graph-integration

name	graph-integration
description	Use this skill when the user is calling Microsoft Graph from a Microsoft Teams bot — listing or creating users / events / messages / files via `api.graph`, switching between app-only and on-behalf-of user tokens, or designing a Graph-driven feature. Triggers on "Microsoft Graph Teams", "api.graph", "list calendar events bot", "send mail Teams bot", "graph permissions".

Microsoft Graph integration

The api.graph proxy in the handler context is a typed Graph SDK pre-bound to the current activity's identity. Picking the right token (app vs. user) is the single most important decision.

1. App-only vs. user (on-behalf-of)

Token	When	Permission type
App-only	Bot acts as itself — internal automations, tenant-wide reads	Application permissions
User (OBO)	Bot acts on behalf of the signed-in user	Delegated permissions

Set both up in the AAD app registration ("API permissions" → add Graph permissions for each type you need, admin-consent the application ones).

2. App-only call

app.on('message', async ({ send, api }) => {
  // api.graph uses the app's own token by default
  const teams = await api.graph.teams.list();
  await send(`This tenant has ${teams.value.length} teams.`);
});