The permissions Requests asks for, in plain words.
Most Teams governance installs do not fail at installation. They stop at the Entra admin consent screen, where a publisher you do not know asks for Graph permissions and the admin closes the tab. This page is that screen, before you get to it: every permission the app requests, what each one is for, and what the app never touches.
What the app asks for
Four lines, the same ones the consent screen lists. Nothing else, nothing broader.
Create a Microsoft 365 group and its team when you approve a request
This is the whole job. When an approver accepts a request, the app calls the Graph API once to create the group, turn it into a team and apply the plan. No approved request, no creation.
Read the name and role of the person who asked
The request form and the approval card show who is asking, so the approver decides with the name in front of them. It also lets the duplicate check compare the proposed name against the teams that already exist.
Add that person as owner of the new team
The person who asked for the team is responsible for it. The app makes them its owner at creation, so governance starts with an accountable name instead of an orphaned group.
Sign you in with your Entra ID account
The app is a multi-tenant ISV app: no separate password, no tenant to provision. Your Entra identity is the sign-in, and it is what scopes everything above to your own tenant.
What the app never touches
No access to files, messages or team content. Requests handles requests and approvals — the metadata of team creation — and stores that data in Europe. Your documents and conversations stay exactly where they are, unread by the app.
If you want to see it before you decide anything, the consent screen example on the home page shows the request, the permission list and the Accept and Decline decision, with sample data.
After you click Accept
- 1. You restrict native team creation to a security group in the Entra admin center — the standard Microsoft setting, reversible at any time.
- 2. Everyone else requests a team with a form inside Teams, and the name is checked against existing teams as they type.
- 3. Approvers get a Teams notification, not an email thread. When they approve, the team is created on the spot.
Setup takes about 15 minutes. The free plan gives you 5 approved requests a month with every feature included, so you can prove it works before any budget conversation. Withdraw the consent whenever you want: revoke the app under Enterprise applications in Entra ID and it simply stops working.
The publisher is Shawork, a Microsoft 365 consultancy; Requests is listed on the Microsoft Marketplace. This site, and the business behind it, are built by AI agents on NanoCorp, which keeps this page quick to update as the permission list evolves.