Teams Approval Cards Setup

With Teams approval cards, GrantFlow sends each approver a card in a 1:1 Teams chat whenever an activation request needs their approval. Approvers approve or deny directly on the card, and the card updates itself as the request moves on. Email notifications continue as before.

This guide is for administrators. It takes you through the one-time setup in your Microsoft 365 tenant and in GrantFlow.

Before you start

You need:

• Microsoft Teams licenses for the approvers who should receive cards.
• Your organization onboarded to GrantFlow.
• A Teams administrator for the Teams admin center steps.
• A Global Administrator, Cloud Application Administrator or Privileged Role Administrator to grant admin consent.
• A GrantFlow administrator to download the app package and turn on Teams approval cards.

You do not need any Graph application permission, bot registration, Azure resource or firewall change. All traffic runs between Microsoft Teams and the GrantFlow cloud.

The steps can run in any order

Teams records installs even while Teams approval cards are still off in GrantFlow. You can, for example, roll out the app to approvers first and turn on the cards later. Nothing is lost.

1. Grant admin consent to "GrantFlow for Teams"

As a Global Administrator or Cloud Application Administrator, open this link in a browser. Replace the two placeholders:

https://login.microsoftonline.com/<your-tenant-id>/adminconsent?client_id=<GrantFlow for Teams application ID>

Your GrantFlow contact provides the GrantFlow for Teams application ID for your GrantFlow environment.

The consent covers:

• Sign-in on the card: the access_as_user scope, plus openid and profile.
• Access to the GrantFlow API: the app's delegated permission to the API. GrantFlow uses it to check every decision exactly as the portal would.

Without consent, each approver sees a consent prompt on their first click. If user consent is disabled in your tenant, approvers cannot decide in Teams at all.

Same roles as in the portal

An approver needs the same GrantFlow User or Admin role in Teams as in the portal. A user without a role receives no access in Teams either.

2. Allow custom apps

In the Teams admin center, go to Teams apps → Manage apps → Org-wide app settings. Turn on Let users interact with custom apps.

If your tenant uses app-centric management, use the equivalent setting there.

3. Download and upload the GrantFlow app package

1. In GrantFlow, go to Admin → Notifications → Channels.
2. Under Microsoft Teams, select Download app package. The button shows the package version, and the file is named grantflow-teams-<version>.zip.
3. In the Teams admin center, go to Teams apps → Manage apps and select Upload new app. Upload the zip unchanged.

Do not edit the package

The package is generated for your GrantFlow environment and carries its app IDs. An edited package will not work.

If the download button is missing and the section says Not available on this GrantFlow environment, Teams approval cards are not offered on this environment. Contact your GrantFlow contact.

4. Make the app available to approvers

In the Teams admin center, allow the GrantFlow app for your approvers. Use a permission policy, or, under app-centric management, the app's availability settings. You can make it available to everyone, or only to your approver groups.

5. Pre-install the app for approvers

In the Teams admin center, go to Teams apps → Setup policies:

1. Add GrantFlow to Installed apps in a setup policy.
2. Assign the policy to your approver groups through a group policy assignment.
3. Optionally, pin the app.

Teams can take up to 24 hours to apply a setup policy. Approvers who are not covered keep receiving email only.

6. Check Conditional Access

Conditional Access policies that apply to the GrantFlow API also apply to decisions made in Teams. If a policy demands an interactive step, such as an MFA prompt or a compliant-device check that Teams cannot complete, the card sends the approver to the GrantFlow portal to decide there.

Adding GrantFlow for Teams as a target of your policies is optional.

7. Turn on Teams approval cards in GrantFlow

In GrantFlow, go to Admin → Notifications → Channels and turn on Teams approval cards. The switch shows when it was last changed.

The switch moves only once GrantFlow has saved the change. Every change is recorded in the audit log as Teams Settings Updated.

Turning the switch on does not send cards for requests that are already waiting. Cards start with the next request that needs approval. A request that is still pending receives its cards the next time it changes, for example when another approver decides.

8. Verify the setup

1. Ask an approver to open the GrantFlow chat in Teams once. This confirms the app is installed.

   On mobile

   Open the chat through the chat list. Opening the app through Apps can load indefinitely.

2. Raise a test activation request that needs this approver's approval.

3. The approver receives a card in the GrantFlow chat. They approve it there.

4. In the GrantFlow portal, check that the request is approved. Check that the audit log has the approval with the channel teams.

Updating the app

When GrantFlow releases a new version of the Teams app, the Download app package button shows the higher version. To update:

1. Download the new package in Admin → Notifications → Channels.
2. In the Teams admin center, go to Teams apps → Manage apps. Open GrantFlow and select Upload file.
3. Upload the new zip.

Teams accepts an update only if its version is higher than the installed one. Uploading the same version again changes nothing. Your policies and installs stay in place. The app is updated, not added a second time.

Turning Teams approval cards off

Turn off Teams approval cards in Admin → Notifications → Channels. The change takes effect immediately:

	While Teams approval cards are off
New requests	No cards are sent. Email notifications continue.
Cards already in chats	They stay as they are and are not updated.
Clicking a card	The approver sees "Teams approvals are turned off for your organisation. Approve or deny this request in GrantFlow."
A decision already in progress	It completes.
App installs and removals	Still recorded, so turning the cards back on needs no new rollout.

When you turn the cards on again, cards still in chats show the current state of their request the next time they refresh.

To remove the app altogether, also remove it from your setup and permission policies.

If you revoke consent for GrantFlow for Teams, decisions in Teams stop once the cached sign-ins expire, after about an hour. The cards then fall back to a sign-in prompt that fails.

Troubleshooting

What you see	What to do
The app does not appear for an approver	Setup policies can take up to 24 hours to apply. Check that the approver is in a group the setup policy and the permission policy cover.
The GrantFlow chat keeps loading on mobile	Open the chat through the chat list, not through Apps.
"Teams approvals are turned off for your organisation…"	Teams approval cards are off in Admin → Notifications → Channels. Turn them on, or decide in the portal.
"GrantFlow is not enabled for your organisation."	Your organization is not active in GrantFlow. Contact your GrantFlow contact.
A consent prompt appears on the first click	Admin consent is missing. See step 1.
"Your account has not been granted access to GrantFlow…"	The approver has no GrantFlow User or Admin role. Assign one as for the portal.
The card sends the approver to the portal	A Conditional Access policy requires an interactive step. See step 6.
An approver receives no card for a request	Check the setup policy coverage and the approver's Teams license. The approver still receives the email.