Azure & CAM Integration Notes
As of January 30, 2021 Azure is not allowing custom token expiry settings. The conditional access policies determine how the token expires are configured. This requires at least a P1 license. See the Microsoft link here.
.png?version=1&modificationDate=1676466376121&cacheVersion=1&api=v2&width=340&height=272)
Service Account Permissions
Service Account/Token User
For creating teams in MS Teams, you must have a service account in M365 and this account must have the permission/roles included in the following table that describes the Service Account Permissions and Roles.
Service Account Permissions (Roles) | Reason |
Application Administrator | Needs to be assigned for generating the token. Can be removed afterwards. If the token expires or is lost, you will need to re-enable this. Our best practice is to keep this enabled. |
Microsoft Team Administrator | For creating and using team, channel, folder, tab, planner tab |
User Administrator | For user administration in a team for the addition or removal of users. |
When a team is created, by default, the service account is the owner of the team.
Planner User
To create and use the Planner tab in Teams, the delegated / service account user must be a member of the team.
To create a team, you must have a team owner. Because of this requirement, you need an additional service account so that you can switch to it to create a planner. This additional service account must have the same permission/roles included in the table that describes the Service Account Permissions and Roles.
Note: If you plan to create a planner, refer to Step 4: Setting Service Account Permissions for the use of Microsoft Planner in Teams.
Private Channel
CAM uses Azure AD - Microsoft Graph API - to access resources in Office365 to create Groups and Teams. When you create a private channel, it has its own SharePoint site collection. The separate site collection is to ensure access to that private channel files are restricted to only members of the private channel compared to the team site where team owners have access to all the assets within the site collection.
The site collection created using private channels as per Microsoft documentation is not visible in the SharePoint admin center unless someone manually clicks on the Files tab in teams once the SharePoint site will be available in 1-2 min or almost instantly.
To trigger the click event on the Files tab, CAM needs the Microsoft native API permission which can be added by following the steps -
Login to Office365 with your Global Admin Access. Go to the “Azure portal”. https://portal.azure.com/#home
Go to Azure Active Directory on the far left menu bar
Click on App Registration in the left side bar
Select the registered app.
Click on Manifest in the left sidebar.
On the right side (in the manifest), click with in the manifest and scroll down till the end.
On your keyboard, process Ctrl+F to bring up the search bar
Search requiredResourceAccess
Put comma, after the previous node then copy below node in the List -
{
"resourceAppId": "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe",
"resourceAccess": [
{
"id": "fd7bf697-168c-45be-b7ba-e94b3529deff",
"type": "Scope"
}
]
},
10. Click Save.
11. Now click on API permissions in the left sidebar.
12. On the right side, scroll down till the end.
13. Under "Microsoft Teams Services (1)", it will list user_impersonation under Microsoft Teams Services, status as Not granted for <global admin user>.
14. In order to provide admin consent, scroll to the top of the page and click on select Grant admin consent for <global admin user>.
15. Confirmation message pop up displays, select “Yes”, add other granted permissions to configured permissions.
Click Save and Continue.
Follow the instructions on the page until
lpermissions are granted successfully.
Snapshot of Manifest
Service Account Permission - Use Planner in Teams
Note: If you would like to have Microsoft's Planner app within MS Teams, refer to Microsoft’s Planner app documentation.
To be able to create the Planner tab in Team Channels, Microsoft requires that delegated / service account users be created and is a members of the team. However, to build a team, there must be an appointed owner. Because of this requirement, you need an additional service account so that you can switch to it to create a planner.
In the M365 Admin Centre, in the left-hand menu click on Users and then Active Users
Click Add User
It is recommended to use a generic name such as “Planner User” with an email address of “planneruser@<domain>”
Assign the user a license
Do not assign any administration permissions or roles. This user should be set up as a standard user
Record the email address, as you will require this with configuring M365 within the CAM platform
Configuration in CAM Planner
Follow the steps to create Planner inside Channel.
Follow the steps to create Planner.
Create a Planner Template Click here to Setup the Planner structure in the template Editor.
Create Planner on Teams-Channel using CSV upload or Request workflow using the Template.
Set up a CSV upload
Enter the Unique Ids metadata for the Office 365 creating Teams. Click the CSV parameters for further help.
Sample CSV
. Go to Jobs tab, and upload the CSV
b. Configure a Request Workflow
On successful job execution, Planner displayed on teams as follows :
Group owners do not have access to Planners.
Note: Microsoft has a restriction, only group members can access Planners. As group owners cannot access Planners, you need an additional service account (group member) to create a Planner.
Token roles can be assigned to group members while creating a planner. After a group member creates the Planner, the token role can be reassigned to the owner. A token role is assigned to a group member so that the group member is able to receive the token and approve creation of planners.
Steps to Set an Additional Service Account in the External System Configuration -
Go to Administration
Click External System Configuration
Select Office 365
Click Edit
Following screen display -
Warning: Ensure Additional Service Account is set in the External System configuration.
CAM Microsoft Teams app
Read the Teams page for more information on how to install CAM teams app, required permissions and creating Teams, Channels, OneDrive, OneNote and Planner. Also how to access CAM application from Teams.
Teams and ETL
Read the ETL page for more information on how to use ETL to move or copy or link Teams, Channels, Tabs to a DMS system, and examples.
Teams and Template Editor
To use Template Editor to create Channels, Tabs and Teams, read here for steps.
Note: The job will not show errored if a user is missing from CAM during the Create Team/Tab or Channel process. The job inside will error in the log only.
Availability of Sharepoint Sites
While configuring M365 with CAM, there is now an option to make archived sharepoint sites read-only for Team Members.
In the Teams app, find a team you want to archive.
Click Archive button from the app menu.
The option now displays to Make the team read only if you choose to make it read only for all team members.
Click Archive to complete.
Troubleshooting
If you encounter any error while creating a team, check the following to ensure your team is created correctly:
Service Account/Token user and Planner user has the correct permissions. Refer to the Service Account Permissions section to verify and ensure it.
Log into Teams as the Service Account/Token User and/or Planner User and check whether you can create a team. If you are still not able to create a team, liaise with your IT or Security Team and let them check whether you have any internal policies set outside of CAM and MS Azure that are affecting this user.
Teams app has the correct Application and Delegated permissions. Refer to the Microsoft Graph Permissions in M365 section to verify and ensure it.
Related Topics
[Office 365 (CSV Parameter)] | [M365 Groups] | [M365 Users] | [CAM within M365 Team Apps]