Microsoft MS-600 Retired: Permissions Inside Teams

A field service team asks for a Teams application that surfaces customer records during a conversation. The developer can make a tab display the right information, but the harder questions arise immediately: whose identity is used, which permissions are granted, how consent is obtained, and what happens when a user leaves the company?

Microsoft MS-600, Building Applications and Solutions with Microsoft 365 Core Services, retired for general candidates on March 31, 2023. A restricted partner-access period continued through December 31, 2023, but that exception is long past. The Microsoft MS-600 exam page is relevant as a legacy introduction to Teams and Microsoft Graph development, not as an active certification opportunity.

Permission design begins with the user journey

A useful collaboration application must describe what the user wants to accomplish and which service data is necessary. Microsoft Graph can expose many capabilities, but technical reach is not the same as appropriate authorization. Distinguish delegated permissions that reflect a signed-in user from application permissions used by a service. Consent, tenant policy and least privilege should be part of the design before endpoints are chosen.

Sketch a Teams application that displays customer appointments from a shared calendar. Identify who owns the calendar, who may read it, and whether background processing is truly needed. Test a worker with restricted access and a guest account. If the solution requires organization-wide permission merely to show one team’s appointments, revisit its architecture rather than hiding that decision in setup instructions. Before extending Teams, Microsoft MS-700 Teams governance provides the administration perspective on guest access, governance and operational boundaries.

Tokens are not a universal access pass

Applications use authentication and authorization flows in specific contexts. An access token for one audience cannot be assumed valid for every service, and a refresh strategy must respect identity and policy. Developers should protect credentials, handle consent failures and avoid logging secrets. Authentication that succeeds in a local developer environment may behave differently under tenant restrictions or Conditional Access.

Design a token acquisition path for a user opening a Teams tab and invoking an API. Describe how errors appear when consent is unavailable, the session expires or a permission has been revoked. Include how an administrator can inspect granted permissions and remove them. A credible security review covers both successful access and what the application does when access should no longer be possible.

Build integrations for imperfect connectivity

Collaboration apps depend on network calls, changing service limits and external data availability. A robust Microsoft Graph integration should be considerate of throttling, paging and retries. Retrying a write without idempotency can create duplicate records; ignoring a partial result can make a user think information is missing. The interface needs to communicate uncertainty rather than silently present an incomplete response as authoritative.

Simulate an application that retrieves thousands of work items while the service temporarily throttles requests. Explain how it resumes without dropping pages or repeating changes. Cache only where data handling policies permit it, and establish how stale information is identified. Test with both a small demo account and a realistic production-size dataset, because the two often expose different failure modes.

Teams interfaces must fit the working context

A tab, message extension or bot is not interchangeable simply because each runs inside Teams. A tab may suit a sustained workflow; a message extension may help insert a compact result into a discussion; a bot may guide a conversational task. Choose the form factor according to user effort, accessibility, deployment complexity and the sensitivity of the information being exchanged.

Compare the same customer lookup workflow implemented as a tab and as a search-oriented message extension. Evaluate how users discover it, how errors are displayed and whether sensitive results could be forwarded accidentally. Consider mobile use and guest access rather than assuming everyone works on a desktop. An appropriate integration should reduce task friction without creating a new channel for information leakage.

Legacy knowledge needs a current security review

The retired MS-600 curriculum can still teach important design thinking around Microsoft 365 extensibility. However, APIs, app permissions, developer tooling and platform policies continue to evolve. An old tutorial may demonstrate a pattern that requires modification under today’s identity or consent model. Historical exam material should be checked against current Microsoft Graph and Teams developer documentation before being reused in production.

For a legacy MS-600 practice exercise, prepare an application design review showing identity flow, permission inventory, data movement, failure handling and deployment rollback. Then mark which details need revalidation against current vendor guidance. That review makes the archived topics professionally useful without presenting the exam as something a candidate can still schedule.