MS Teams – Channels – Verify Channel Member Access

Check whether a user has access to a Team channel.

Action details

Property	Value
Action label	MS Teams – Channels – Verify Channel Member Access
Category	CloudTools
Apex class and method	GetMSTeamsChannelMemberAccess.getChannelMemberAccess
Input type	GetMSTeamsChannelMemberAccess.GetMSTeamsChannelMemberAccessInput
Output type	List<GetMSTeamsChannelMemberAccess.GetMSTeamsChannelMemberAccessOutput>
Authorization	Microsoft 365 connector; check endpoint support for delegated and application access.
Microsoft Graph request	GET /teams/{teamId}/channels/{channelId}/doesUserHaveAccess(userPrincipalName='{userEmail}')

Prerequisites and permissions

Configure a CloudTools Connector with Connector Type set to Microsoft 365. Complete Microsoft sign-in for OAuth Delegated (Authorization Code). For endpoints supporting OAuth Application (Client Credentials), grant application permissions and administrator consent. The identity must have access to the selected resource. See Creating an Entra ID App and Integration Connectors for setup.

The action permission provider declares these alternatives. They are not cumulative requirements, and not all are least privileged. Confirm endpoint restrictions and any resource-specific consent requirements in the Microsoft reference.

Permission type	Declared alternatives
Delegated	ChannelMember.Read.All, ChannelMember.ReadWrite.All
Application	ChannelMember.Read.All, ChannelMember.ReadWrite.All

Endpoints: /teams/{teamId}/channels/{channelId}/doesUserHaveAccess(userPrincipalName='{userEmail}’).

See the Microsoft operation and permissions reference.

Inputs

Input	Apex field	Type	Required	Description
Team Id	teamId	String	Yes	MS Teams team identifier
Channel Id	channelId	String	Yes	MS Teams channel identifier
User Email	userEmail	String	Yes	User email to check (maps to Graph userPrincipalName)

Supply a nonempty list with a non-null first request. This implementation processes only the first request and does not bulk-process Flow interviews. Global inputs do not expose connectorId; Flow and subscriber Apex use CloudTools connector selection. Use Microsoft Graph IDs, not Salesforce IDs or browser links. Resolve dynamic values before invoking this action.

Outputs

Returns one operation result after the request completes. Inspect its documented fields. Failures throw an exception rather than returning a success=false result.

Output	Apex field	Type	Description
Has Access	hasAccess	Boolean	Whether the user has access to the channel

Use in Flow

Add MS Teams – Channels – Verify Channel Member Access where supported. Use a Microsoft 365 application connector configured as Set as default for Flow automations only if the endpoint supports the required application operation. Delegated connections are not supported for CloudTools Flow automation. Supply required values, retain outputs, and add fault handling.

Use in custom Apex

This subscriber-org example uses the Apptigent namespace. Replace example identifiers and values before use. Configure the connector, arrange authorization first, run in a context permitting callouts, and handle exceptions and empty results.

Apptigent.GetMSTeamsChannelMemberAccess.GetMSTeamsChannelMemberAccessInput request =
    new Apptigent.GetMSTeamsChannelMemberAccess.GetMSTeamsChannelMemberAccessInput();
request.teamId = '893075dd-2487-4122-925f-022c42e20265';
request.channelId = '19:private-channel@thread.tacv2';
request.userEmail = 'adele.vance@contoso.com';

List<Apptigent.GetMSTeamsChannelMemberAccess.GetMSTeamsChannelMemberAccessOutput> results =
    Apptigent.GetMSTeamsChannelMemberAccess.getChannelMemberAccess(
        new List<Apptigent.GetMSTeamsChannelMemberAccess.GetMSTeamsChannelMemberAccessInput>{ request }
    );
System.debug(results);

Use in a Lightning Web Component

Use getMSTeamsChannelMemberAccess from msTeamsConnectorLib through MSTeamsConnectorController. Set request.connectorId to select a configured connector. These c/ imports apply in the same namespace. The controller uses a shared request DTO; its field names differ from the global invocable input.

Global input	LWC request mapping
teamId	request.teamId
channelId	request.channelId
userEmail	Separate argument userEmail

teamsActionExample.js

import { LightningElement } from 'lwc';
import { getMSTeamsChannelMemberAccess } from 'c/msTeamsConnectorLib';

export default class TeamsActionExample extends LightningElement {
    result = null;
    errorMessage = '';
    isRunning = false;
    completed = false;

    async handleRun() {
        if (this.isRunning || this.completed) return;
        this.isRunning = true;
        this.errorMessage = '';
        try {
            const request = { connectorId: 'REPLACE_WITH_CONNECTOR_RECORD_ID' };
            request.teamId = '893075dd-2487-4122-925f-022c42e20265';
            request.channelId = '19:private-channel@thread.tacv2';
            this.result = await getMSTeamsChannelMemberAccess(request, 'adele.vance@contoso.com');
            this.completed = true;
        } catch (error) {
            this.errorMessage = error.requiresInteractiveAuthorization
                ? 'Sign in to Microsoft for the connector, then try again.'
                : error.message || 'The Teams action failed.';
        } finally {
            this.isRunning = false;
        }
    }
}

teamsActionExample.html

<template>
    <lightning-button label="Run action" onclick={handleRun}
        disabled={isRunning}></lightning-button>
    <p role="alert">{errorMessage}</p>
</template>

The library resolves to one mapped object or null. rawJson serializes the mapped Apex model rather than the untouched Microsoft response. Message body, membership roles, and nested properties can be flattened or serialized in JavaScript DTOs.

The controller maps hasAccess to the LWC result.success and supplies an access message; success here is the access decision, not merely completion of the lookup.

Use getMSTeamsAuthorizationState, beginMSTeamsAuthorization, and createMSTeamsOAuthMessageHandler to arrange delegated sign-in. The library normalizes errors but does not automatically sign in or retry. Reset completed for a new deliberate operation. Inspect resource state before retrying a mutation with an uncertain outcome.

Error handling and troubleshooting

Symptom	What to check
Required fields error	Supply a nonempty request list, a non-null first request, and required or conditionally required values. For LWC, check controller mappings.
Authorization or access denied	Check selected connector, delegated versus application support, consent, Teams app installation where required, and access to the resource.
Resource not found	Check team, channel, chat, message, membership, and app installation IDs; these are distinct identifiers.
Missing data	Check pagination, query support, empty-response behavior, and documented model mapping.
Operation rejected	Inspect the Microsoft error, endpoint restrictions, supported properties, message authorization limits, and notification configuration.

See Teams connector introduction.