This article explains how the Absorb Aura app for Microsoft Teams works, what it can access, what it stores and where, and what your IT team needs to approve. It covers v1.6 of the app, which includes the Absorb Learn tab and Nudge Notifications delivered in Teams.
How the App Works
The app relies on several components run by Microsoft and Absorb. This section lists each component, shows how they connect, and describes what happens when a Learner opens the Absorb Learn tab, adds the app, and receives a Nudge Notification.
App Components
The following table lists each component of the app and who runs it:
| Component | What It Does | Run By |
| Microsoft Teams (desktop, web, and mobile) | Hosts the Absorb Learn tab and the Learner's chat with the app. | Microsoft |
| Microsoft Entra ID | Your organization's directory. Issues the Teams sign-in token for Absorb's app after your admin grants consent. | Microsoft, in your organization's tenant |
| Microsoft Bot Service and Bot Connector | Tell Absorb when a Learner adds or removes the app, and deliver Absorb's messages into Teams. | Microsoft |
| Microsoft Graph | Used only to read one Learner's mail address and User Principal Name (UPN) when they add the app. | Microsoft |
| Absorb LMS | Hosts the Learner Experience, the Portal lookup, sign-in, and the Nudge schedule. Runs in your Absorb region (US, Canada, EU, or Australia). | Absorb |
| Absorb notification service | Records which Learners have the app and sends their welcome message and Nudge Notifications. Runs on Amazon Web Services (AWS) in the US East region for all Absorb regions. | Absorb |
Architecture Diagram
The following diagram shows how these components connect when a Learner opens the tab and signs in, adds the app, and receives a Nudge Notification. Microsoft components appear in blue, Absorb LMS components in green, and the Absorb notification service in orange.
Opening the Absorb Learn Tab
Each time a Learner opens the Absorb Learn tab, the following sign-in process runs:
- Teams loads Absorb's entry page from myabsorb.com.
- The entry page sends your organization's Microsoft Tenant ID to Absorb to find your Portal.
- Absorb checks each region in turn (US, Canada, EU, and Australia) until one recognizes the Tenant ID. Absorb responds only if Embed Learning Experience is turned on for your Portal.
- The entry page asks Teams for a sign-in token, which your Microsoft Entra ID issues for Absorb's app.
- Absorb checks that the token is signed with Microsoft's published keys, issued by Microsoft for Absorb's app, and not expired.
- Absorb matches the username or email address in the token to an Absorb account.
- When Absorb finds exactly one match, it starts a normal Absorb session.
Only the Tenant ID is sent during the Portal lookup. The sign-in token is not stored, and no Microsoft Graph call is made.
If automatic sign-in does not find a match, Learners sign in the way your Portal is set up: through a pop-up to your Identity Provider (IdP), or on the Absorb login screen if your Portal does not use Single Sign-On (SSO).
Absorb pages load inside Teams only from an approved list of addresses for your Portal, which is set when Embed Learning Experience is turned on.
Adding the App
The following process runs once for each Learner, when they add the app in Teams:
- Microsoft's Bot Service tells Absorb's notification service that the Learner added the app.
- The notification service checks that your organization has Nudge Notifications turned on.
- The notification service reads the Learner's mail address from Microsoft Graph, or their UPN if the mail address is empty.
- If both checks succeed, the notification service stores the Learner's email address and Teams chat reference details.
- The notification service sends the welcome message.
The welcome message is always sent. A Learner who could not be set up in steps 2 and 3 still receives it, but receives no Nudge Notifications until they remove the app and add it again.
Nudge Notifications
A Nudge is an automated Course reminder that Absorb schedules based on the Course's Nudge settings. The same Nudge is also sent by email. When a Nudge is due, Absorb delivers it in Teams through the following process:
- Absorb sends the Nudge from your Absorb region to the notification service, including the Learner's email address, your Absorb client ID, the reminder text, and the Course.
- The notification service finds the Learner by email address within your organization's tenant.
- The notification service delivers a reminder card through Microsoft's Bot Connector.
- The Learner clicks Open course to open the Course in the Absorb Learn tab.
The notification service does not store the Nudge. For more information about how Nudges are scheduled, see How do Nudge and Notification Settings Work?
What Your IT Team Needs to Approve
Setup involves four one-time steps across three roles. Complete them in the following order:
| Step | Who | What They Do | Where |
| 1 | Microsoft 365 admin (Global Administrator, Application Administrator, or Cloud Application Administrator) | Grants admin consent for Absorb's app. One consent covers both automatic sign-in and Nudge Notifications. | Microsoft Entra admin center. The app's application ID is 491877bb-918e-4666-bc92-935015b34e9e. |
| 2 | Teams administrator | Makes the app available in your organization's Teams app catalog. Assigning the app to specific people or groups controls who can see it. | Teams Admin Center > Teams apps > Manage apps |
| 3 | Absorb System Admin | Enters your organization's Microsoft Tenant ID and turns on Embed Learning Experience. | Admin Experience (AE) > Account > Client Settings > Workplace apps |
| 4 | Absorb System Admin | Turns on Nudge Notifications. | AE > Account > Client Settings > Workplace apps |
Learners who add the app before steps 1 and 4 are complete still receive the welcome message, but do not receive Nudge Notifications until they remove the app and add it again.
Until step 1 is complete, Learners see a Microsoft Need admin approval screen the first time they open the tab. This is expected and clears as soon as consent is granted.
For detailed setup instructions, Portal requirements, and troubleshooting, see Absorb Learner Experience in Microsoft Teams App v1.5.
What the App Can Access
The app uses a limited set of Microsoft data and permissions. The following table describes what the app accesses and how Absorb uses it:
| Access | Details |
| Sign-in | Sign-in uses no Microsoft Graph call. Everything Absorb needs to sign a Learner in is in the Teams sign-in token. |
| Microsoft Graph | Used once per Learner. When a Learner adds the app and your organization has Nudge Notifications turned on, the notification service reads that Learner's mail address (or UPN). This app-only request requires the User.Read.All application permission. That permission allows reading basic profile fields for any user in your organization, but Absorb reads only these two fields, and only for the Learner who added the app. |
| Teams permissions | The app requests two permissions: identity, to confirm who the signed-in user is, and messageTeamMembers, to send the welcome message and reminder cards. |
| Display name | Teams includes it when the Learner adds the app. Absorb does not use or store it. |
Your Microsoft 365 admin sees the full permission list in Microsoft Entra when granting consent. Absorb never accesses mail, files, calendars, profile photos, or Teams messages outside the app.
What Is Stored and Where
Absorb stores a limited set of data in your Absorb region and in the Absorb notification service. The following table lists what is stored in each location:
| Location | Data Stored |
| Absorb LMS, in your Absorb region |
|
| Absorb notification service (AWS US East), for your organization | Your Absorb client ID, Microsoft Tenant ID, Absorb region, and whether Nudge Notifications are turned on. |
| Absorb notification service (AWS US East), for each Learner who adds the app |
|
| Absorb notification service access logs | Requests to the service's web endpoint, including the caller's IP address. |
| Absorb notification service application logs | Records of events such as the app being added or removed and Nudge Notifications being delivered. These include Microsoft user object IDs, Tenant IDs, Absorb client IDs, and Teams conversation IDs. They do not include email addresses or message content. |
| Microsoft Teams | The welcome message and reminder cards, in the Learner's chat with the app. |
Absorb does not store the Teams sign-in token or the Learner's display name.
Data Location
The notification service runs on AWS in the US East region for all Absorb regions. For organizations in the Canada, EU, and Australia regions, the notification service data listed above is stored in the US. All other data stays in your Absorb region.
For more information about the third parties Absorb uses to process data, see Absorb Sub-Processors.
Data Retention
Data in Absorb LMS and in the notification service's records is not deleted on a time-based schedule. The following table describes when each type of data is removed:
| Data | When It Is Removed |
| Tenant ID link and the list of allowed addresses | Kept until they are changed. |
| Learner record in the notification service | Deleted when the Learner removes the app. If the Learner blocks the app, the record is deleted the next time a message to them is rejected. |
| Organization record in the notification service | Marked as turned off when Nudge Notifications is turned off. The organization record and its Learner records are not deleted. |
| Nudge Notifications that could not be delivered | Retried up to three times, then held for up to 14 days. |
| Notification service access logs | Kept for one month. |
| Messages in the Learner's Teams chat with the app | Governed by your organization's Microsoft 365 settings. |
The Sign-In Address Teams Uses
Teams uses one Portal address for your whole organization, chosen before it knows which Learner is signing in. Because of how the Teams sign-in exchange works, that address must have no SSO configuration attached.
Because the address Teams uses has no SSO configured on it, its standard Absorb sign-in page can be reached directly. Anyone who already holds a valid Absorb username and password for your Portal could sign in there, outside your SSO policy. Learners who are signed in automatically never see this page. This applies to any address without SSO, including those most Portals already have, and is not specific to Teams.
Security Controls
The app uses the following controls to protect sign-in, stored data, and communication between components:
- Sign-in tokens are checked against Microsoft's published keys, issuer, audience, and expiry before any session starts.
- Absorb pages display inside Teams only from your Portal's approved list of addresses.
- The Microsoft Graph permission is used app-only, and Absorb reads only the mail address and UPN of one Learner at a time.
- The notification service authenticates to Microsoft's Bot Connector with a certificate, and its secrets are stored in AWS Secrets Manager.
- The notification service's stored records are encrypted at rest and have point-in-time backups.
- All traffic uses HTTPS.
More Information
If you have questions about this article, contact your Absorb Customer Success Manager.
Comments
Article is closed for comments.