MS Teams – Team – Upgrade Team App

Upgrade an installed app in a Team.

Action details

Property	Value
Action label	MS Teams – Team – Upgrade Team App
Category	CloudTools
Apex class and method	UpgradeMSTeamsTeamApp.upgradeTeamApp
Input type	UpgradeMSTeamsTeamApp.UpgradeMSTeamsTeamAppInput
Output type	List<UpgradeMSTeamsTeamApp.UpgradeMSTeamsTeamAppOutput>
Authorization	Microsoft 365 connector; check endpoint support for delegated and application access.
Microsoft Graph request	POST /teams/{teamId}/installedApps/{appInstallationId}/upgrade

Prerequisites and permissions

Configure a CloudTools Connector with Connector Type set to Microsoft 365. Complete Microsoft sign-in for OAuth Delegated (Authorization Code). For endpoints supporting OAuth Application (Client Credentials), grant application permissions and administrator consent. The identity must have access to the selected resource. See Creating an Entra ID App and Integration Connectors for setup.

The action permission provider declares these alternatives. They are not cumulative requirements, and not all are least privileged. Confirm endpoint restrictions and any resource-specific consent requirements in the Microsoft reference.

Permission type	Declared alternatives
Delegated	TeamsAppInstallation.ReadWriteSelfForTeam, Directory.ReadWrite.All, Group.ReadWrite.All, TeamsAppInstallation.ManageSelectedForTeam, TeamsAppInstallation.ReadWriteAndConsentForTeam, TeamsAppInstallation.ReadWriteAndConsentSelfForTeam, TeamsAppInstallation.ReadWriteForTeam
Application	TeamsAppInstallation.ReadWriteSelfForTeam.All, Directory.ReadWrite.All, Group.ReadWrite.All, TeamsAppInstallation.ManageSelectedForTeam.All, TeamsAppInstallation.ReadWriteAndConsentForTeam.All, TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All, TeamsAppInstallation.ReadWriteForTeam.All

Endpoints: /teams/{teamId}/installedApps/{appInstallationId}/upgrade. Group and Directory permissions are listed for backward compatibility. Self permissions apply only to the calling app. Installing or upgrading apps that require RSC consent needs a consent-capable permission, not a ReadWrite-only permission.

See the Microsoft operation and permissions reference.

Inputs

Input	Apex field	Type	Required	Description
Team Id	teamId	String	Yes	MS Teams team identifier
App Installation Id	appInstallationId	String	Yes	Installed app identifier from team installedApps
Permission Values	permissionValuesCsv	String	No	Optional comma-separated permissionValue entries for consentedPermissionSet.resourceSpecificPermissions
Permission Types	permissionTypesCsv	String	No	Optional comma-separated permissionType entries (Application or Delegated), aligned by position with Permission Values

Supply a nonempty list with a non-null first request. This implementation processes only the first request and does not bulk-process Flow interviews. Global inputs do not expose connectorId; Flow and subscriber Apex use CloudTools connector selection. Use Microsoft Graph IDs, not Salesforce IDs or browser links. Resolve dynamic values before invoking this action.

Outputs

Returns one operation result after the request completes. Inspect its documented fields. Failures throw an exception rather than returning a success=false result.

Output	Apex field	Type	Description
Success	success	Boolean	Whether the team app upgrade request succeeded
Message	message	String	Result message

Behavior and limits

The implementation accepts HTTP status codes from 200 through 399. Success means the request was accepted by this check; it does not prove an asynchronous operation finished.

Teams App Id identifies the app catalog resource; App Installation Id identifies an installation within a team. Retain the correct ID for uninstall or upgrade. Permission Values and Permission Types, when supported, must have matching CSV item counts; types are Application or Delegated.

Use in Flow

Add MS Teams – Team – Upgrade Team App where supported. Use a Microsoft 365 application connector configured as Set as default for Flow automations only if the endpoint supports the required application operation. Delegated connections are not supported for CloudTools Flow automation. Supply required values, retain outputs, and add fault handling.

Use in custom Apex

This subscriber-org example uses the Apptigent namespace. Replace example identifiers and values before use. Configure the connector, arrange authorization first, run in a context permitting callouts, and handle exceptions and empty results.

Apptigent.UpgradeMSTeamsTeamApp.UpgradeMSTeamsTeamAppInput request =
    new Apptigent.UpgradeMSTeamsTeamApp.UpgradeMSTeamsTeamAppInput();
request.teamId = '893075dd-2487-4122-925f-022c42e20265';
request.appInstallationId = 'NjkwM2ZhOTMtNjA1Yi00M2VmLTkyMGUtNzdjNDcyOWY4MjU4IyMwMjQwYTM2OC0yNWUwLTQ1NjktOGViZS0xMzYwMWNiNTVhMTg=';
request.permissionValuesCsv = 'Channel.Create.Group,ChannelMeeting.ReadBasic.Group';
request.permissionTypesCsv = 'Application,Delegated';

List<Apptigent.UpgradeMSTeamsTeamApp.UpgradeMSTeamsTeamAppOutput> results =
    Apptigent.UpgradeMSTeamsTeamApp.upgradeTeamApp(
        new List<Apptigent.UpgradeMSTeamsTeamApp.UpgradeMSTeamsTeamAppInput>{ request }
    );
System.debug(results);

Use in a Lightning Web Component

Use upgradeMSTeamsTeamApp from msTeamsConnectorLib through MSTeamsConnectorController. Set request.connectorId to select a configured connector. These c/ imports apply in the same namespace. The controller uses a shared request DTO; its field names differ from the global invocable input.

Global input	LWC request mapping
teamId	request.teamId
appInstallationId	request.appInstallationId

The shared controller DTO does not expose these global inputs: permissionValuesCsv, permissionTypesCsv. Adding them as arbitrary properties to request does not make them reach the action. Use global Apex/Flow for those inputs where authorization permits.

teamsActionExample.js

import { LightningElement } from 'lwc';
import { upgradeMSTeamsTeamApp } from 'c/msTeamsConnectorLib';

export default class TeamsActionExample extends LightningElement {
    result = null;
    errorMessage = '';
    isRunning = false;
    completed = false;

    async handleRun() {
        if (this.isRunning || this.completed) return;
        this.isRunning = true;
        this.errorMessage = '';
        try {
            const request = { connectorId: 'REPLACE_WITH_CONNECTOR_RECORD_ID' };
            request.teamId = '893075dd-2487-4122-925f-022c42e20265';
            request.appInstallationId = 'NjkwM2ZhOTMtNjA1Yi00M2VmLTkyMGUtNzdjNDcyOWY4MjU4IyMwMjQwYTM2OC0yNWUwLTQ1NjktOGViZS0xMzYwMWNiNTVhMTg=';
            this.result = await upgradeMSTeamsTeamApp(request);
            this.completed = true;
        } catch (error) {
            this.errorMessage = error.requiresInteractiveAuthorization
                ? 'Sign in to Microsoft for the connector, then try again.'
                : error.message || 'The Teams action failed.';
        } finally {
            this.isRunning = false;
        }
    }
}

teamsActionExample.html

<template>
    <lightning-button label="Run action" onclick={handleRun}
        disabled={isRunning}></lightning-button>
    <p role="alert">{errorMessage}</p>
</template>

The library resolves to one mapped object or null. rawJson serializes the mapped Apex model rather than the untouched Microsoft response. Message body, membership roles, and nested properties can be flattened or serialized in JavaScript DTOs.

Use getMSTeamsAuthorizationState, beginMSTeamsAuthorization, and createMSTeamsOAuthMessageHandler to arrange delegated sign-in. The library normalizes errors but does not automatically sign in or retry. Reset completed for a new deliberate operation. Inspect resource state before retrying a mutation with an uncertain outcome.

Error handling and troubleshooting

Symptom	What to check
Required fields error	Supply a nonempty request list, a non-null first request, and required or conditionally required values. For LWC, check controller mappings.
Authorization or access denied	Check selected connector, delegated versus application support, consent, Teams app installation where required, and access to the resource.
Resource not found	Check team, channel, chat, message, membership, and app installation IDs; these are distinct identifiers.
Missing data	Check pagination, query support, empty-response behavior, and documented model mapping.
Operation rejected	Inspect the Microsoft error, endpoint restrictions, supported properties, message authorization limits, and notification configuration.

See Teams connector introduction.