Resolve issue with MS Teams "Post Direct Message" Fails with 500 Error in Action Flows

When running an Action Flow that includes a Post Direct Message step for Microsoft Teams, the step fails with:

{

"http_status_code": 500,

"message": "intent: post_dm failed with response: "

}

The "Post to Channel" step works fine — only Direct Messages are affected.

Root Cause

To send a direct message, the Zendesk MS Teams connector needs to look up the recipient's Microsoft user ID using their email address. It does this by calling the Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/users?$filter=mail eq '{recipient-email}'

This API call requires the User.Read.All application permission with admin consent granted in the customer's Azure AD (Microsoft Entra ID) tenant. Without it, Microsoft returns a 403 Forbidden response, which surfaces as a 500 error in the Action Flow logs.

Deeper logs will show:

h.PostDM()

h.GetUserByEmail()

failed to get user by email: 403 Forbidden

Resolution

Step 1: Grant Admin Consent for the Zendesk MS Teams Connector

Disconnect the existing MS Teams connection in Zendesk Admin Center .

Have a Microsoft 365 Global Administrator open the following URL in their browser to grant admin consent:

https://login.microsoftonline.com/{customer-tenant-id}/adminconsent?client_id=60e3ef2b-554e-4bbc-88f7-88fcb63f6586

{customer-tenant-id} — Replace this with your organization's Azure AD (Microsoft Entra ID) tenant ID. This is the tenant where your MS Teams users exist. To find your tenant ID, see: Find your Microsoft Entra tenant ID

client_id — This value (60e3ef2b-554e-4bbc-88f7-88fcb63f6586) identifies the Zendesk MS Teams IAP Connector app. Do not change this value.

Why your tenant ID? The Zendesk connector is a multi-tenant application registered in Microsoft Entra ID. By using your tenant ID in the URL, you are granting admin consent for this application to access user data within your organization. Each customer organization needs to grant consent separately using their own tenant ID.

A consent pop-up will appear listing the permissions requested. Click Accept to grant admin consent.

Reconnect the MS Teams connection in Zendesk Admin Center.

Re-test the Action Flow.

Step 2: Verify the Permission Was Granted

The customer's Azure AD admin can confirm the grant by checking:

Go to the Microsoft Entra admin center

Navigate to Identity > Applications > Enterprise applications

Search for the Zendesk connector app (client ID: 60e3ef2b-554e-4bbc-88f7-88fcb63f6586)

Under Permissions, confirm that User.Read.All (Application type) shows as granted

For more details, see: Grant tenant-wide admin consent to an application

Known Limitation

The MS Teams connector does not support sending a Direct Message to the same user account that was used to authenticate the connection. Make sure the DM recipient is a different user than the one who set up the Teams connection in Zendesk.

Relevant Microsoft Documentation

Microsoft Graph permissions reference — details on User.Read.All and other permissions

Grant tenant-wide admin consent — how to grant admin consent via the Azure portal or URL

Find your Microsoft Entra tenant ID — locating the tenant ID needed for the consent URL

List users - Microsoft Graph API — the API endpoint that requires User.Read.All

Configure the admin consent workflow — setting up approval workflows for consent requests