/
Configure Teams recording

Configure Teams recording

Prerequisites

  • A client machine with Microsoft Windows 10 is required.

  • PowerShell version >= 5.x is required.

  • The user should be Tenant Global Admin

  • The AD/Entra should have 3 users groups:

    • One group for the recorded end user

    • One group for the compliance end user (With replay rights)

    • One groupe for the IT end user (To check the technical configuration)

Registering the Microsoft Teams Bot in Azure

The first step is to allow our bot to connect to your tenant. To do so, open the following links into a browser, the user should be tenant administrator:

For the first bot:

https://login.microsoftonline.com/YOURTENANTID/adminconsent?client_id=9b976bac-588c-4070-b72a-a12fffa87e40&state=12345&redirect_uri=https://compliance-hub.open-lake.com/

For the second bot:

https://login.microsoftonline.com/YOURTENANTID/adminconsent?client_id=66e3e942-42d3-41b1-95f0-db47bb3fe5c5&state=12345&redirect_uri=https://compliance-hub.open-lake.com/

Replace YOURTENANTID with your tenant ID (You can find it on the home page of Azure Entra).

Automatic installer

This script can help you install our Teams recording application with PowerShell

#PAREMETERS:: # Ask the user for a domain name $domainName = Read-Host "Please enter your domain name" Write-Host "You entered the domain name: $domainName" Install-Module MicrosoftTeams Connect-MicrosoftTeams #CREATE THE FIRST BOT OBJECT $upn01 = "oltcompliancebot01@$($domainName)" Write-Host "First bot UPN is: $upn01" $appInstance = New-CsOnlineApplicationInstance -UserPrincipalName $upn01 -DisplayName 'OLT_BOT01' -ApplicationId 9b976bac-588c-4070-b72a-a12fffa87e40 $objectIbot01 = $appInstance.ObjectId Write-Host "ObjectId is: $objectIbot01" Sync-CsOnlineApplicationInstance -ObjectId $objectIbot01 -ApplicationId 9b976bac-588c-4070-b72a-a12fffa87e40 #CREATE THE SECOND BOT OBJECT $upn02 = "oltcompliancebot02@$($domainName)" Write-Host "Second bot UPN is: $upn02" $appInstance = New-CsOnlineApplicationInstance -UserPrincipalName $upn02 -DisplayName 'OLT_BOT02' -ApplicationId 66e3e942-42d3-41b1-95f0-db47bb3fe5c5 $objectIbot02 = $appInstance.ObjectId Write-Host "ObjectId is: $objectIbot02" Sync-CsOnlineApplicationInstance -ObjectId $objectIbot02 -ApplicationId 66e3e942-42d3-41b1-95f0-db47bb3fe5c5 #Configuring access to meeting metadata New-CsApplicationAccessPolicy -Identity "OLT-COMPLIANCE-RECORDING-BOT01" -AppIds "9b976bac-588c-4070-b72a-a12fffa87e40" -Description "Recording Access to meeting metadata bot1" Grant-CsApplicationAccessPolicy -PolicyName "OLT-COMPLIANCE-RECORDING-BOT01" -Global New-CsApplicationAccessPolicy -Identity "OLT-COMPLIANCE-RECORDING-BOT02" -AppIds "66e3e942-42d3-41b1-95f0-db47bb3fe5c5" -Description "Recording Access to meeting metadata bot2" Grant-CsApplicationAccessPolicy -PolicyName "OLT-COMPLIANCE-RECORDING-BOT02" -Global #Create the compliance recording rule New-CsTeamsComplianceRecordingPolicy -Enabled $true -Description 'Open Lake Technology Compliance Recording' -Identity 'OLT_Compliance_Recording' #Disable audio notitification Set-CsTeamsComplianceRecordingPolicy -Identity 'OLT_Compliance_Recording' -DisableComplianceRecordingAudioNotificationForCalls $true Write-Host "Waiting 30 seconds for propagation..." Start-Sleep -Seconds 30 #Associate the bots with the compliance rules $app1 = New-CsTeamsComplianceRecordingApplication -Parent 'OLT_Compliance_Recording' -Id ([Guid]$objectIbot01) $app2 = New-CsTeamsComplianceRecordingApplication -Parent 'OLT_Compliance_Recording' -Id ([Guid]$objectIbot02) #Show the rules Get-CsTeamsComplianceRecordingPolicy

 

Manual installation

The following section is for a manual installation of the Teams recording.

Whitelisting the Microsoft Teams Bot App

In order to complete the steps below, you must have Global Administrator role.

The same Bot can be whitelisted in multiple Microsoft Entra (formerly Azure AD) tenants, and can be used for multiple compliance policies.

The registration consists of the following steps:

Prerequisites

Accessing the tenant via PowerShell

Registering the bot as a Teams application

Step 1 - Download and install PowerShell 5.1.

Step 2 - Open PowerShell as administrator.

Step 3 - Set the security protocol to TLS 1.2 with the following command:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Step 4 - Install the NuGet package provider module by running the following command:

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

Step 5 - Install the Microsoft Teams module by running the following command:

Install-Module MicrosoftTeams

Accessing the tenant via PowerShell

Step 1 - Open PowerShell as administrator.

Step 2 - Execute the following command:

Update-Module MicrosoftTeams

Step 3 - Execute the following command:

Connect-MicrosoftTeams

Step 4 - A login prompt will show up. Provide the user credentials.

Registering the bot as a Teams application

Step 5 - Execute the following command. At the UPN part, provide a unique UPN for the recording bot, for example, oltbot1@contoso.com. Provide something at the displayName part, it can be anything.

For the first bot

Execute the following command:

New-CsOnlineApplicationInstance -UserPrincipalname UPN -DisplayName 'displayName' -ApplicationId 9b976bac-588c-4070-b72a-a12fffa87e40

In the command results, take note of the ObjectId. It will be needed later.

Execute the following command. Replace the ObjectId part with the ID from the results of the previous command:

Sync-CsOnlineApplicationInstance -ObjectId ObjectId -ApplicationId 9b976bac-588c-4070-b72a-a12fffa87e40
image-20250312-211500.png

For the second bot

Execute the following command:

New-CsOnlineApplicationInstance -UserPrincipalname UPN -DisplayName 'displayName' -ApplicationId 66e3e942-42d3-41b1-95f0-db47bb3fe5c5

In the command results, take note of the ObjectId. It will be needed later.

Execute the following command. Replace the ObjectId part with the ID from the results of the previous command:

Sync-CsOnlineApplicationInstance -ObjectId ObjectId -ApplicationId 66e3e942-42d3-41b1-95f0-db47bb3fe5c5
image-20250312-211511.png

Configuring Access Policy for Meeting Metadata

You need to execute the following commands.

For the first bot, create the policy:

New-CsApplicationAccessPolicy -Identity "OLT-RECORDING-BOT1" -AppIds "9b976bac-588c-4070-b72a-a12fffa87e40" -Description "Recording Access to meeting metadata bot1"

For the first bot, apply the policy:

Grant-CsApplicationAccessPolicy -PolicyName "OLT-RECORDING-BOT1" -Global

For the second bot, create the policy:

New-CsApplicationAccessPolicy -Identity "OLT-RECORDING-BOT2" -AppIds "66e3e942-42d3-41b1-95f0-db47bb3fe5c5" -Description "Recording Access to meeting metadata bot2"

For the first bot, apply the policy:

Grant-CsApplicationAccessPolicy -PolicyName "OLT-RECORDING-BOT2" -Global
image-20250312-211524.png

Creating a Microsoft Teams Compliance Policy

In order to complete the steps below, you must have Global Administrator or Teams Service Administrator role.

At least one compliance policy has to be created in Teams which is then assigned to recorded users. Multiple policies can be configured and assigned to different bots.

For more information on policies, see https://docs.microsoft.com/en-us/powershell/module/skype/set-csteamscompliancerecordingpolicy

The policy configuration consists of the following steps:

  • Prerequisites

  • Creating a Teams Compliance Recording Policy

  • Changing the Compliance Recording Policy settings

Creating a Teams Compliance Recording Policy

Step 1 - Execute the following command to create the policy. At the Policy Description part, provide some description. At the PolicyName part, provide a name.

New-CsTeamsComplianceRecordingPolicy -Enabled $true -Description '<Policy Description>' -Identity '<PolicyName>'

And the pair the bots with the compliance rules:

Set-CsTeamsComplianceRecordingPolicy -Identity 'ContosoPartnerComplianceRecordingPolicy' -ComplianceRecordingApplications @(New-CsTeamsComplianceRecordingApplication -Parent 'ContosoPartnerComplianceRecordingPolicy' -Id 'APPID01'), @(New-CsTeamsComplianceRecordingApplication -Parent 'ContosoPartnerComplianceRecordingPolicy' -Id 'APPID02')

Step 8 - Disable the built-in audio notification for P2P PSTN Calls

As we'll use the recording service to play the audio annoucement, you need to disable the built in announcement.

Set-CsTeamsComplianceRecordingPolicy -Identity 'PolicyName' -DisableComplianceRecordingAudioNotificationForCalls $true
image-20250312-211617.png

Changing the Compliance Recording Policy settings

The Teams Compliance Recording Policy allows the following configuration options:

RequiredBeforeMeetingJoin Defines if the bot has to join the call before the recorded user can join the meetings Default value: 1 (On)

RequiredBeforeCallEstablishment Defines if the bot has to join the call before the recorded user can place or receive calls Default value: 1 (On)

RequiredDuringMeeting Defines if the recorded user will be disconnected from the meetings if the recorder bot connection is lost Default value: 1 (On)

RequiredDuringCall Defines if the recorded user will be disconnected from the call if the recorder bot connection is lost Default value: 1 (On)

It is strongly recommended to use the default settings (strict mode) for the compliance recording policies. The default settings ensure that if, for some reason, the bot cannot join or disconnects from the call/meeting, the recorded user will be disconnected automatically to avoid compliance issues. There is no failover or automatic retry mechanism implemented on the Teams side.

Follow the steps below to change the settings:

Step 8 - Execute the following command to get the ID of the compliance recording application and the name of the compliance recording policy. It will return the name of the compliance recording policy in the Identity field. Take note of the value of the Identity field (after the Tag: part). It also returns the compliance recording application ID. Take a note of the identifier which is displayed after ComplianceRecordingApplications : {Id=.

Get-CsTeamsComplianceRecordingPolicy
image-20250312-211642.png

Step 9 - If you want to change the default values, execute the following commands to change the compliance recording policy options. Replace the and the parts with the values received in the previous command. This example below turns off all restrictions.

Set-CsTeamsComplianceRecordingApplication -Identity '/' -RequiredBeforeMeetingJoin 0 -RequiredBeforeCallEstablishment 0 -RequiredDuringMeeting 0 -RequiredDuringCall 0

Changing these parameters of an existing compliance recording policy that is already granted to a recorded user might take hours to take effect on the user's calls & meetings. As an alternative, we recommend creating a new compliance recording policy (see Step 7) with all the parameters having the same values as before, except the PolicyName that should be different; setting the new policy's parameters using the Set-CsTeamsComplianceRecordingApplication command; then granting this policy to the recorded user that takes effect almost immediately. Of course, if you have a policy already set up with the desired parameter values, it's enough to grant that policy to the user, no need to create another one with the same settings.

Administering Compliance Policy for Microsoft Teams Users

Step 1 - Open PowerShell as administrator.

Step 2 - Execute the following command:

Update-Module MicrosoftTeams

Step 3 - Execute the following command:

Connect-MicrosoftTeams

Step 4 - A login prompt will show up. Provide the user credentials.

Assigning a Compliance Policy to a user

Step 5 - Execute the following command. Replace the <User’s UPN> part with the recorded user's UPN. Replace the part with the name of the compliance policy (Whitelisting the App and Creating the Compliance Policy - Step 9)

Grant-CsTeamsComplianceRecordingPolicy -Identity '<User's UPN>' -PolicyName ''

Once the compliance policy is assigned to the user, it may take some time to take effect. The policy assignment of the user can be checked with the following command. Replace the <User’s UPN> part with the recorded user's UPN.

Get-CsOnlineUser -Identity '<User's UPN>' | Select-Object -ExpandProperty 'TeamsComplianceRecordingPolicy'

Removing the Compliance Policy from a user /

Follow the steps below to remove the compliance policy from a user:

Step 1 - Execute the following command. Replace the <User’s UPN> part with the recorded user's UPN. Leave PolicyName empty to remove the policy.

Grant-CsTeamsComplianceRecordingPolicy -Identity '<User's UPN>' -PolicyName ''

It may take some time to take effect. The policy assignment of the user can be checked with the following command. Replace the <User’s UPN> part with the recorded user's UPN.

Get-CsOnlineUser -Identity '<User's UPN>' | Select-Object -ExpandProperty 'TeamsComplianceRecordingPolicy'Configure the recording for the Compliance Hub

HELP

If the command to add the apps into the recording rules is not working, try remove the S after ComplianceRecordingapplications