Azure Permissions

Note

This is the canonical Azure permissions page for the collector. Other pages link here to avoid configuration drift.

Use this guide to create the Microsoft Entra application used by the collector to call Microsoft Graph APIs.

Required Outcome

At the end you must have:

• tenant_id
• client_id
• One authentication method:
  • client_secret, or
  • client_certificate_path (PEM with private and public key)
• Admin-consented Graph application permissions

flowchart TD
    A[Azure Portal] --> B[Microsoft Entra ID]
    B --> C[New App Registration]
    C --> D[Copy tenant_id and client_id]
    D --> E{Auth method}
    E -->|Client secret| F[Create client secret]
    E -->|Certificate| G[Upload public cert and store PEM on host]
    F --> H[Add Graph API permissions]
    G --> H
    H --> I[Grant admin consent]
    I --> J[Validate in collector config]

Create the App Registration

1. Open Azure Portal and go to Microsoft Entra ID.
2. Copy Tenant ID from Overview.
3. Go to App registrations and click New registration.
4. Select Accounts in this organizational directory only.
5. Create the application and copy Application (client) ID.

Configure Authentication

Client Secret

1. Open Certificates and secrets.
2. In Client secrets, click New client secret.
3. Copy the secret Value immediately after creation.
4. Put this value in microsoft_authentication.graph.client_secret.

Certificate (PEM)

1. Open Certificates and secrets.
2. In Certificates, upload the public certificate (.cer, .pem, or .crt).
3. Keep a PEM file containing both private and public keys on the collector host.
4. Put the PEM path in microsoft_authentication.graph.client_certificate_path.

Expected PEM layout:

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Caution

Use RSA certificates. EC or DSA certificates are not supported by this integration flow.

Add Microsoft Graph API Permissions

In API permissions:

1. Click Add a permission.
2. Select Microsoft Graph.
3. Select Application permissions (not Delegated).
4. Add:
   • CallRecords.Read.All
   • Reports.Read.All
   • ServiceHealth.Read.All
5. Click Grant admin consent and confirm.

Validate Collector Configuration

Use one of these authentication patterns.

Client secret

microsoft_authentication:
  graph:
    tenant_id: "<tenant-id>"
    client_id: "<client-id>"
    client_secret: "<secret>"

Certificate

microsoft_authentication:
  graph:
    tenant_id: "<tenant-id>"
    client_id: "<client-id>"
    client_certificate_path: "/etc/ms-teams-observability-agent/graph.pem"
    client_certificate_passphrase: "optional"

Run:

ms-teams-agent validate --config ./config.yaml
ms-teams-agent test-connection --config ./config.yaml

For all configuration fields, see Configuration Reference.

Complete permission and authentication reference

Required Permissions

Permission	Type	Required	Purpose
CallRecords.Read.All	Application	Yes	Retrieve Teams call records, stream details, PSTN, and Direct Routing data
Reports.Read.All	Application	Yes	Access Teams activity reports (user activity, usage)
ServiceHealth.Read.All	Application	Yes	Access Microsoft 365 service health incidents and advisories

Optional Permissions (VAAC Features)

Permission	Type	Required For	Purpose
VAAC-specific permissions	Application	Auto Attendant and Call Queue	Voice application analytics

Permission Type Notes

Attribute	Value
Permission type	Application (not Delegated)
Admin consent	Required
Token flow	Client credentials

Supported Authentication Methods

Method	Description
Client secret	Secret generated in Azure App Registration
Certificate (PEM)	RSA certificate with private and public key