Connections
Microsoft 365
Beta. The connector and connect flow work end to end, but the integration has had less production use than Google, Slack, Atlassian, and GitHub. Always dry-run before go-live, and tell us what you hit.
Camper is a target for Microsoft collaboration membership. People still enter Camper from your IdP over SCIM (including Entra). Camper does not manage Entra security groups — those stay with your identity provider.
What to link (sysadmin mental model)
Microsoft stacks several products on one directory object. Camper maps them to clear operator jobs:
| You want… | Link in Camper |
|---|---|
| Who is on Engineering’s Team (chat, standard channels, team files) | Microsoft Team |
| Who is on a private channel inside a Team | Private channel |
| Who can edit a standalone SharePoint site (intranet, classic, non-group) | SharePoint site |
| Who is on an Outlook / M365 Group that is not a Team | M365 Group (no Team) |
| Who is in a security group for Conditional Access / app assignment | Your IdP / Entra — not Camper |
Team = group + files + standard channels
A Microsoft Team’s id is the underlying Microsoft 365 Group id. Creating a Team also creates a group-connected SharePoint site. For that object:
- Team membership is the roster for chat and standard channels.
- File access on the team site follows the same membership (the group is nested into SharePoint Owners/Members).
- Do not also link the same object as a Group or as a SharePoint site — Camper blocks dual-link thrash.
Prefer Microsoft Team for almost all department collaboration links.
Private channels vs standard channels
| Channel type | Membership |
|---|---|
| Standard | Inherited from the Team — link the Team |
| Private | Own roster (subset of the team) — link Private channel |
| Shared | Not supported yet |
SharePoint
| Site shape | What to do |
|---|---|
| Team / group-connected team site | Link the Team (or M365 Group if there is no Team) |
| Communication site, classic, non-group | Link SharePoint site |
Camper refuses to attach a group-connected site as SharePoint when it can detect the group owner — use Team/Group instead.
M365 Group (no Team)
Only unified groups that are not Teams appear under this type. Use it for Outlook groups and other non-team collaboration groups. Security groups and distribution lists are not supported.
Prerequisites
- Directory already receiving people (e.g. Entra → Camper SCIM).
- You are a Camper owner or admin.
- The person who clicks Connect is an Entra Global Administrator or Privileged Role Administrator (application permission consent).
Summary of steps
- Connections → Microsoft 365 → Set up
- Admin consent in the customer Entra tenant
- Optional: set the bootstrap owner for Teams Camper creates
- Link resources under Resources (prefer Teams)
Connect
- Open Connections → Microsoft 365 → Set up. Check access lists what consent needs. You can set an optional tenant id to land on that tenant’s admin consent page.
- On Grant consent, continue to Microsoft, sign in to the customer Entra tenant, and accept the application permissions.
- Camper redirects back; status is active when required health probes pass (token, organization, users, groups). Teams, channels, and SharePoint probes may soft-fail — those surfaces stay unavailable until permissions are granted and you reconnect.
- On Team owner, set the Entra user who will own Teams created by Camper (required before managed team create). You can skip — attach still works, and Manage lets you set it later.
If status is error, the tile says so and Fix connection reopens consent with the reason.
What Camper stores
| Stored | Not stored |
|---|---|
| Customer Entra tenant id (sealed) | Long-lived user tokens in the product UI |
Platform app credentials live on Camper’s side. Graph access tokens are minted short-lived in process for API calls.
Application permissions
Configured on Camper’s multi-tenant app (admin consent required):
| Permission | Used for |
|---|---|
Group.ReadWrite.All | Non-Team M365 Groups + underlying group lifecycle for Teams |
Team.ReadWrite.All | Teams create / membership / archive |
Channel.ReadBasic.All | List private channels |
ChannelMember.ReadWrite.All | Private channel membership |
Sites.FullControl.All | Standalone SharePoint site membership (or Sites.ReadWrite.All where sufficient) |
User.Read.All | Resolve people by mail / UPN |
Organization.Read.All | Health / org display name |
After Camper adds permissions, reconnect Microsoft 365 so the customer tenant re-grants consent.
Resource types
| Type | Create managed | Notes |
|---|---|---|
| Microsoft Team | Yes (needs bootstrap owner) | Primary. Chat + standard channels + team files |
| Private channel | Attach only | Id form teamId/channelId |
| SharePoint site | Attach only | Standalone only; group-connected refused |
| M365 Group (no Team) | Yes | Unified groups that are not Teams |
Dual-link rule
A Graph object may be linked once per connection. In particular, the same GUID must not be both a Group and a Team. Team-backed groups must be linked as Microsoft Team.
Lifecycle
| Op | Team | Private channel | SharePoint | M365 Group |
|---|---|---|---|---|
| Attach | Yes | Yes | Yes | Yes |
| Create managed | Yes | No | No | Yes |
| Rename | Managed only | Managed only | No | Managed only |
| Archive | Archive team + soft-delete group | Delete channel | No | Soft-delete group |
Exclusive ownership
For each linked resource, Camper should be the only membership writer. Disable overlapping Entra dynamic membership or group-push policies for those objects, or membership will thrash.
Directory SCIM from Entra into Camper is independent and encouraged.
UPN vs mail
Camper matches people by email from SCIM. Entra users may only have a matching UPN. If many members stay in drift, compare Camper emails to Entra mail vs userPrincipalName, and ensure users have mail populated or SCIM maps the right attribute.
Remove connection
Remove connection clears the sealed tenant binding. Linked resources stay in Camper for re-attach. Also revoke Camper’s enterprise app consent in Entra if you are decommissioning the integration.
Not supported
- Entra security groups / mail-enabled security / distribution lists (IdP territory)
- Shared Teams channels
- Exchange mailboxes
- Nested group expansion as members
- National clouds (GCC High, China)