An internal phone book sounds simple. In practice, it needs to be available where staff already work: Microsoft Teams.
A tailored web application was therefore developed as a Teams tab for Maurus Schifferli's firm.
Technical review date: 8 September 2026. The SSO description follows Microsoft's Teams tab SSO documentation. Statements about Replit are qualified using its documentation on project geography and the shared responsibility model.
Starting point and functions
The firm manages employees, partners, and project contributors with contact details, roles, teams, and project relationships. The app allows users to search and filter contacts, open Teams actions where supported by the client and policy, assign projects, and export all or filtered records to a BOM-encoded CSV file.
Daily and manual exports can be stored in SharePoint and an available export can be used for restoration. A backup reduces risk but cannot guarantee “no data loss”. Retention, encryption, access, restore testing, and deletion need a documented operating procedure.
The app is embedded as a Teams tab. Feature behaviour must be tested in the supported desktop, browser, and mobile clients rather than promised for every platform without qualification.
Teams SSO is not the whole access-control model
With Teams SSO, the tab requests a Microsoft Entra access token through the Teams JavaScript SDK. The backend must validate its signature, issuer, audience, expiry, and required permissions, then perform its own role-based authorisation for each operation.
A valid token does not make an application inaccessible from outside Teams by itself. Exposure also depends on publishing, network, and application configuration. Separate user passwords may be unnecessary, but identity lifecycle and application permissions still need active administration.
Development and operation
The application uses React/Vite, Express with Drizzle ORM, and PostgreSQL. Replit was used as the development environment. The production host and data location are separate architecture choices.
Replit documents an EU project geography for published applications, but not a Swiss region. Workspace geography and publishing geography are separate. Under Replit's shared responsibility model, the operator remains responsible for application logic, permissions, privacy notices, dependencies, monitoring, and app-specific testing.
What the project demonstrates
An embedded app can reduce searching and context switches. “Production-ready” is not a property of the development tool alone; it requires verified authentication and authorisation, privacy controls, monitoring, tested recovery, and a maintained operating model.