Graph access and Teams admin sign-in

What it is for

EasyUC talks to Microsoft in two ways. Through Microsoft Graph it reads users, presence and Teams phones. Through Teams PowerShell it sets up the trunk, the voice routes and the number assignments. Both ways need a permission in the customer’s Microsoft tenant.

For Graph you register an application in the customer’s tenant and store its application ID and client secret in EasyUC. The same app registration can also handle the sign-in to Teams PowerShell. EasyUC then signs in by itself before every action, and saving a script sets the route in Teams without intervention.

Without an app registration the device code sign-in remains: a Teams administrator confirms the sign-in in the browser. This session expires after about an hour. EasyUC never stores an administrator’s user name and password.

Prerequisites

• Licence module teams. Without this module the EasyUC Teams workspace does not appear.
• Role EasyUC Teams (ROLE_APP_TEAMS_WORKSPACE) with the sub-permissions TENANTS (ROLE_APP_TEAMS_TENANTS) to read and TENANTS bearbeiten (ROLE_APP_TEAMS_TENANTS_EDIT) to change.
• The tenant exists and the Directory (tenant) ID is entered.
• An account with the right to create app registrations in the customer’s Microsoft tenant and to grant admin consent.
• For the device code sign-in: an account with the Teams Administrator role.
• The EasyUC PowerShell service is running. The tenant page shows this under Set up the trunk in Teams.

Step by step: Prepare the app registration in Microsoft Entra

1. Sign in to the customer’s Microsoft Entra admin center and create a new application under the app registrations, for example with the name EasyUC.
2. Note the directory (tenant) ID and the application (client) ID. Both are GUIDs; do not mix them up.
3. Grant the application the Microsoft Graph application permissions User.Read.All (users), Presence.Read.All (presence) and TeamworkDevice.Read.All (Teams phones).
4. If you want to use presence sync, add Presence.ReadWrite.All.
5. If EasyUC is to sign in to Teams PowerShell by itself, add the application permission Organization.Read.All.
6. Grant admin consent for all permissions.
7. For the app sign-in to Teams PowerShell, also assign the Teams Administrator directory role to the application. Do not add an API permission for the “Skype and Teams Tenant Admin API”.
8. Create a client secret and copy its value. Note the expiry date.

Step by step: Store and test Graph access in EasyUC

1. Open Teams Tenants, click the tenant and stay in the Settings section.
2. Check the Directory (tenant) ID at the top.
3. Go to the box Microsoft Graph (user import and presence).
4. Enter the Application (client) ID.
5. Under Client secret, enter the value of the secret.
6. Click Save.
7. Click Test credentials. On success it shows „Verbindung steht. Beispielbenutzer: …“ and the box header shows Checked.

Step by step: Sign in to Teams PowerShell with the app registration

1. On the tenant page, in the Settings section, go to the box Set up the trunk in Teams.
2. Check the line PowerShell service reachable. After it are the versions of the MicrosoftTeams module and of PowerShell.
3. If it says “An app registration is stored: EasyUC signs in by itself before every action (app sign-in, unattended).”, you do not need to do anything else. The status pill shows Signs in automatically.
4. To test, click Sign in with the app registration.
5. Click Check connection. On success it shows Signed in with App sign-in (unattended).

Step by step: Sign in with a Teams administrator by device code

1. In the box Set up the trunk in Teams, click Sign in with a Teams admin.
2. EasyUC shows a code and an address. Click Copy code.
3. Click Open sign-in page, sign in as a Teams administrator and enter the code.
4. Leave the tenant page open. It polls every three seconds, for at most five minutes.
5. After confirmation it shows Signed in with Device code (expires), the account and the expiry time.
6. Finish trunk, voice routes and number assignments within the session. Sign out ends it early.

Fields and options

Check the result and narrow down errors

• Graph success: the tenant’s Users section shows the users of the directory, the Phones section shows the inventory.
• PowerShell success: in the box Set up the trunk in Teams, Show what would happen and Update routes can be used, and the Number plan section loads phone numbers.
• „Es sind noch keine vollständigen Graph-Zugangsdaten hinterlegt (Verzeichnis-ID, Anwendungs-ID und Secret).“ One of the three details is missing. Save before testing.
• “The directory (tenant) ID above is also required.” Enter the GUID in the tenant settings.
• State Rejected: check the client secret and its expiry date, the application permissions and the admin consent in the correct tenant.
• „Verbindung steht, das Verzeichnis liefert aber keine Benutzer.“ The sign-in works, but User.Read.All is missing or has no consent.
• „Der PowerShell-Dienst ist nicht erreichbar - ohne ihn kann der Trunk nur von Hand in Teams angelegt werden.“ Check in the EasyUC Manager that the PowerShell service of the Teams module is running.
• “The device code sign-in has expired” Sign in again or store an app registration.
• „Die Anmeldung wurde nicht bestaetigt. Bitte erneut starten.“ The five minutes have passed. Start the sign-in again.
• „Die Anmeldung steht, aber dem Konto fehlen die Rechte. Der App-Registrierung muss die Verzeichnisrolle „Teams-Administrator“ zugewiesen sein.“ Assign the role in Microsoft Entra.
• A successful Graph test does not prove rights for Teams PowerShell and vice versa. Check both ways separately.