Package the connector as an importable Teams personal tab - runs on Teams desktop and mobile. Sign-in uses the existing device-code flow, redeemed on your CA-trusted device inside Teams, so Conditional Access is satisfied there - no 53003. (Browser-redirect MSAL/SSO is impossible here: the tenant bans app registrations.)
Install: In Teams, go to Apps, Manage your apps, Upload an app, then "Upload a custom app" and pick the downloaded .zip. It appears as a personal tab.
Pre-flight: (1) custom-app upload must be allowed for your account; (2) the Entra app-registration side-door is blocked tenant-wide, so Teams tab SSO and browser MSAL are unavailable - the tab uses device-code instead. The tab surfaces both checks on open.
The package is built on the fly for this deployment's HTTPS domain - re-download the .zip after deploying to a new domain.
Approved tenant apps that support delegated (per-user) sign-in, read from the last saved snapshot in the database — no live tenant call. Green = admin already consented tenant-wide, so you just sign in with your own account. Yellow = needs a per-user consent prompt (blocked today until an admin enables a consent policy). Everything is bounded by your own role — [WRITE] flags apps whose scopes can change data.
Pick a public first-party client above, then sign in once on your Conditional-Access-trusted phone — the connection then stays alive on its own (auto-refreshing, surviving restarts) until you disconnect. Everything is delegated: the token only reaches what your own role allows. The paste-a-token box below is a short-lived fallback.
Open the Microsoft sign-in page on your Conditional-Access-trusted phone and enter this code:
Waiting for you to redeem the code…
Or paste a Graph token from a trusted browser session
In the Entra admin center: F12 → Network → filter graph.microsoft.com → copy the Authorization: Bearer … value and drop it here. Good for ~1 hour, read-only.
Probes several read planes with the current delegated token and shows what actually returns vs what your role blocks (403). This is the proof that the delegated route pulls real data from here.
Stored snapshots of what your identity can reach across the tenant. Run a map from the Connection tab, then browse results here.