It seems that adding new tabs to spaces (websites) does not support Windows authentication prompts. For example, if I add a link to an internal site that uses Integrated Windows Authentication the tab loads fine for users signed in on a domain machine. However, users accessing the tab from a personal computer via VPN just see an endless loading icon. Presumably, this is because the page tries to prompt for credentials and Teams doesn't know how to handle it. This use case should be handled, either by supporting authentication prompts (preferred), or by providing a message stating the URL is not supported in the app, and provide a link to pop it out in the default browser.