Foundry Agent published to Teams via Group chat

Hello Nimesh,

What you are seeing is expected behavior when an Azure AI Foundry agent is published to Microsoft Teams and uses external tools such as Azure AI Search through Foundry Knowledge.

Each time the agent invokes the knowledge_base_retrieve tool, Teams displays a Tool Approval Request card to ensure that users explicitly consent to the agent accessing external data on their behalf. This is a built-in security and compliance feature designed to provide transparency and user control over tool execution.

Why You See Repeated Approval Prompts

• Your agent is invoking an external tool (Azure AI Search knowledge retrieval).
• In Microsoft Teams, external tool calls require user consent.
• When the app is side-loaded or used in a Teams chat, this approval is enforced at runtime.

In group chat scenarios, approval prompts are commonly displayed for tool usage to ensure all participants are aware of the agent's access to external resources.

Is This the Default Behavior?

Yes, this is currently the expected behavior for Foundry agents using tools in Teams, particularly when the app has been side-loaded rather than fully published.

Can Approval Be Granted Only Once?

At present, there is no setting that allows approval to persist across all future group chat threads for side-loaded apps.

However, the exact behavior depends on the permission mode configured when the agent was created.

Reader Mode

• Every elevated action or tool call requires approval.
• Users may see approval prompts repeatedly during the conversation.

Privileged Mode

• Approval is requested once at the start of a conversation thread.
• Subsequent tool calls within the same thread typically do not require additional approval.
• A new conversation thread will trigger a new approval request.

The permission mode cannot be changed after the agent is created. If your current agent was created in Reader mode, you would need to redeploy it in Privileged mode to benefit from reduced prompting.

How to Eliminate Repeated Approval Prompts

The most effective way to avoid recurring approval prompts is to formally publish the Teams app:

• Publish the app to your organization's Teams app catalog via the Microsoft 365 Admin Center, or
• Publish it to the Microsoft Teams Store

Once published, a Teams administrator can grant tenant-wide consent and pre-approve the required permissions. This allows end users to interact with the agent without receiving approval prompts for each tool invocation.

Recommended Options

You have two primary options:

Redeploy the agent in Privileged mode

• Reduces prompts to one approval per conversation thread.

Publish the Teams app to your organization’s app catalog or the Teams Store

• Allows tenant administrators to pre-approve permissions.
• Provides the smoothest end-user experience by eliminating repeated approval prompts.

Please refer this

Chat feature & permission levels (Reader vs Privileged mode): https://learn.microsoft.com/azure/sre-agent/usage#chat-with-your-agent

Publish agents to Microsoft 365 and Teams (org catalog or Store publishing): https://learn.microsoft.com/azure/foundry/agents/how-to/publish-copilot#publish-to-microsoft-365-and-teams

I Hope this helps. Do let me know if you have any further queries.

If this answers your query, please do click Accept Answer and Yes for was this answer helpful.

Thank you!