A compliance Expiry policy has been setup to look for Teams activity, but when the policy runs I receive the following error:

Local-AAD-App-configuration-is-not-valid-for-checking-channel-activity...

Why do I get this error and how can I resolve the Issue?

 

Cause

An App registration is required to grant additional permissions to collect the Teams activity. This error often means the app registration does not have the required permissions or it has not been linked to ProvisionPoint via the AAD App settings.

 

Resolution

Check the AAD App Settings in ProvisionPoint

1. Go to Admin > Settings > AAD App
2. Check the certificate expiry date
   
3. If this has expired,
   
   1. Click + New Version to create a new certificate
   2. Download the Certificate & upload to the App registration in Entra Admin Centre

Check the App Registration in Azure/Entra

1. If the certificate in ProvisionPoint is still active, check the certificate has been uploaded to the App registration in Entra Admin Centre
2. Check that the App Registration has the appropriate API Permissions
   
   1. For the Teams activity checks you should have the Graph > ChannelMessage.Read.All added with Admin consent granted
      
3. Save the settings
4. Wait 5-10 minutes for the changes to take effect, then replay your failure in the job queue.