Setting up the Microsoft Teams Integration

Mark Murphy Updated by Mark Murphy

Description

This workflow allows Admins to configure their Microsoft Teams tenant into Apprenticeship Management, used for hosted Reviews.

Required module

ePortfolio

Education - Microsoft Teams

Admin Access to the Azure Portal

Type of user

  • Administrator

Features

  • Pre-Requisites: Before Administrators configure settings for the Microsoft Teams integration in Apprenticeship Management, there are pre-requisites that need to first be in place. The Admin must have:
    1) A Microsoft 365 organisational account (Work or School).
    2) Access to the Azure Portal (https://portal.azure.com).
    3) Appropriate Azure AD Permissions: 'Application Developer' or 'Cloud Application Administrator' role.
    4) Ability to grant 'Admin Consent'.
  • The process requires having the ability to create a new App Registration within the Azure Portal. Admins can check they have access by attempting to complete Step 1 and logging into the Azure Portal > Azure Active Directory > App Registrations > selecting '+ New Registration'. If the '+ New Registration' button is greyed out, then the Admin will need to consult with their organisation's IT Team to gain access.
  • Step 1: Log into the Azure Portal > Azure Active Directory > App Registrations > select '+ New Registration'.
  • Step 2: Complete the Basic Information for the new registration:
    1) Name - Apprenticeship Management Teams Integration.
    2) Supported Account Types - Accounts in this organisational directory only (Single tenant).
    3) Redirect URI - this can be left blank for now and will be completed in Step 7.
  • Step 3: Select 'Register'.
  • Step 4: Make a note of the Tenant ID, Application ID, Client ID and Client Secret for the newly created app because these are required later in Apprenticeship Management.
  • Step 5: Permissions must be configured within the API to allow users within the tenant to book Teams Meetings through Apprenticeship Management. In the app created, select 'API Permissions' > '+ Add a permission' > select 'Microsoft Graph' > select 'Delegated Permissions'. The following permissions need to be added:
    1) User.Read - This allows user sign in and read user profiles - Admin consent is not required. This is added by default.
    2) Calendars.ReadWrite - This allows users to create calendar events with Teams meetings - Admin consent is required.
    3) OnlineMeetings.ReadWrite - This allows Teams meeting links to be generated - Admin consent is required.

4) Offline_access - This provides Refresh Tokens for a seamless experience - Admin consent is not required.

5) Openid - This provides OpenID Connect Authentication - Admin consent is not required.

6) Profile - This reads a user's basic information - Admin consent is not required.

7) User.ReadBasic.All - This reads all users' basic information - Admin consent is not required.

8) Mail.Send - This sends Teams notifications as a user - Admin consent is not required.

  • Step 6: This is a critical step of the setup because without this configuration, Assessors will need to authenticate their Microsoft account every time they attempt to book a Teams meeting through Apprenticeship Management. Select 'Grant admin consent for [Your Organisation Name]', select 'Yes' in the confirmation and wait for approximately ten seconds. You must then verify that all permissions show the 'Granted for [Your Organisation Name]' with a green check.
  • Step 7: The Redirect URI now needs to be setup and configured. In the app created, go to 'Authentication' > select '+ Add a Platform' > select 'Single-page Application'. Then add the URL for Production 'https://education.oneadvanced.com'. Under 'Implicit grant and hybrid flows', ensure that 'ID tokens' is checked, and 'Access tokens' is unchecked. Then select 'Save'.
  • Step 8: Now the settings in Apprenticeship Management are ready to configure. With Administrator access to Apprenticeship Management, select the 'Microsoft Teams Settings' menu item. Here, there are four settings to configure:
    1) Azure Tenant ID - this is a required field - insert the 'Tenant ID' noted from Step 4.
    2) Azure Application ID - this is a required field - insert the 'Application ID' noted from Step 4.
    3) Client ID - this is an optional field - insert the 'Client ID' noted from Step 4.
    4) Client Secret - this is an optional field - insert the 'Client Secret' noted from Step 4.
    Once the fields have the correct values for your organisation's instance of Microsoft Teams, then select 'Save Configuration'.
  • When Assessor users book reviews with their learners, they will then have the option to book as a Teams Meeting using the tenant configured by the Admin. When attempting to book a review as a Teams Meeting, the integration with Microsoft Teams will check that the logged in Assessor who is booking the review is a user within the Microsoft Teams tenant via the email address against the user's Identity account.

If the integration cannot verify the user exists in the tenant or the user has not logged into the tenant then a pop-up window will open so the Assessor can sign-in via their Microsoft account. The Assessor requires the relevant licence in the Azure Portal to book Teams Meetings, such as Microsoft 365 E3 or Microsoft 365 E5. If the review is booked without the Assessor having logged into their Microsoft account, then the review will not save as a Teams Meeting and will instead save as an in-person review.

How did we do?

Contact