DATEV and Microsoft Teams integration

What moves between them

The flow runs from DATEV out to Microsoft Teams for review and back to DATEV on approval. When a booking batch, a DXSO booking suggestion, or a document upload is staged, ml-connector posts an adaptive card into the assigned Teams channel with the amounts, accounts, document number, and DATEV client. Approval responses move the other way: a Graph change notification fires when the reviewer replies, and once an approval is recorded ml-connector submits the EXTF CSV or DXSO XML job to DATEV and posts the job result back into the same thread. Because DATEV cannot push and Teams subscriptions are short-lived, both directions are checked on a schedule as well, so nothing is missed if a notification is delayed.

How ml-connector handles it

ml-connector stores both credential sets encrypted and runs two different OAuth models side by side. DATEV uses interactive Authorization Code with PKCE, so the tax advisor consents once and the connector refreshes the 900-second access token using only the client_id, never the client_secret. Microsoft Teams uses app-only client credentials, so the connector requests a Graph token with the .default scope after an admin has consented to the Teams permissions. Each DATEV client id, fetched from accounting:clients, is mapped to a Teams team and channel so approvals land in the right place. Outbound, booking and document details render as an adaptive card posted with ChannelMessage.Send; inbound, a Graph subscription on the channel messages reports replies, and ml-connector checks clientState on every notification, answers the validation handshake within ten seconds, and renews the subscription before its three-day limit. Approved bookings are submitted as EXTF or DXSO jobs and polled with exponential backoff and jitter, since DATEV publishes no processing time and offers no webhook. Graph throttling returns HTTP 429 with a Retry-After header that the connector honors, EXTF filenames are kept deterministic so a retry is not rejected as a duplicate, and every event and approval carries a full audit trail and can be replayed if a DATEV submission or a Teams post fails. A real edge case: DATEV cannot read posted journals back, so the Teams thread, not DATEV, is the record that a booking was reviewed and released.

A real-world example

A German tax advisory firm with about forty staff books month-end entries for several dozen SMB clients in DATEV. Before the integration, a junior accountant prepared booking batches and then emailed or printed them for a senior to sign off, and the senior often approved from a phone, which meant delays and the occasional batch posted to the wrong client. With DATEV and Microsoft Teams connected, each prepared batch posts as an adaptive card into that client's Teams channel showing the accounts, amounts, and document numbers, the senior approves or rejects in the channel, and only approved batches are submitted to DATEV as EXTF jobs and polled to completion. Review now happens where the team already works, every approval is timestamped in the thread, and nothing posts to DATEV without a recorded sign-off.

What you can do

• •Post DATEV booking batches, DXSO suggestions, and document uploads into a Microsoft Teams channel as adaptive cards for review.
• •Read approve and reject replies through Microsoft Graph change notifications and gate DATEV submission on them.
• •Submit approved EXTF CSV and DXSO XML jobs to DATEV and poll each job to completion with backoff.
• •Bridge DATEV interactive OAuth with PKCE and the Teams app-only Graph token, mapping each DATEV client to its channel.
• •Keep a full audit trail of every event, approval, and job result, with replay when a DATEV or Teams call fails.

Questions

Which direction does data move between DATEV and Microsoft Teams?

DATEV booking and document events move out to Microsoft Teams as adaptive cards, and approval responses move back from Teams to release the posting. Once a reply is approved, ml-connector submits the EXTF or DXSO job to DATEV and polls it. Microsoft Teams holds no accounting records, so it is used as the review and approval surface, not a data source.

Why does this integration use approvals in Teams instead of posting straight to DATEV?

DATEV bookings are submitted as asynchronous file jobs and finalized entries cannot be read back through the API, so a sign-off before submission matters. Microsoft Teams provides that step where the team already works, and the approval thread becomes the record that a batch was reviewed. ml-connector only submits to DATEV after an approval is recorded, then posts the job result back into the same thread.

How does ml-connector handle the two different logins for DATEV and Microsoft Teams?

DATEV uses interactive Authorization Code with PKCE against login.datev.de, so a tax advisor consents once and the 900-second token is refreshed with the client_id only. Microsoft Teams uses app-only client credentials through Microsoft Entra ID with the .default scope after an Azure AD admin grants consent. ml-connector stores both credential sets encrypted and runs them in parallel for each connected DATEV client.