# Slack and Microsoft Teams

HollyHR collaboration apps bring approved notifications and bounded workflows
into Slack and Microsoft Teams. They do not create a second HR permission
model: HollyHR resolves the current tenant membership and capability before any
person-level result or action.

## Connect an organisation

1. Sign in as a HollyHR administrator who can manage integrations.
2. Open **Settings → Integrations → Connected apps**.
3. Choose **Connect Slack** or **Connect Teams**.
4. Complete the provider consent flow and return to HollyHR.
5. Confirm the card names the installation, its granted permissions and the
   last authenticated activity.

Installation and disconnection require fresh HollyHR two-step verification.
Provider tenant IDs never select a HollyHR organisation and do not grant
person-level authority.

## Slack permissions

The Slack app requests only:

- `chat:write` to post approved HollyHR messages;
- `channels:read` and `groups:read` to resolve approved public and private
  destinations;
- `app_uninstalled` and `tokens_revoked` events to close or repair the stored
  installation safely.

Token rotation is enabled. HollyHR stores provider credentials encrypted,
refreshes them through a bounded operation lease and revokes Slack credentials
before scrubbing the local installation.

## Microsoft Teams permissions

The Teams bot supports personal, team and group-chat surfaces. Its manifest
requests only identity permission and no broad Microsoft Graph scopes. A
separate multitenant connection registration binds the consenting Microsoft
tenant to the selected HollyHR organisation; the bot identity itself remains
single-tenant.

## Health and troubleshooting

The Connected apps card reports one of these mechanically derived states:

- **Connected** — an active tenant-bound installation exists;
- **Needs attention** — health is degraded or re-authorisation is required;
- **Available** — no active installation exists;
- **Unavailable** — HollyHR's provider configuration is not ready.

If delivery stops, reconnect only from the affected organisation. Disconnecting
Slack revokes the provider credential before local removal; Teams has no
customer credential and is disconnected locally. Both operations retain a
content-free HollyHR audit event.

For help that requires provider logs, use [developer support](/support). Never
send access tokens, employee records or message payloads in a support request.