Rovo + Microsoft Teams

Geoffroy de La Rochebrochard

Hi Community,

We'd like to let employees build Rovo agents that use Microsoft Teams content. Our security team's main rule is that data is never shared "unconsciously" and Rovo having access to all Teams content nreakes this rule. Whoever turns on the integration should know exactly what Rovo can read and what it can't.

The process we have in mind:

1. An employee requests access in our system to build agents that use Rovo with Microsoft Teams.
2. Our security team reviews and grants the request, setting access covering
   1. Channels only: Rovo can read the Teams channels the requester chose. Personal chats (1:1 and group chats) are never read.
   2. Attachments: whether Rovo may read documents shared in those conversations, or only the messages.
   3. Protected people: some people, such as executive committee members, must be fully excluded. Their messages, chats and files are never indexed, wherever they appear.
3. Access is reviewed regularly and can be removed, along with the data already indexed.

What we found so far: the Teams connector is set up once for the whole organisation (tenant based). By default it indexes everything, including private chats. The only filter is an allowlist or blocklist of Teams and channels.

Our questions:

1. Can the integration be turned on per user or per request, instead of once for the whole organisation?
2. Can personal chats be fully excluded, so only channels are indexed?
3. Can we choose whether attachments are read in Teams conversations?
4. Can we exclude specific people so their content is never indexed?
5. Can we automate this, for example through an API driven by our internal request form?
6. When access is removed, is the indexed data deleted?

Has anyone built a similar governance process, maybe by combining Rovo settings with Microsoft-side controls? We'd also welcome input from an Atlassian product specialist.

Thanks!

Ciro

Hi, I went through the current docs on this, so here's what they say, in your order:

1. Per user / per request: no. The connector is set up once per organization by an admin with Microsoft Entra admin rights. What is per user is runtime access: Rovo answers with each person's own Teams permissions, so nobody sees a chat or channel through Rovo that they can't open in Teams.
2. Channels only, no chats: not as a setting. By default it indexes every message, including private chats and private channels. The only filter is an allowlist / blocklist of Teams and channels, which you can change after setup. There's an open feature request for chat inclusion/exclusion: ROVO-987, worth a vote.
3. Attachments: the Teams connector only indexes metadata for files and links shared in channels. Full file content comes in through the SharePoint connector, so that's your real switch.
4. Excluding specific people: nothing in the docs.
5. API / automation: none documented for connector scope. Setup is Microsoft Graph API permissions on the Entra side (plus PowerShell policies if you want meeting transcripts, which are off by default).
6. Deleting indexed data on removal: the docs don't say. I'd get that confirmed in writing by Atlassian support before go-live.

One more trap: the "limit by date" window can't be changed after setup, so choose it before connecting.

So the process you describe can't be enforced inside Rovo today. The closest workable version: keep the connector scoped with a tight allowlist, make that allowlist the thing your security team approves (your request form becomes a ticket to the admin who edits it), and keep chats out of scope until ROVO-987 lands.