Getting Started

MS Teams Observability is a two-part solution: a Collector that pulls Teams telemetry from Microsoft Graph, and backend integrations that store and visualise that data in Dynatrace or Splunk.

Prerequisites Everything you need before deploying: Azure app, permissions, network access, and backend access.

Install the Collector Deploy the collector, validate configuration, and start your first collection cycle.

Connect a Backend Choose Dynatrace or Splunk and configure the integration end-to-end.

License Understand demo versus live mode and the license requirements for production use.

How It Works

graph LR
    A["Microsoft Teams \(Graph API\)"] -->|polling| B["ms-teams-agent \(Collector\)"]
    B --> C["Dynatrace \(Grail + App\)"]
    B --> D["Splunk \(HEC + App\)"]

The Collector authenticates to Microsoft Graph using an Azure app registration and polls Teams telemetry on a configurable interval.
It enriches and normalises the data, then exports it to one or more backends.
The backend application (Dynatrace or Splunk) renders the data in operational dashboards.

What Data Is Collected

The collector retrieves and exports the following event families:

Event family	Content
`MSTeams_CallRecords_CallMetadata`	Call-level summary: type, health, duration
`MSTeams_CallRecords_StreamDetails`	Stream-level quality: RTT, jitter, packet loss
`MSTeams_CallRecords_PSTN`	PSTN telephony calls
`MSTeams_CallRecords_DirectRouting`	SIP / Direct Routing calls
`MSTeams_CallRecords_AutoAttendant`	Auto attendant usage
`MSTeams_CallRecords_CallQueue`	Call queue behaviour
`MSTeams_ServiceAnnouncement`	Microsoft published incidents and advisories
`MSTeams_CollectionHealth`	Collector operational health

See Metrics Dictionary for a full field reference.

Deployment Modes

The Dynatrace application supports two modes:

Demo mode — uses built-in sample data. No collector required. Useful for evaluation and demonstration.
Live mode — uses real tenant data collected by the collector. Requires a valid license. See License.

Demo and Live mode are specific to the Dynatrace application. The Splunk backend does not have a demo mode and displays data as soon as the collector starts sending it.

Supported Backends

Backend	Application included	Notes
Dynatrace	Yes — Grail + dedicated app	Full-featured integration with dashboards
Splunk	Yes — Splunk app	HEC-based ingestion with dedicated app