Teams Presence Integration

An easy automated setup is default. Manual client setup can be toggled on to setup an own client that exists in the customer’s “App registrations” in Microsoft Entra ID.

The setup inherits the application from Telia, and is controlled and renewed by Telia, meaning no need to update secrets and handle time out issues. 

NB! Due to limitations in Microsoft Graph API, it’s only possible to subscribe to presence events for 650 subscribers per integration user. If you need to subscribe to more than 650 subscribers you need to setup multiple integration users and configure them in Telia Switchboard. Click the “add” button on the teams integration, and choose between the available Microsoft users. 

Enter your Tenant ID. Upon save you will be redirected to a Microsoft login where you need to pick an admin account for the tenant. After login, consent to the permissions requested by the “Telia Smart Connect – Teams Sync” application are needed.

Accepting the permissions will create an application in the your Entra ID “Enterprise applications“.

If you are not able to consent on behalf of the organization, you might need to enter the “Permissions” for the application, and choose “Grant permission for…”

To setup the integration, it is required to have a valid Microsoft Azure Tenant ID, Client ID and Client Secret for the application. Steps to obtain this will be described in Azure Service configuration. The service will use an integration user to subscribe to presence event changes. Any active user, with or without a valid Microsoft Azure license can act as an integration user.

Due to limitations in Microsoft Graph API, it’s only possible to subscribe to presence events for 650 subscribers per integration user. If you need to subscribe to more than 650 subscribers you need to setup multiple integration users and configure them in Telia Switchboard. This is described in step 25 in this document.

1. In the Azure Active Directory click on “App registration”.

2. Click on “New registration”.

3. Enter any name for the application for example “Telia Teams Presence” and click on “Register”.

4. The Application will be created and generate the Application (client) ID. The same view will display your Directory (tenant) ID.

Both the Client ID and Tenant ID needs to be entered into the Teams Presence integration configuration page in Telia Switchboard.

5. Open “Certificates & secrets” in the application view in the Azure Admin portal and click on “New client secret”.

6. Give the secret a name and select am expiration time of the secret. After the secret expires, a new one needs to be generated and updated in the configuration for Teams Presence in Telia Switchboard. Click on “Add” when finished.

7. Copy the client secret and paste it in the Teams Presence integration configuration page in Telia Switchboard.

8. Open “API permissions” in the application view in the Azure Admin portal and click on “Add a permission”.

9. Click on “Microsoft Graph”.

10. Click on “Delegated permissions”.

11. Select “Presence.Read.All” and click on “Add permissions” to add the permission.

12. Click on “Add a permission” again.

13. Click on “Microsoft Graph”

14. Click on “Application permissions” and select “User.Read.All” and click on “Add permissions” to add the permission.

Step 15 to 19 is only needed if you plan to use the Push line status to Teams. If you don’t plan to use this feature, you can skip to step 21.

15. Click on “Add a permission” again.

16. Click on “Microsoft Graph”.

17. Click on “Application permissions”.

18. Select “Presence.ReadWrite.All” and click on “Add permissions” to add the permission.

19. Enable the toggle in Telias Switchboard for “Push line status to Teams”.

20. Click on “Grant admin consent for <Company Name>”.

21. Confirm the permission in the popup.

22. Enter the username and password to an Azure Active Directory user in the Teams Presence integration configuration page in Telia Switchboard.

23. Click “Save”. The password and client secret will be hidden and the status will be updated to verify that the connection is up and running.

24. If you need to synchronize more than 650 users, you need to configure one new Integration user per 650 users. This can be done by clicking on the +-sign and add more, unique, integrations user. Each integration user are able to subscribe to presence status for 650 Teams users.

Can I use a user with Multi-factor authentication enabled for Integration users?

No. This is not possible. “Each user added to Integration users” can subscribe to presence status for 650 users, and do not work if the have MFA (Multi-factor authentication enabled).

This can become a problem for companies when Microsoft is adding mandatory MFA for all users starting rollout in July 2024. To work around this it is important to update the MFA Conditional Access policy and med an exception for the “Presence integration users”.

1. In Microsoft Azure/Entra go so Microsoft Entra Conditional Access by search.
2. Navigate to the Policy Snapshot
3. Locate and open the Policy used for enforcing Multifactor authentication on users
4. Select Users and the Exlude pane, toggle User and groups. You can either add Presence integration users to a group and add this group to the exclusion or one or multiple single users. Save changes for them to take affect. Now these users are not forced into the Multiple authentication login flow, but still might require to deactivate MFA if they have it already activated on a user level.

We are not allowed to give Application permissions, can we use delegated permissions?

No.

Can I use the same email on multiple users?

No, only one user can have an active synchronisation with each email-account.

Can I use multiple email-accounts on the same user?

No, only one email-account per user.

Can I change which user that is mapped with a specific email?

No.

Can I synchronise my Teams status message?

No.

Can I have multiple Microsoft Tenants synchronised to the same Telia solution?

Yes.

Can I have the same Microsoft Tenant synchronised to multiple Telia solutions?

Yes.

How often is the user mapping updated?

Every full hour.

Can I manually trigger an update of the user mapping?

Yes, do a change in the Teams Presence configuration in Telia switchboard like the username, change back to a valid username and save. This will trigger an instant update of the user mapping.

I experience that the Teams status suddenly stops to synchronise from my Teams client to the switchboard?

The fetching of the user list from Microsoft sometimes fails. This will create an empty user mapping-table. The next auto-update of users or a manual trigger will solve the issue.

The status icon for the integration is OK (green checkmark), but number of users is still 0?

The email address of the user is fetched from Microsoft and mapped to a users email address in Telia Switchboard. Verify that the correct email address is used in both places. Email alias isn’t supported. It might be due to missing permissions. Verify that the application in Azure Active Directory got the correct permissions for Presence.Read.All (Delegated) and User.ReadBasic.All (Application) and that you have granted admin consent.

After I save the configuration in Telia Switchboard the status is red with an error code?

The error message is returned from Azure Active Directory, you can lookup the error code here: https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-aadsts-error-codes

I created a valid synchronisation and I see users in the Teams Presence users list. But no status is displayed in the switchboard?

After a configuration change, the user needs to reload the switchboard for the changes to be visible.

All our users have two email addresses, the mapping of them seems to be random, how to map up the correct user?

You can use the export/import function in the user list in the administration portal to configure a email address on the users you want to synchronise. After you setup the Teams Presence integration, make a new import where you add the email to all users again.

Can passive users have Teams Presence?

Yes.

Is the user used for authentication required to have a valid Office365 E-license?

No.

Is the user used for authentication required to be a member of a valid user group?

No.

Is it possible to filter which users that are synchronised from Azure Active Directory?

No.

The configurator complains about invalid client secret with error code 7000215?

If you just created the secret, wait a minute and try again by adding the secret again and save the settings. If that doesn’t help, create a new client secret.

Is it possible to use the same O365 tenant on multiple customers?

Yes, but you need to use a unique clientid per customer for the integration to work. If you use the same settings on two different customers, the last one activated in Telia Switchboard will be the one that receives status updates.

Is it possible to use the same integration user multiple times?

No, each integration user is limited to subscribe to only 650 members.

My status in Teams didn’t change when I answered a call?

• Only the status “Available” and “Busy” in Teams will be replaced with your call status. If your status in Teams is set to “Do not disturb”, “Be right back”, “Appear away”, “Appear offline” or any other status, it will not be updated.
• It might take up to a full minute before the Teams status is updated due to limitations in Azure.
• Verify that you have set the correct permissions on the application in Azure. To set status in Teams, it is required to have the Application Presence.ReadWrite.all permission. The permissions are session dependant. After a permission change you need to have a new session, either by wait until the hourly synchronization or manually trigger a new session by performing a change to the Teams Presence Configuration in Telia’s Switchboard.
• It can take up to 15 minutes before the integration is activated after the service is enabled in Telia’s Switchboard.

I see the error message “Authorization_RequestDenied”, what to do?

This is due to insufficient privileges. Check the permissions for the application and verify that you have provided the correct access.