Microsoft Teams integration

With the "Lanes & Planes" app for Microsoft Teams, managers can approve or decline travel requests directly in Microsoft Teams, without switching to the SaaS application of Lanes & Planes GmbH ("SaaS application").

Using the "Lanes & Planes" app in your Microsoft 365 tenant is an additional channel and does not replace the email notifications from the SaaS application. These continue to be sent to the responsible people as before.

Before activating the integration, please read the sections Terms of use, Legal notices and Before activating.

Terms of use

These terms govern the use of the "Lanes & Planes" app of Lanes & Planes GmbH to connect your organisation's Microsoft 365 tenant. The General Terms and Conditions of Lanes & Planes GmbH, including the data processing terms, apply in addition.

Use of the integration is optional and requires a paid company account in the SaaS application.

By ticking the two checkboxes in the SaaS application, you declare on behalf of your organisation:

• that Lanes & Planes GmbH may transmit the data listed under What data is transferred and to whom, including the personal data it contains, of all users of your organisation via Microsoft Teams to the respective recipients, for the purpose of review and processing.
• that your organisation has authorised you to set up the integration on its behalf, and that its use has been approved internally.

You may withdraw this declaration at any time, without giving reasons and with effect for the future, by disconnecting the integration (see Disconnecting). The lawfulness of transmissions made up to that point remains unaffected.

Responsibilities are as set out under Legal notices.

What you can do in Microsoft Teams

When a person submits a travel request in the SaaS application, the manager stored in the travelling person's travel policy receives a message in the chat with the "Lanes & Planes" app in Microsoft Teams. There, the manager can approve the request directly, optionally with a percentage buffer on the requested amount, or decline it with a reason.

Requirements

• Your organisation must be enabled for the integration. Once enabled, the Microsoft Teams section appears under Settings & Policies.
• The connection must be activated by an administrator of your organisation with access to Settings & Policies.
• In addition, an administrator of your Microsoft 365 tenant must install the "Lanes & Planes" app in your Microsoft 365 tenant and consent to the required permissions. This requires the Global Administrator or Privileged Role Administrator role.

Connecting Microsoft Teams

Two people are involved in the setup. This can also be the same person:

• an administrator of your organisation in the SaaS application with access to Settings & Policies.
• an administrator of your Microsoft 365 tenant. Consent requires the Global Administrator or Privileged Role Administrator role. Allowing the app can also be done by a Teams Administrator.

The Microsoft administrator does not need access to the SaaS application.

In the SaaS application (Lanes & Planes administrator)

1. Open Settings & Policies > Microsoft Teams.
2. Read this product description and the notes, then tick both checkboxes.
3. Click Create link. Copy the link with Copy link and send it to your Microsoft administrator. The link is valid for 7 days. Use Cancel link to invalidate it earlier. If you hold one of the two Microsoft roles yourself, you can open the link directly with Open it myself.

At Microsoft (Microsoft administrator)

4. Allow the "Lanes & Planes" app for your organisation in the Microsoft Teams admin center at https://admin.teams.microsoft.com/policies/manage-apps. A Global Administrator or a Teams Administrator can do this.
5. Open the link you received from the Lanes & Planes administrator and sign in with your Microsoft 365 account. You will then see which organisation in the SaaS application you are about to connect Microsoft Teams to. If this is correct, click Continue to Microsoft and confirm the requested permissions. If it is not your organisation, close the page; nothing will be connected.
6. Finally, you will see a confirmation. Let the Lanes & Planes administrator know that the connection has been made.

Steps 4 and 5 can be done in any order. Both must be completed before step 8.

Back in the SaaS application (Lanes & Planes administrator)

7. The Microsoft Teams page now shows the name of your Microsoft 365 tenant. Check that it is the right one.
8. In the Test message recipient field, enter the email address of a person in your Microsoft 365 tenant and click Send test message.
9. Once Microsoft Teams has accepted the test message, the connection is active. The page shows the connected Microsoft 365 tenant, the person who set up the connection, and the date. If the message cannot be delivered, the SaaS application shows the reason.

Matching via the email address

Who receives which message is determined by the email address: Lanes & Planes matches a person to their account in the Microsoft 365 tenant based on their email. For this to work reliably:

• A person's email address must be identical in the SaaS application and in the Microsoft 365 tenant.
• The email address must not be used by another person in the Microsoft 365 tenant, as actions could otherwise not be attributed unambiguously.
• If no matching address is found, no message can be delivered via Microsoft Teams. The notification is still sent by email as usual.

What data is transferred and to whom

What the manager receives in the "Lanes & Planes" app in Microsoft Teams

For a travel request, the following data is sent to the responsible manager(s):

• Names of the travellers (first and last name)
• Travel period and destination
• Services (e.g. flight, hotel, train, bus, rental car)
• Original price
• Rules of the travel policy that the trip violates (if any)
• If provided: reason for the request (free text, written by the requesting person)
• "Requested by" with first and last name, if the requesting person is not the travelling person
• "Approve up to" selection: here the manager sets the maximum amount up to which the trip may be booked. The options are the original price or a surcharge of 5%, 10%, 15%, 20% or 25%. The default is 10%.
• Link to the detail view in the SaaS application

What data Lanes & Planes also transmits for delivery to Microsoft

To make sure the message reaches the right person, Lanes & Planes and Microsoft additionally exchange the following data:

• During setup, Microsoft transmits the ID of your Microsoft 365 tenant to Lanes & Planes. Lanes & Planes stores it and includes it in every request to Microsoft.
• With the first message to a manager, Lanes & Planes transmits the manager's email address to Microsoft. Microsoft responds with the manager's Microsoft ID. Lanes & Planes stores it and uses it for all further messages to this manager.

The Microsoft ID is a fixed identification number assigned by Microsoft, not the email address.

What is transferred back from the Microsoft 365 tenant to Lanes & Planes

When the manager clicks Approve or Decline (with reason), Microsoft Teams transmits to Lanes & Planes:

• the decision
• for an approval, the amount selected under "Approve up to"
• for a decline, the reason (optional free text)
• the Microsoft ID of the person who decided. This ensures that only the person to whom the message was addressed can decide. The ID is stored together with the decision.

The message in Microsoft Teams is then updated. It shows the outcome and the first and last name of the deciding person, for an approval also the approved amount and the time, and for a decline the reason.

Which permissions Lanes & Planes receives in your Microsoft 365 tenant

The integration uses four application permissions. Your Global Administrator or Privileged Role Administrator grants them once during setup. The app uses these permissions itself, without anyone having to sign in. They therefore apply to your entire Microsoft 365 tenant. We use only a small part of each:

• User.Read.All
  What the permission allows: reading the user profiles in your Microsoft 365 tenant, e.g. name, email address, job title or department.
  What we use: when a manager is to receive a message, we search the Microsoft 365 tenant specifically for their email address. We only retrieve three details: their Microsoft ID, whether their account is active, and whether it is a guest account. We do not read user lists and do not retrieve any other profile data.
• TeamsAppInstallation.ReadWriteSelfForUser.All
  What the permission allows: adding and removing the "Lanes & Planes" app for individual people. The permission applies only to our own app, not to other apps in your Microsoft 365 tenant.
  What we use: when a manager receives a message for the first time, we add the app for them. This creates the chat in which the message arrives.
• AppCatalog.Read.All
  What the permission allows: reading your organisation's app catalog.
  What we use: we look up the "Lanes & Planes" app there once, so that we can add it for managers.
• Organization.Read.All
  What the permission allows: reading the basic details of your Microsoft 365 tenant.
  What we use: only the name and ID of your Microsoft 365 tenant. We use them to check whether the connection is still active and to show in the SaaS application which tenant you are connected to.

The messages themselves are not sent through these permissions, but through Microsoft's bot service (Microsoft Azure AI Bot Service, see Legal notices).

What Lanes & Planes has no permissions for

The "Lanes & Planes" app has no access to:

• channels, chats or messages in your Microsoft 365 tenant
• mailboxes, files or calendars
• other apps in your Microsoft 365 tenant

The app only sends messages in the personal chat with the respective manager, not in channels or group chats.

Legal notices

• On activation, Lanes & Planes GmbH additionally sends notifications of all users of your organisation from the SaaS application via Microsoft Teams to the respective recipients in your organisation.
• Depending on the type of notification, various personal data is transmitted, such as first and last name, date of birth, Microsoft ID, a person's home address, or health data voluntarily provided by a user such as food intolerances, allergies or accessibility needs.
• Please note that the provider of the Microsoft 365 tenant operated by your organisation is a recipient of the notifications and processes the information they contain to the extent agreed with your organisation.
• For the technical transmission between the SaaS application and Microsoft Teams, in both directions, we use the Microsoft Azure AI Bot Service of Microsoft Ireland Operations Limited, Ireland, as a sub-processor; the service solely relays and transmits the notifications and the responses to them, processes them in the European Union for this purpose, and stores their content only temporarily for less than 24 hours. No content analysis or training of artificial intelligence models takes place. Further information can be found in section 4.9 of our privacy policy and in section 5 of the annex to the data processing agreement.
• Your Microsoft 365 tenant is under the control of your organisation, i.e. its administrators may, depending on the configuration, access messages processed there.
• Your organisation alone, not Lanes & Planes GmbH, is responsible for the processing in Microsoft Teams.
• The data protection assessment of using Microsoft Teams lies with your organisation, not with Lanes & Planes GmbH.
• Your organisation is responsible for managing and deleting the messages delivered in Microsoft Teams.
• Of course, all functions of the SaaS application remain available to you unchanged even without activating the Microsoft Teams integration.

Data protection information

• Roles: 
  For the data processed in the SaaS application, the customer is the controller and Lanes & Planes is the processor. For the transmission between the SaaS application and Microsoft Teams, Lanes & Planes uses the Microsoft Azure AI Bot Service of Microsoft Ireland Operations Limited as a sub-processor; the service is listed in the "Sub-processors" annex to the data processing agreement. Once a notification has been delivered in Microsoft Teams, it resides in the customer's Microsoft 365 tenant and is therefore the customer's sole responsibility.
• Data transmitted: 
  The recipient's email address (to find their Microsoft 365 account), the Microsoft IDs of the recipient and of the customer's Microsoft 365 tenant, and the content of the notification are transmitted. Which data a notification contains and what is sent back to Lanes & Planes is listed under What data is transferred and to whom.
• Purpose of processing: 
  The Azure AI Bot Service transmits the messages solely between the SaaS application and the customer's Microsoft Teams. No content analysis of the messages and no training of artificial intelligence models takes place.
• Place of processing: 
  Lanes & Planes uses a European instance of the service. Processing takes place in the European Union. Access by Microsoft entities in third countries for maintenance and support purposes cannot be ruled out and is safeguarded by the European Commission's Standard Contractual Clauses.
• Retention period: 
  Message content is stored in the Azure AI Bot Service only temporarily, for less than 24 hours. The retention period of delivered messages in the customer's Microsoft 365 tenant is governed by the customer's retention policies. At Lanes & Planes, the connection data (ID and name of the Microsoft 365 tenant) and the Microsoft IDs of the recipients are stored for as long as the connection exists and deleted when it is disconnected. If a person has decided on a travel request via Microsoft Teams, their Microsoft ID remains stored with the travel request as evidence of this decision. We also keep a record of who submitted the declarations for the Microsoft Teams integration and when, and when the connection was disconnected.
• Notes for the customer's administrators: 
  Before activating the integration, the customer should check whether its retention policies for Microsoft Teams are appropriate for the delivered notifications, whether the processing needs to be added to its record of processing activities, and whether employees need to be informed about it. The integration is set up only at the customer's request and can be deactivated at any time.

Before activating

• Please check within your organisation whether any data protection, works council/co-determination or other legal obstacles preclude a Microsoft Teams integration, given that the integration transmits personal and other data to another IT system.
• Please obtain explicit approval from the responsible persons in your organisation confirming that you may carry out the activation in the name and on behalf of your organisation.
• Clarify in advance who holds the Global Administrator or Privileged Role Administrator role in your Microsoft 365 tenant and when this person is available for the connection process.

Disconnecting

You can end the integration at any time without giving reasons:
Settings & Policies > Microsoft Teams > Disconnect

After that, no further messages are sent to Microsoft Teams; all notifications are sent exclusively by email again. Messages already delivered in Microsoft Teams are not deleted by this.

The consent once granted for the "Lanes & Planes" app in your Microsoft 365 tenant is managed by your organisation itself. If you also want to remove it, a Global Administrator must delete the "Lanes & Planes" app in the Microsoft Entra admin center under Enterprise applications. This is not required to stop messages being sent.

Frequently asked questions

Who receives notifications in Microsoft Teams?
Only people whose email address is identical in Lanes & Planes and in Microsoft 365. Everyone else continues to receive the notification by email only.

Will I receive notifications twice?
Yes. Email remains the primary channel for notifications; the notification via Microsoft Teams comes in addition.

Can I turn off the messages in Microsoft Teams just for myself?
No. The integration can only be set up for the whole organisation. It is ended by your organisation disconnecting it under Settings & Policies > Microsoft Teams > Disconnect.

Who can set up or remove the connection?
Setting up: an administrator in the SaaS application with access to Settings & Policies, together with a Global Administrator or Privileged Role Administrator of your Microsoft 365 tenant who grants the consent. A Teams Administrator can also allow the app.
Removing: an administrator in the SaaS application with access to Settings & Policies.

Does our Microsoft administrator need access to the SaaS application?
No. Your Lanes & Planes administrator creates a link in the SaaS application and sends it to your Microsoft administrator. They open the link on their own computer, only sign in to Microsoft, and grant the consent there. The link is valid for 7 days. See Connecting Microsoft Teams for details.

Does anything change about the approval or booking process?
No. Only the channel through which the notification is delivered changes. The approval process and its outcome stay the same.

Does the Microsoft Teams integration also apply to post-trip approvals?
No. Currently, only the approval of travel requests before the trip is supported in Microsoft Teams. You continue to handle post-trip approvals in the SaaS application as usual.

What happens to messages already delivered in Microsoft Teams if we disconnect?
They remain in Microsoft Teams and are managed by your organisation. Open travel requests can no longer be approved or declined there; please use the SaaS application instead.