator will upload the manifest to their Teams tenant.
The Teams administrator will block the Now Virtual Agent app so that users do not install it directly and then add the Now Virtual Agent app to the allowed list, so that the bot is able to function in the ServiceNow for Teams app.
The ServiceNow System Administrator will continue with configuration of the ServiceNow for Teams application within the ServiceNow instance.

Re: Roles required in the setup of the Microsoft Teams integration

creativecookie — Tue, 19 Dec 2023 05:02:36 GMT

It's a little unrealistic to expect an integration account be provided admin privileges like "Global Administrator", "Privileged Role Administrator" and "Cloud Application Administrator".

Are these required only for the setup or are they required permanently.

Re: Roles required in the setup of the Microsoft Teams integration

Jason Brough2 — Mon, 15 Jan 2024 13:22:20 GMT

@creativecookie any more recent thoughts on this?

Re: Roles required in the setup of the Microsoft Teams integration

Simon Turton — Tue, 26 Aug 2025 13:46:46 GMT

to respond to the above comments - it appears the article is saying you only need one of the roles not all of them - so having application administrator role should be sufficient. At least that is how the article reads for me as we certainly will not be able to grant global admins to any account running an automated installation process

Re: Roles required in the setup of the Microsoft Teams integration

melvinj05 — Wed, 04 Feb 2026 17:53:26 GMT

what role is needed to use teams chat? everything i am seeing seems to be "itil" or incident write/read

post Roles required in the setup of the Microsoft Teams integration in MS Teams blogs

Roles required in the setup of the Microsoft Teams integration

Purpose

Who is involved?

ServiceNow Roles

Azure AD Roles

Microsoft Teams Roles

Roles Chart

Setup Steps

Re: Roles required in the setup of the Microsoft Teams integration

Re: Roles required in the setup of the Microsoft Teams integration

Re: Roles required in the setup of the Microsoft Teams integration

Re: Roles required in the setup of the Microsoft Teams integration