Authenticated Teams calls

What are the benefits of using Authenticated Teams Calls?

When joining calls on Airtame Hub using your individual Microsoft Account there are multiple benefits. Two of the most useful are:

• Skip waiting rooms for internal calls: When joining calls with your individual user you can often join internal meetings without having to be let into the call. Without authenticated calls the Hub might have to be let into the meeting since it’s joining as a guest
• Easily access chat items during and after meetings: Since you have been part of the meeting with your individual user any chat activity will show up inside Teams. You can participate in the chat there both during and after the meeting.
• Show up with your personal name in meetings instead of the meeting room name: This makes it easier for e.g. external parties to recognize who is joining the meeting if they invited you

Requirements

• Users need to be running at least version 4.7.0 of the Airtame application.
• Users must be granted a Teams license from the Microsoft organization to make use of the feature. Here’s a guide on how you check your organization’s license status: https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/eligible-teams-licenses

How to test

There are two key actions to take before users can utilize the authenticated calls feature:

• ACS Service Principal created on your Microsoft Tenant
• Airtame Rooms App registered and approved in the Microsoft organization. This is done by logging into a Microsoft account via the Airtame app. Depending on your Microsoft account settings an admin might have to approve the Airtame app.

1. ACS Service Principal installed

In order to enable authenticated Teams calls you have to have the ACS Service Principal installed. Azure Communication Services (ACS) is the Microsoft SDK that the Airtame Teams integration is built on. The service principal is necessary for letting your Teams users authenticate against the ACS SDK.

1.1 How to check if the ACS Service Principal is installed

1. Log in on entra.microsoft.com and go to Home | <ORG NAME> | Enterprise Applications | All Applications - Here’s a direct link
2. Clear all existing filters.
3. In the Search field, search for Azure Communication Services. If it appears, you have the ACS Service Principal installed.

1.2 How to install the ACS Service Principal

See Microsoft’s own instructions in this article. The steps relevant to using authenticated calls on Airtame Hub are in the last section of Step 5:

1. Open Powershell*

2. If you have not installed yet, you must install the Azure Powershell module:

   Install-Module AzureAD

3. Authenticate against your Microsoft Tenant, you can find your Tenant ID here, After running the following command an authentication window will appear:

   Connect-AzureAD -TenantId "Tenant_ID"

4. Enter the following command to create the service principal:

   New-AzureADServicePrincipal -AppId "1fd5118e-2576-4263-8130-9503064c837a"

*If you are doing this from a Mac see this article.

2. Register the Airtame Rooms Calendar Integration App in the Microsoft organization

When the application is registered in your organization, it appears as a separate entity in your apps list. See the screenshot below:

For the Airtame Rooms Calendar application to be automatically registered, the user must grant permission for the application to fetch calendar events and to allow the user to join calls on the Airtame Hub with their own Teams user.

We recommend that administrators grant consent for the entire organization, so users will have fewer steps to complete to enable both calendar and joining calls as their registered Teams user.

The two steps look like this:

1: Connecting the Microsoft Calendar in the Airtame Application

Once the user clicks on "Sign in with Microsoft" a window will open where the admin or end-user has to approve the Airtame Rooms integration for the calendar. After authenticating the user is asked to accept and then open the Airtame app. This enables the app to show calendar events containing call links.

2: Joining a conference call:  

When joining a call for the first time, after authenticating with a Microsoft account, the application will attempt to enable the authenticated calls feature. Upon starting a call users will see this prompt, in the case the admin has not already granted permission on behalf of the organisation.

If authenticated calls are not automatically enabled by the admin or by the user during their first call, users can always go to the "Connections" tab in order to enable the feature. In connections, there is a toggle that will trigger the above permissions flow.

Troubleshooting:

A blank tab opens in the browser when I try to join Teams calls on Airtame Hub

This should only happen on the first attempt to join a call and in case the service principal is missing. The Airtame app will not retry to authenticate as a Teams user until the toggle in Connections has been set to active.

You try to enable authenticated calls but the Airtame app throws an error: 

If this is the case, your ACS Service Principal is missing and the users cannot grant the necessary permissions.  Contact your IT admin including a reference to this article. They will need to complete step 1.2 in this guide to enable the feature for your organization.

The user has granted the necessary permissions but they are not authenticated in the call

The service principal is likely missing. If you try to give admin consent for the users, you will get the following error message:

If this is the case, your ACS Service Principal is missing and the users cannot grant the necessary permissions. To enable authenticated calls go back to step 1.2 in this guide and complete the steps.