/
Microsoft Teams

Microsoft Teams

Description of how the Teams connector works

This document describes how our Teams connector works and the prerequisites.

Prerequisites

  • The user should be Tenant Global Admin

Operating diagram

The diagram below shows how the MS 365 data recovery solution works

image-20250312-210008.png

The information is retrieved in the following stages:

  1. Our "Teams Container 1" will subscribe to the tenant by authenticating with an API key. The tenant will then publish the events to the container's public DNS name.

  2. The tenant will send the call references to our container. The container will compare the participants of the calls to the "User List" and only keep the events concerning the users on this list.

  3. Our "Teams Container 2" will read the various events contained in the "Filestorage" and extract the data. Once extracted, the data is pushed into a NoSQL database.

  4. The Dashboard will then query the database to display the data on various dashboards.

Global solution requirements

MS365 authentication

In order to authenticate our container on the tenant, an API key must be generated.

The user carrying out the operations must be an administrator of the tenant.

Creation of the registration application

Go to: https://portal.azure.com with your Microsoft account.

  1. Search for "App registration

  2. Create "New App".

On the creation screen, you will see the type of access the application will have on the Tenant and on the users. Name your application.

image-20250312-210035.png

Add permissions

The following permissions must be added:

  • Permission type : Application

  • User.Read.All

  • Reports.Read.All

  • CallRecord-PstnCalls.Read.All

  • CallRecords.Read.All

  • Chat.ReadBasic.All

  • Chat.Read.All

  • AppCatalog.Read.All

  • Channel.ReadBasic.all

  • ChannelMeber.Read.all

  • Directory.Read.all

  • Groupe.Read.All

  • TeamsSettings.Read.all

image-20250312-210043.png

Generate the application's Secret Key

The Secret Key value will be hidden just after it is generated, so copy it and save it in a notepad or other tool.

The secret key is available in the "Certificates & secrets" menu:

Summary

At the end of the various operations, you will have :

  • Application ID

  • Tenant ID

  • Secret Key

image-20250312-210146.png

Authorisation to display ids in activity reports

By default, in the activity reports. The user-friendly name of each user is hidden. To obtain the user-friendly name, perform the following operation:

In Microsoft 365 admin center.

  • Settings > Org Settings > Services > Reports.

image-20250312-210120.png

  • Uncheck "Display user names".

image-20250312-210159.png

Queue authorisation

To obtain information about queues, the application must be added to the "Teams Communication Administrator" role.

You need to go to Microsoft Entra Id (the new Azure Active Directory), then to "All Roles". In this menu, you can find the "Teams Communication Administrator" role and add the application to it:

image-20250312-210210.png

Application and flow security

  • All data flows are encrypted using SSL.

  • Authentication is performed using an API key and its secret via TLS negotiation.

  • The data collected does not leave our infrastructure (if the solution is used on our infrastructure).

  • All our data is located in mainland France and stored in a multi-tenant system with a separate storage environment for each customer

  • Container 1 is published behind a reverse proxy that only publishes the web listening port and the subscription URL (everything else is closed).

Notes

  • Obtaining CDRs can take up to 15 minutes (Microsoft limitation).

  • Usage reports (Users, PSTN, Direct Routing, etc.) are published once a week by Microsoft.