Teams Bot and Chat-to-ERP Access Request Form Template
Before a Teams or WhatsApp bot can answer an ERP question, someone has to approve the app registration, the permissions and the data it can see. This form collects those details in one place so security and data owners can say yes or no quickly.
Fill in
Chat-to-ERP Identity and Access Request Form Template
Access Request
Requester: A. Developer, Integration team Date: 2026-10-20 Bot or app: ERP Approvals Bot Platform: Microsoft Teams Target ERP: SAP S/4HANA Access mode: Read and request approval Hosting: Company Azure tenant, EU region
Data and Objects
Purchase requisitions and purchase orders for company codes 1000 and 2000. No payroll or HR data.
Identity and Authorization
Single sign-on token maps to ERP user. Requests run with that user's authorizations, not a shared technical user.
Logging and Retention
Log user, question, ERP query and response metadata for 12 months in the central log platform.
Permissions Requested
| Permission or role | System | Justification | Approved (Y/N) |
|---|---|---|---|
| Identity provider | |||
| SAP S/4HANA | |||
| Microsoft Teams |
Checks Before Approval
| Check | Evidence | Reviewer |
|---|---|---|
| No shared admin credentials | ||
| ERP roles enforced per user | ||
| Secrets stored in a vault | ||
| Offboarding removes access |
Approvals
A starting point for your internal access process, not legal advice. Use your organization's own permission names and review requirements.
Review my bot access design
Share the completed form and get feedback on identity mapping, permissions and logging.
Optional. The tool and every export work without this. No spam.
How to use the form
The developer fills in the bot name, platform, ERP, access mode and data scope. Be specific about the objects: name the document types, company codes or plants, and state what is excluded. Describe how users are identified. Then route the exported document to the data owner, the ERP administrator and information security. The permissions table is intentionally blank because permission names vary by identity provider and ERP, so list the exact ones requested and justify each.
Identity: the part that matters most
A bot that runs every request under one technical user bypasses the ERP's authorization model, so a junior employee could read what only a director should see. The safer pattern maps the signed-in chat user to an ERP user and runs each request with that user's authorizations, or applies equivalent filtering before returning data. Prefer read-only access first. For write-back, require a human approval step and log what was approved, by whom and when.
- Per-user identity, not a shared account
- Least privilege on app permissions
- Secrets in a vault
- Audit log of questions and queries
- Access removed at offboarding
Common mistakes
Requesting broad tenant-wide permissions when narrower ones would work is the most common. Another is forgetting that chat history itself may contain sensitive data, so retention and export settings in the messaging platform matter. A third is leaving test bots registered after the project ends. Add a review date for the app registration and delete unused ones. Make sure the data owner, not just IT, signs for what the bot may expose.
Frequently Asked Questions
Does this replace our change process?
No. It feeds into it. Attach the exported form to your change or access ticket so approvers see the same details in a consistent layout.
Why avoid a shared technical user?
Because ERP authorization objects, roles and org-level restrictions are tied to the individual. A shared account gives everyone the same access, and your audit trail loses the real requester.
Is read-only access safe enough?
It reduces risk a lot, but data exposure remains. Apply role checks, mask sensitive fields, and log queries. Treat read access to costs or HR data as sensitive.
Can I use it for WhatsApp bots?
Yes. Choose the WhatsApp platform and add details on phone number mapping, consent and message retention in the data scope and logging fields.
Netray builds read-only, role-aware ERP agents that respect your authorization model and can run on your own infrastructure. We can review a completed form with you.
Related Tools
Messaging Integration Risk Register Worksheet
A scored risk register pre-filled with typical WhatsApp, Teams and ERP chat integration risks. Edit, score and export to Excel.
ERP OperationsMessaging Integration Project Charter Template
A one-page charter for projects that push ERP events to WhatsApp or Microsoft Teams, or take commands back from chat. Export to PDF or Word.
ERP OperationsMessaging Channel SLA and Escalation Worksheet
Define how fast each alert type must be acknowledged, who is escalated to and which fallback channel is used. Exports to Excel.
Developer ToolsWebhook Event Test Case Worksheet
A test plan grid for messaging webhooks: inbound text, status receipts, duplicates, bad signatures and ERP failures. Exports to Excel.