Configuring the Teams Extension

Overview

The Microsoft Teams Extension enables UniversitySite to create and manage Teams meetings for Live Instructor-Led Training Events using Azure subscriptions. "Azure subscriptions have a trust relationship with Azure Active Directory (Azure AD). Azure AD is trusted to authenticate Users, services, and devices for the subscription..." See the full article here.

Step 1 - Azure Admin: Register the UniversitySite Teams Extension application with this Microsoft Identity Platform to create the Application (client) ID, Directory (tenant ID), and Client Credential Secret Value. Provide this information to the LMS Admin. 

Step 2 - Azure Admin or Network Sys Admin: Update Teams Policy via PowerShell (as an Admin).

Step 3 - LMS Admin: Connect UniversitySite to Microsoft Teams with your Application (client) ID, Directory (tenant ID), and the Client Credential Secret Value.

Permissions UniversitySite Uses

UniversitySite connects to Microsoft Graph as an application, not as a signed-in person. It needs exactly four Microsoft Graph Application permissions:

• OnlineMeetings.ReadWrite.All: creates, updates and cancels the Teams meeting for a live event.
• OnlineMeetingArtifact.Read.All: reads the meeting's attendance report, so attendance can be brought into UniversitySite.
• Calendars.ReadWrite: adds the event to the host's Outlook calendar, with the Teams meeting and chat.
• User.Read.All: finds the host's Microsoft account from their email address.

UniversitySite does not read Teams recordings, transcripts, email, files or chats. It doesn't need OnlineMeetingRecording.Read.All, OnlineMeetingTranscript.Read.All or OnlineMeetings.Read.All, or any Delegated permissions.

Existing Teams Integration - Need the New Teams Event Calendar Creation Instructions?

If you already have Teams integration working but need to add this capability, so UniversitySite also creates a Teams calendar event with chat and other functionality, follow the next step.

If you have NEVER CONFIGURED Teams integration for UniversitySite, skip the next step and begin at Register UniversitySite.

1. Open your UniversitySite app registration, click API permissions | + Add a permission | Microsoft Graph | Application permissions. In the Select permissions search field, type calendar. Click Calendar | Expand and select the Calendars.ReadWrite permission. Click Add permissions, then Grant admin consent.

   

Register UniversitySite Teams Extension Application via Azure Portal

1. From Azure Active Directory admin center | select Azure Active Directory.

   

2. Select App registrations.

   

3. Click + New registration. 

   

   
   

4. Add a Name such as UniversitySiteTeamsExtension or USiteTeams | choose Accounts in this organizational directory only and then click Register. Make note of the App Registration's Name to use in the PowerShell script (for convenience, not required).

   

5. Next, click API permissions.

   

6. Click + Add a permission.

   

7. Click Microsoft Graph.

   

8. Click Application permissions.

   

9. From the Select permissions search field, type onlinemeeting to show a list of the related permissions.

   

10. Click to Expand and select only OnlineMeetingArtifact.Read.All and OnlineMeetings.ReadWrite.All. Leave the recording, transcript and OnlineMeetings.Read.All permissions unselected. Don't add the permissions yet, because there are more to select.

    

11. Go back to the Select permissions search field, type calendar. Click Calendar |Expand  and select the Calendars.ReadWrite permission.

    

12. Again, from the Select permission field, search for user. Click User | Expand and select the User.Read.All permission, and then click Add permissions.

    

13. Click Grant admin consent for newly added permissions, then click Yes to confirm.

    

14. Click Overview.

    

15. Next, under Client credentials, click the Add a certificate or secret link.

    

16. Click + New client secret. 

    

17. Add a Description, then from the Expires dropdown, choose 24 months, and then click the Add button.

    

18. Copy the Client Secret Value (not Secret ID) and paste it into an email or chat message to the LMS Administrator along with the Application (client) ID, and then Directory (tenant) ID from the next two steps. You will also use the Application (client) ID value when you run the PowerShell script to create a Teams policy.  

    
    

    

19. From the Overview page: Copy and paste the Application (client) ID into the message.

    

20. Copy and paste the Directory (tenant) ID into the message. Keep the message open for the PowerShell script.

    

    
    

Update Teams Policy

This section describes creating a security policy in the Teams service which is needed to support the Teams-related permissions granted to the App Registration in the Azure service.

1. Open PowerShell (as an admin).

   Before running the following script in PowerShell, replace the [Application (client) ID] below with your firm's Application (client) ID and [Policy Display Name] with any name you choose (it is recommended to use the name of the App Registration + "Policy") in the code below:

Install-Module -Name PowerShellGet -Force -AllowClobber
Install-Module -Name MicrosoftTeams -Force -AllowClobber
Import-Module MicrosoftTeams
Connect-MicrosoftTeams
New-CsApplicationAccessPolicy -Identity "[Policy Display Name]" -AppIds "[Application (client) ID]"
Grant-CsApplicationAccessPolicy -PolicyName "[Policy Display Name]" -Global

Install-Module -Name PowerShellGet -Force -AllowClobber
Install-Module -Name MicrosoftTeams -Force -AllowClobber
Import-Module MicrosoftTeams
Connect-MicrosoftTeams
New-CsApplicationAccessPolicy -Identity "UniversitySiteTeamsExtensionPolicy" -AppIds "e9eef294-xxxx-xxxx-xxxx-b0401bd428b7"
Grant-CsApplicationAccessPolicy -PolicyName "UniversitySiteTeamsExtensionPolicy" -Global

2. Provide the LMS Admin with the Application (client) ID, Directory (tenant ID), and the Client Credential Secret Value so they can add the values to UniversitySite.

Connect UniversitySite to Microsoft Teams

From InstructorSite, go to Global Settings | Miscellaneous | Extensions | expand Microsoft Teams Extension.

• In the Teams Tenant ID field paste the Directory (tenant) ID.
• In the Teams Client ID field paste the Application (client) ID.
• In the Teams Secret field paste the Client Credential Secret Value.
• Click the Test Teams Connection button.

Frequently Asked Questions

We already granted the recording, transcript or OnlineMeetings.Read.All permissions. Should we remove them?

You can remove them. UniversitySite doesn't use them, and removing them doesn't affect the extension. If you leave them in place, nothing breaks.

Do we need any Delegated permissions?

No. UniversitySite signs in as the application, so Microsoft only applies the Application permissions. An earlier version of this article added a Delegated Calendars.ReadWrite permission. You can remove it.

Can we limit the Teams policy to the people who host training events?

Yes. Instead of Grant-CsApplicationAccessPolicy -Global, grant the policy to each host with -Identity <user>. If you do, add each new event host to the policy. Otherwise, UniversitySite can't create Teams meetings for them.

What happens when the client secret expires?

UniversitySite stops creating Teams meetings until a new secret is entered. Before the secret expires, create a new one in the app registration, then paste it in the Teams Secret field and click Test Teams Connection.