MSFT Teams: update onlineMeetings setup documentation

[aperez-worklytics]

Adds the exact PowerShell commands needed to set up the Teams application access policy, fixes a field-name mismatch that was silently dropping these instructions from the generated setup doc, and extracts the msft-teams instructions into a template file for easier maintenance.

Fixes

paste links to issues/tasks in project management

• Field-name mismatch (external_todo vs external_token_todo) in infra/modules/worklytics-connector-specs/msft-365.tf that silently dropped the PowerShell setup instructions from the generated TODO - setup msft-teams.md file during terraform apply

Features

paste links to issues/tasks in project management

• Document the exact New-CsApplicationAccessPolicy / Grant-CsApplicationAccessPolicy PowerShell commands (not just a link to Microsoft's docs) in the msft-teams connector README, so customers can copy-paste them directly
• Extract the msft-teams setup instructions out of an inline heredoc into infra/modules/worklytics-connector-specs/docs/msft-teams/instructions.tftpl, following the same pattern already used for claude/cursor/etc., for easier maintenance

Logistics

paste links to issues/tasks in project management

• Asana task

Change implications

• dependencies added/changed? no
• something important to note in future release notes?
  • The generated TODO - setup msft-teams.md will now include the PowerShell section (previously silently dropped due to the field-name bug) - output content differs, but this is a bug fix, not a breaking change
  • not in a module/example marked alpha, but this is a bug fix restoring intended behavior, not a breaking change

Test plan

• terraform validate passes in infra/modules/worklytics-connector-specs and infra/modules/worklytics-connectors-msft-365
• Verified via terraform console that templatefile(...) on the new .tftpl renders byte-identical content to the old heredoc (including the %%entraid.client_id%% marker, still substituted downstream in worklytics-connectors-msft-365/main.tf)
• terraform apply in a real msft-365 deployment to confirm the generated TODO - setup msft-teams.md now includes the PowerShell section with the real client ID substituted in

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

🟡 Changes recommended

An unresolved critical shared-app indexing issue and two moderate output and regression-test issues remain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds copy-pasteable Microsoft Teams PowerShell setup commands, extracts generated instructions into a Terraform template, and corrects the connector metadata field wiring.

Changes:

• Adds exact application access policy commands to the Teams README.
• Adds reusable Teams setup instructions with client ID substitution.
• Corrects external_token_todo integration.

File summaries

File	Summary	Review findings
infra/modules/worklytics-connector-specs/msft-365.tf	Wires Teams instructions into generated connector todos.	critical (1 vote): Shared-app plans can fail with an invalid module.msft_365_grants index. moderate (1 vote): Add regression coverage for both cmdlets and the client ID marker. moderate (1 vote): Non-file TODO outputs omit the external instructions.
infra/modules/worklytics-connector-specs/docs/msft-teams/instructions.tftpl	Stores generated Teams setup instructions.	No findings.
docs/sources/microsoft-365/msft-teams/README.md	Documents the exact PowerShell commands.	No findings.

Review details

Suppressed comments (2)

infra/modules/worklytics-connector-specs/msft-365.tf:171

• This is the regression-sensitive part of the fix, but the existing Terraform tests do not exercise the Microsoft 365 connector output or the generated Teams instructions. Please add a test that checks available_msft_365_connectors["msft-teams"].external_token_todo contains both cmdlets and the %%entraid.client_id%% marker; otherwise the original external_todo typo could recur while terraform validate and the current tests still pass.

      external_token_todo : templatefile("${path.module}/docs/msft-teams/instructions.tftpl", {})

infra/modules/worklytics-connector-specs/msft-365.tf:171

• When todos_as_local_files = false, this new external instructions value is never included in a returned TODO: worklytics-connectors-msft-365.outputs.todos exposes only module.msft_365_grants[*].todo, while the only concatenation of external_token_todo is the local-file resource gated by that flag. Terraform Cloud/output-based configurations therefore still silently lose the PowerShell setup instructions. Include the external text in the non-file TODO output too, with the same client-ID substitution.

      external_token_todo : templatefile("${path.module}/docs/msft-teams/instructions.tftpl", {})

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aperez-worklytics]

Fixing this, that was broken

[aperez-worklytics]

Adding here the commands needed to run.

[Copilot]

🔵 Needs a closer look

The MSFT todos output path still omits the rendered external Teams instructions.

Review details

Suppressed comments (1)

infra/modules/worklytics-connector-specs/msft-365.tf:171

• This makes the Teams instructions non-null, but they are only consumed by local_file.todo-with-external-todo. When todos_as_local_files is false (the Terraform Cloud/todos_as_outputs flow), worklytics-connectors-msft-365/outputs.tf still returns only values(module.msft_365_grants)[*].todo, so it never includes this PowerShell section (and is empty for shared-app deployments). Include the rendered external instructions, with the client-ID substitution, in the MSFT todos output as well.

      external_token_todo : templatefile("${path.module}/docs/msft-teams/instructions.tftpl", {})

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[aperez-worklytics]

Good catch, not a false positive — fixed in 00a4eba: factored the enriched per-connector todo text (base grant todo + external_token_todo with client-ID substitution) into a single local.msft_365_todos map, and now use it for both the todos output and the local_file.todo-with-external-todo content, so the todos_as_outputs flow (and the shared-app path) get the msft-teams PowerShell instructions too.

[Copilot]

🔵 Needs a closer look

Two moderate issues remain in shared-app TODO file management and next-step calculation.

Review details

Suppressed comments (2)

infra/modules/worklytics-connectors-msft-365/main.tf:154

• In shared-app mode with todos_as_local_files = true, module.msft_365_grant_to_shared[0] already creates and manages this filename through its local_file.todo resource. This second local_file writes enriched content to the same path, so the module resource sees drift on every subsequent plan and Terraform continually tries to restore/rewrite the base TODO. Avoid having two local_file resources manage one filename; move the enrichment into the original resource or disable its file creation when the enriched file is used.

  filename = local.provision_entraid_apps ? module.msft_365_grants[each.key].filename : module.msft_365_grant_to_shared[0].filename
  content  = local.msft_365_todos[each.key]

infra/modules/worklytics-connectors-msft-365/outputs.tf:8

• With msft_connector_app_object_id set and msft-teams enabled, this output now contains the shared grant/Teams TODO, but next_todo_step still derives only from module.msft_365_grants (which is empty in this mode; outputs.tf:13). It therefore remains var.todo_step instead of advancing, and the AWS/GCP root modules use that value for subsequent TODOs, reusing step 1. Include the shared grant's next_todo_step for the shared-app path.

  value       = values(local.msft_365_todos)

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite