Microsoft Teams and Copilot

This connection lets people use Meridian in Microsoft Teams or Copilot. It is optional. Meridian works with no Microsoft tenant connected, and Meridian sign-in does not use this link.

Spending alerts in a Teams channel are a different card. That one is Settings → Notifications → Microsoft Teams, and it is covered in Send Meridian alerts to Microsoft Teams.

Who needs it

Connect a tenant when people in that Microsoft tenant should open Meridian from Teams or Copilot.

Leave it unconnected when Meridian is used only in the browser. The page says "This connection is optional. It is only needed to use Meridian in Microsoft Teams or Copilot." and "Meridian sign-in is unchanged."

On the setup checklist, this step appears only after the identity provider is saved as Entra. It is optional. See Meridian setup checklist.

Open the page

In Settings, open the card Microsoft Teams & Copilot. The card says "Optional. Only needed to use Meridian in Teams or Copilot. Meridian sign-in is unchanged." Choose Configure.

The page title is Microsoft Teams & Copilot. ← Back to settings returns to Settings.

Until a tenant is connected, the page says "No Microsoft tenant is connected. Meridian works without one." While the page is loading it says "Loading this connection…".

Connect a tenant

An organization owner or an admin chooses Connect a Microsoft tenant. The line under the button says "Sign in as a Microsoft tenant administrator for the tenant you want to connect."

Microsoft asks which account to use. Sign in as a tenant administrator for the tenant you mean to connect. The roles that can approve the connection are Global Administrator, Privileged Role Administrator, Application Administrator, and Cloud Application Administrator.

After Microsoft sends you back, the page asks Connect this Microsoft tenant? It shows the tenant name and primary domain, or the sentence "Microsoft did not return a name for this tenant." The tenant id is on the next line. The page also says "Teams questions from this Microsoft tenant will use this Meridian organization. Cancel if this is not the tenant you meant to connect."

Connect this tenant saves the link. Cancel drops it. Choose a different Microsoft account starts the Microsoft sign-in again. While either action is running, the button says Connecting….

When the tenant is connected, the page says Connected Microsoft tenant, then the name and domain, then the tenant id.

If the tenant is connected and Microsoft did not return a name, an owner or an admin sees "A person who is not an administrator will not recognize this id. Read the tenant name from Microsoft so the name is what they see." Read the tenant name signs in to Microsoft again and stores the name. While that runs, the button says Reading the tenant name….

Someone who is not an owner or an admin sees "Only an organization owner or admin can connect a Microsoft tenant." and has no connect button.

If Microsoft sign-in is not set up for this site, the page says "Microsoft sign-in is not configured for this environment."

Assignment and Allow everyone

After a tenant is connected, the page shows Allow everyone in our tenant. It is off until an organization owner turns it on. The line under the checkbox says "Off by default. When on, people in this Microsoft tenant can use the Teams agent as members. Meridian sign-in is unchanged."

With the checkbox off, a person from that tenant can use the Teams agent in two cases:

They have a pending invitation to this Meridian organization.
A Microsoft administrator has assigned them directly to the Meridian Auth app.

Anyone else from that tenant is refused. Meridian replies "Ask your admin to invite you to Meridian."

With the checkbox on, people in the connected Microsoft tenant can use the Teams agent as members. A person who gets in this way is a member. Spend questions still follow the role rule in the next section.

Only an organization owner can change the checkbox. Anyone else sees "Only an organization owner can change who may sign in from this tenant." and the checkbox stays as it is.

Roles

Action	Who can do it
Connect a Microsoft tenant, or read the tenant name	An organization owner or an admin, signing in to Microsoft as a tenant administrator
Turn Allow everyone in our tenant on or off	An organization owner
Disconnect this tenant	An organization owner
Use the Teams agent while the checkbox is off	A person with a pending Meridian invitation, or a person assigned directly to the Meridian Auth app
Use the Teams agent while the checkbox is on	A person in the connected Microsoft tenant
Ask spend questions in Teams or Copilot	An organization owner, an admin, or a person with finance rights

Reply messages

These are the sentences the page shows, and the sentences Meridian sends back in Teams or Copilot.

On the connection page

Message	What it means
This Microsoft tenant is already connected to another Meridian organization.	The Microsoft tenant you signed in with is already linked somewhere else.
This organization is already connected to a Microsoft tenant.	This Meridian organization already has a tenant. Disconnect that one before connecting a different tenant.
A Microsoft tenant administrator has to approve this connection. Sign in as a Global Administrator, Privileged Role Administrator, Application Administrator, or Cloud Application Administrator.	The Microsoft account you used is not one of those tenant administrator roles.
Only an organization owner or admin can connect a Microsoft tenant.	Your Meridian role cannot connect a tenant.
Only an organization owner can disconnect a Microsoft tenant.	Your Meridian role cannot disconnect the tenant.
Only an organization owner can change who may sign in from this tenant.	Your Meridian role cannot change Allow everyone in our tenant.
Type the confirmation exactly. Teams users from that tenant lose access.	The disconnect box does not match the confirmation sentence.
Microsoft did not return a tenant for this sign-in.	Microsoft signed you in and did not include a tenant id.
Microsoft did not return a name for this tenant.	The tenant id is known, and Microsoft did not return a display name or domain.
Meridian could not be reached. Try again.	The page could not reach Meridian.
That request did not complete. Try again.	Meridian refused the request and did not return one of the sentences above.
Microsoft sign-in was cancelled.	The Microsoft sign-in was cancelled or access was denied.
Microsoft sign-in is already in progress.	A Microsoft sign-in is already open. Finish or close it, then start again from this page.
Microsoft did not return a sign-in token.	Microsoft completed the redirect and did not return a sign-in token.
Microsoft sign-in did not complete.	Microsoft rejected the sign-in and the page has no more specific sentence for that error.

When Microsoft returns an error number, the page adds "Microsoft error" and that number. These are the sentences for the numbers the page recognizes:

Message	What it means
Microsoft rejected the sign-in. In the Entra app registration, list the site origin under Single-page application redirect URIs.	Microsoft error 9002326 or 7000218. The sign-in redirect was rejected.
Microsoft rejected the browser sign-in. Start the connection again from this page.	Microsoft error 9002327.
Microsoft did not receive the sign-in proof for this page. Start the connection again from this page, in the same window.	Microsoft error 9002325.
Microsoft could not match this sign-in to the page that started it. Start the connection again from this page, in the same window.	Microsoft error 501481. Start again in the same window.
That Microsoft sign-in was already used. Start the connection again.	Microsoft error 54005.
Update the Entra redirect URI so it is exactly the site origin.	Microsoft error 50011. The redirect address did not match.
This Microsoft app only allows one directory. In Entra, set supported account types to accounts in any organizational directory, then start the connection again.	Microsoft error 50194.
Microsoft rejected the sign-in response. Start the connection again.	Microsoft error 9002313.

If Microsoft includes a short description and a number the page does not list, the page shows that description and "Microsoft error" plus the number. If it includes only a number, the page says "Microsoft sign-in did not complete. Microsoft error" and the number.

In Teams or Copilot

Message	What it means
Ask your admin to invite you to Meridian.	Allow everyone in our tenant is off, and this person has no pending invitation and no direct assignment to the Meridian Auth app. The same sentence is used when that person's email is already a Meridian account.
Ask your admin for access to these spend questions.	The person can open the Teams agent, and they are not an owner, an admin, or someone with finance rights.
This Entra tenant is not linked to an organization.	No Microsoft tenant is connected to a Meridian organization for this sign-in.
This Entra user is already linked to a Meridian account.	This Microsoft user is already linked to a different Meridian account.
Rate limit exceeded	This person has asked more than 30 questions in the current minute.

Disconnect

The section is titled Disconnect this tenant. The page says "Disconnecting removes the tenant link and its user links. Teams users from that tenant lose access. Connect can be offered again after that."

An organization owner types this sentence exactly:

Teams users from that tenant lose access

The box is labeled "Type this to confirm:" followed by that sentence. Disconnect this tenant stays unavailable until the box matches. While the disconnect is running, the button says Disconnecting….

Disconnecting removes the tenant link and the user links for that tenant. People from that tenant lose Teams and Copilot access. The page returns to "No Microsoft tenant is connected. Meridian works without one." An owner or an admin can connect a tenant again after that.

Someone who is not an organization owner sees "Only an organization owner can disconnect a Microsoft tenant." and does not get the confirmation box.