HomeNewsletterCommunityToolsArchiveBlogAboutQuick Links Subscribe free
← Back to Blog
AI ChatGPTTeamsOpenAIEnterpriseEntra IDMicrosoft GraphAI

ChatGPT Is Now Inside Microsoft Teams — What Every IT Admin Needs to Know

IA
Imran Awan
26 June 2026

OpenAI has quietly shipped one of the most significant enterprise AI integrations of 2026. ChatGPT can now read your Microsoft Teams messages. Not through a user connecting their own account — through a single admin-managed setup that indexes your entire organisation's Teams content and makes it available inside ChatGPT for every user in the workspace.

This is available right now for ChatGPT Enterprise and Edu workspaces. If you manage Microsoft 365, you will get asked about it. Here is what it does, what the admin setup looks like, what the risks are, and how to think about whether to enable it.

What the integration actually does

The Microsoft Teams app with admin-managed sync lets ChatGPT index supported Teams messages and conversation metadata across your workspace. Once enabled, when a user asks ChatGPT a question, it can automatically draw on Teams content to answer — without the user needing to paste anything in or connect their own account.

Example

A user asks ChatGPT: "What was the outcome of last Tuesday's architecture review meeting?" — ChatGPT searches the indexed Teams content and surfaces the relevant discussion, decisions, and action items from the channel the user already has access to.

The key word is already has access to. Microsoft Teams permissions are respected — ChatGPT can only surface content a user is already allowed to see in Teams. A user cannot use ChatGPT to read channels they are not a member of.

Admin-managed sync vs self-service — what is the difference?

There are two versions of the Teams app for ChatGPT. Understanding the difference matters for how you plan the rollout.

Feature Self-service Admin-managed sync
Who sets it upEach user individuallyAdmin sets up once for the whole workspace
Teams content indexedOnly the user's own connected accountAll content in admin-defined scope
Background syncNoYes — content refreshed periodically
Purview label filteringNoYes — admins can exclude sensitive labels
AvailabilityEnterprise, Edu, TeamEnterprise and Edu only
RBAC controlNot availableYes — role-based access control

Admin-managed sync is the one worth planning carefully. It is more powerful, more controlled, and the one that requires Microsoft Entra admin consent before anything happens.

The Entra ID connection — what permissions does ChatGPT request?

This is where most IT admins will want to pause and read carefully. The integration works through Microsoft Graph. When an admin enables the Teams app with sync, ChatGPT requests a set of Microsoft Graph application permissions — meaning it can sync data in the background without each user signing in individually.

A Microsoft Entra admin must grant consent. These are application permissions — they do not self-activate. Nothing syncs until an Entra admin reviews and approves the Graph permissions for the ChatGPT enterprise application in your tenant.

The permissions ChatGPT requests cover reading Teams messages, membership, channel data, and directory information. A notable one is SensitivityLabels.Read.All — a delegated permission used to apply the Purview sensitivity label filter (more on that below). Every permission requires explicit Entra admin consent.

What happens in your Entra ID tenant
1 A service principal for ChatGPT is created in your Entra ID tenant
2 Application permissions are assigned — ChatGPT syncs data without per-user sign-in
3 Entra admin must grant admin consent — without this, nothing works
4 Content syncs in the background — new messages and permission changes refresh periodically

The Purview sensitivity label filter — the most important setting for most organisations

If your organisation uses Microsoft Purview sensitivity labels, this setting is the first thing to configure before enabling sync. It lets admins define which labelled content is excluded from the ChatGPT index.

For example, you can configure the filter so that any Teams message or channel tagged with a Highly Confidential or Restricted sensitivity label is never indexed. ChatGPT will not be able to surface that content regardless of what a user asks.

With Purview filter set
  • ✓ Sensitive channels excluded from index
  • ✓ HR, legal, executive content protected
  • ✓ Finance data stays out of AI queries
  • ✓ Audit trail via Purview
Without Purview filter
  • ✗ All in-scope content indexed
  • ✗ Sensitive discussions may surface
  • ✗ Harder to control data governance
  • ✗ Compliance risk if labels are not applied

Tip: Review your Purview sensitivity label taxonomy before enabling this integration. If labels are inconsistently applied across Teams channels, the filter will only be as good as your labelling coverage. This is a good forcing function for a labelling audit.

What ChatGPT cannot do — it is read-only

The Teams app with sync is strictly read-only. There is a clear list of what it cannot do, which is worth sharing with stakeholders who raise concerns:

Step-by-step: how to enable it

This is the setup sequence for workspace owners and admins. You need a Microsoft Teams admin account that can grant Microsoft Entra admin consent before starting.

1 Enable the Teams app in Workspace settings

In ChatGPT, go to Workspace settings → Apps. Locate Microsoft Teams and enable it for the workspace. If you see two entries — the standard Teams app and the Teams app with sync — you want the one labelled with sync for admin-managed deployment.

2 Grant Microsoft Entra admin consent

You will be prompted to sign in with a Microsoft Teams admin account and grant Entra admin consent for the Graph permissions. Review each permission before approving. This is the step that creates the ChatGPT service principal in your Entra ID tenant.

After granting consent, check Entra ID → Enterprise applications for the ChatGPT service principal. Verify the permissions match what you approved. Monitor this in Entra going forward.

3 Define the sync scope

Use the scope picker to choose which Teams and channels are included in the sync. You do not have to include everything. Start narrow — include the teams and channels that will give the most value, and expand over time as you build confidence.

If you have Microsoft Purview sensitivity labels, configure the label filter here to exclude any labelled content you do not want indexed.

4 Deploy to your team

Use "Deploy to your team" to make the app available to workspace members. Users do not need to set anything up themselves — ChatGPT will automatically reference Teams content when relevant to their queries.

Use RBAC settings in Workspace settings → Apps to control which roles in your workspace can access Teams content in ChatGPT. You can restrict it to specific user groups if you want a staged rollout.

Security considerations every IT admin should review

This integration changes your Microsoft 365 security posture in a specific way. The threat surface is not the application itself — it is identity and consent.

🔒
Monitor the ChatGPT service principal in Entra ID
After consent is granted, watch Entra ID → Enterprise applications → ChatGPT for any permission scope changes. OpenAI has migrated SharePoint app scopes before — Teams may follow. Entra admins will be notified if scope changes require re-consent, but only if they are watching.
🔍
Enable OAuth consent monitoring in Entra
Set up alerts in Entra ID → Monitoring → Audit logs for OAuth consent grants and service principal creation events. OAuth consents are now as important to monitor as lateral movement in endpoint telemetry.
📋
Review new actions before enabling them
All new app actions are disabled by default. Go to Workspace settings → Apps → Manage actions to review what is available. Do not enable actions you have not reviewed, even if they appear harmless.
👤
Check your Conditional Access policies cover the ChatGPT service principal
Application permissions granted to a service principal may not be covered by existing Conditional Access policies that target user sign-ins. Review your CA policies to confirm they account for workload identities if this is relevant to your security posture.

Should you enable it? A decision guide

There is no single right answer — it depends on your organisation's AI adoption stage, data governance maturity, and risk appetite. Here is a simple framework:

Your situation Recommendation
You have Purview labels applied consistently across TeamsEnable with label filter — good governance foundation in place
You have no Purview labels or inconsistent labellingEnable with narrow scope first — do a labelling audit in parallel
You have strict data residency or sector compliance requirementsReview OpenAI's enterprise data agreement and DPA before enabling
You are in a pilot with a small group of power usersEnable with RBAC scoped to the pilot group — ideal approach
Your security team hasn't reviewed it yetDo not enable — share this post, book a review session first

The broader picture

This is one of three Microsoft 365 integrations OpenAI has rolled out for ChatGPT Enterprise — the others are SharePoint and Outlook. Each follows the same pattern: admin-managed setup, Graph application permissions, Entra admin consent, Purview label filtering, RBAC controls.

OpenAI is also migrating the SharePoint app scope from delegated to application permissions as of June 2026 — Teams may follow the same path. If you have already enabled the SharePoint connector, check your Entra ID app permissions and confirm the scope migration has been handled correctly in your tenant.

Bottom line for IT admins: This is a genuinely useful integration when configured correctly. The value is real — Teams is where your organisation's institutional knowledge lives, and making it searchable through a natural language interface is powerful. The risk is manageable with proper Entra governance, Purview labelling, and a scoped rollout. The admins who will struggle are those who enable it without reviewing the Entra permissions and assuming Teams security handles everything. It does not — you need to actively manage the ChatGPT service principal in your tenant.

Share this post
LinkedIn X / Twitter Reddit Bluesky

More from EndpointWeekly

AI
Copilot Notebooks Now Available to Copilot Chat Users: What Is…
Microsoft is expanding Copilot Notebooks to Copilot Chat users for the first time,…
AI
Claude Opus 4.8 Is Now Inside Microsoft 365 Copilot: What IT…
Anthropic Claude Opus 4.8 is now available directly inside Microsoft 365 Copilot…
AI
Microsoft Agent 365: The IT Admin Guide to Governing AI Agents…
Microsoft Agent 365 is generally available as of May 1, 2026 — a purpose-built control…