MS Teams

This guide is for the customer’s Microsoft 365 administrator and the Edmingle administrator. Follow it in order. When it is complete, tutors can schedule an MS Teams session in Edmingle, students can join without a Microsoft account, and Edmingle can close the session, mark attendance, and pull the recording.

Edmingle does not use a shared Edmingle Teams tenant. Every meeting is created in your Microsoft 365 tenant, with your app registration and your organizer user.

1. What you are setting up

2. How a class behaves

Read this before setup. Several items look like product bugs and are Microsoft limits.

1. A tutor or admin opens the session in Edmingle. Edmingle creates one Teams meeting under the organizer user and gives everyone the same join link.
2. A student who clicks Join in Edmingle is marked present at that moment.
3. The student opens Teams. If they have no Microsoft account, they join as a guest and type a name. That name is not used for attendance.
4. The meeting is not ended from Edmingle. Someone must end it in the Teams client.
5. After Teams has actually ended, an admin can end the session in Edmingle. Students who never clicked Join are marked absent.
6. Time spent inside Teams is not stored. Attendance threshold does not apply to MS Teams and is hidden when MS Teams is selected.
7. If auto-record is on, the recording is pulled after the call has ended and attached to the session. A transcript is pulled only when your tenant allows Graph to read transcripts.

Who is the host

The host is the organizer user configured in Edmingle, not whichever tutor is logged into Edmingle.

• A tutor who signs into Teams with a different user in the same tenant can present (share, mute) but is not the meeting owner.
• A tutor whose Teams browser session is expired, or who joins without that work account, joins as a guest and will not have presenter controls.
• Students are attendees. They cannot end the meeting or manage others.

If tutors must have full host controls, the organizer user must be that tutor’s Microsoft account, or you must accept that host controls stay with the shared organizer account. Edmingle does not add co-organizers.

3. Before you start

You need all of the following.

Decide the organizer before creating the app policy. Changing the organizer later means granting the policy to the new user. Old meetings stay owned by the old user.

Do not use a personal Microsoft account (@outlook.com, @hotmail.com, or a personal Gmail used to sign into Microsoft). It cannot be the organizer of these meetings.

4. Create the organizer user

1. In the Microsoft 365 admin center, create or choose a user, for example teams-classes@yourdomain.com.
2. Assign a licence that includes Microsoft Teams.
3. Sign in once as that user and finish any first-run prompts. The mailbox and Teams app must exist. An unlicensed or never-activated user will fail when Edmingle creates a meeting.
4. In Microsoft Entra admin center → Identity → Users → open that user.
5. Copy Object ID. This is the value Edmingle calls Organizer user id.

Keep the account’s password and MFA with your IT team. Edmingle never signs in as this user. If the account is deleted, disabled, or loses its Teams licence, new classes stop working and existing recordings may become unreadable.

5. Register the Edmingle app

1. Entra admin center → Identity → Applications → App registrations → New registration.
2. Name it something your admins will recognise, for example Edmingle Teams.
3. Supported account types: Accounts in this organizational directory only.
4. Leave Redirect URI empty. This app uses a secret, not a user login.
5. Register.
6. On Overview, copy:
   • Application (client) ID → Edmingle Client id
   • Directory (tenant) ID → Edmingle Tenant id
7. Certificates & secrets → New client secret.
8. Choose an expiry your team will track (24 months is typical). Copy the Value immediately. Microsoft shows it only once. This is the Edmingle Client secret. The Secret ID is not the secret.

Store the secret in a password manager. Do not email it or put it in a ticket.

6. Grant Graph permissions

Entra → your app → API permissions → Add a permission → Microsoft Graph → Application permissions.

Add these. They must be Application, not Delegated.

Then click Grant admin consent for . Every row must show a green Granted. Adding a permission without consent does nothing.

User.Read and User.Read.All are not required. Do not add broad directory permissions “just in case”.

7. Allow the app to manage the organizer’s meetings

Admin consent is not sufficient. Microsoft also requires an application access policy that names this app and this organizer. This is PowerShell only.

Install once:

Install-Module MicrosoftTeams -Scope CurrentUser

Sign in as a Teams administrator. Use a normal desktop PowerShell window. Cloud Shell often cannot do interactive sign-in.

Connect-MicrosoftTeams

Confirm you are in the customer tenant, not another Azure subscription:

Get-CsTenant | Format-List DisplayName, TenantId

TenantId must match the Directory (tenant) ID from the app registration.

Create the policy once. Replace the app id:

New-CsApplicationAccessPolicy `
  -Identity "Edmingle-Live-Class" `
  -AppIds "<application-client-id>" `
  -Description "Allows Edmingle to create and read live-class meetings"

Grant it to the organizer. Use the organizer’s sign-in address:

Grant-CsApplicationAccessPolicy `
  -PolicyName "Edmingle-Live-Class" `
  -Identity "teams-classes@yourdomain.com"

Confirm:

Get-CsOnlineUser -Identity "teams-classes@yourdomain.com" |
  Format-List ApplicationAccessPolicy

The result must be Edmingle-Live-Class. Policy assignment can take up to 30 minutes, sometimes longer. If Test connection works but creating a class returns an access or policy error, wait and retry before changing the app.

8. Allow students to join without a Microsoft account

Students do not have accounts in your tenant. Both of the settings below must allow anonymous join. If either is off, students see Sign in to join the meeting.

Set-CsTeamsMeetingConfiguration -Identity Global -DisableAnonymousJoin $false

$policy = (Get-CsOnlineUser -Identity "teams-classes@yourdomain.com").TeamsMeetingPolicy
if ([string]::IsNullOrWhiteSpace($policy)) { $policy = "Global" }

Set-CsTeamsMeetingPolicy -Identity $policy -AllowAnonymousUsersToJoinMeeting $true

Get-CsTeamsMeetingConfiguration -Identity Global | Format-List DisableAnonymousJoin
Get-CsTeamsMeetingPolicy -Identity $policy | Format-List AllowAnonymousUsersToJoinMeeting

Expected: DisableAnonymousJoin : False and AllowAnonymousUsersToJoinMeeting : True.

The same change exists in Teams admin center:

• Meetings → Meeting settings → Anonymous users can join a meeting → On
• Meetings → Meeting policies → the policy on the organizer → Anonymous users can join a meeting → On

These changes can take a few hours. Test with a new session. An old join link can keep the previous behaviour.

9. Recording and transcripts

Recording

On the organizer’s meeting policy:

Set-CsTeamsMeetingPolicy -Identity $policy -AllowCloudRecording $true

Edmingle asks Teams to record automatically. The file is not available at the moment the call ends. Edmingle fetches it after Microsoft publishes the recording. Large files can take longer.

Tell learners that the class is recorded. Recording laws and your own privacy notice are your responsibility.

Transcripts

Transcription must be allowed, and Graph must be allowed to read the transcript. The second switch is off by default in many tenants.

Set-CsTeamsMeetingPolicy -Identity $policy -AllowTranscription $true
Set-CsTeamsMeetingConfiguration -Identity Global -EnableGraphTranscriptAccess $true

If Graph transcript access is off, the class still runs and the recording can still be saved. The transcript step fails with an error similar to “Graph API access to transcripts is disabled for this tenant”. That is a tenant setting, not an Edmingle outage.

If the tenant disallows speaker names in transcripts, Edmingle saves the transcript without speaker names.

10. Enter the credentials in Edmingle

1. Sign in to Edmingle as an administrator.
2. Open Settings → Integrations → MS Teams.
3. Enter:

4. Save and turn the integration on.
5. Click Test connection.

Test connection only proves that the tenant id, client id, and secret can obtain a token. It does not prove the application access policy, the organizer licence, anonymous join, or recording. Those are proved by the class test in the next section.

The secret is never shown again in Edmingle. To rotate it, create a new secret in Entra, paste the new value, and save. Leave the secret box empty on later saves if you are not changing it.

After a successful save, Edmingle registers a Microsoft subscription so it is told when calls end. The notification address is:

https://<your-edmingle-host>/webhooks/msteams/TeamsWebHook.php

That URL must be reachable from the public internet and must be the same host your institution uses in the browser. If Test connection succeeds but the subscription warning appears, send that warning text to Edmingle support. Do not keep creating new app registrations.

11. Prove the setup with one real class

Use a brand-new session. Do not reuse a meeting created before the policy changes.

1. In Edmingle, schedule a live session and choose MS Teams. Attendance threshold must not be offered for this provider.
2. As a tutor, open the session and start it. Edmingle should return a Teams join link without an error.
3. In a private browser window, with no Microsoft login, open the student join flow. You should reach the Teams pre-join screen and be able to enter a name. You should not be forced to sign in.
4. In another window, sign in to Teams as the organizer and join. That user should have host controls.
5. If a tutor uses a different work account, sign out of Teams completely, sign in as that tutor, and join from Teams. They should appear under their work name. They can present. They should not be labelled as a guest.
6. End the call inside Teams. Ending it only in Edmingle will be rejected while Teams still considers the call live. The message is: the meeting is still running in Microsoft Teams; end it there first.
7. End the session in Edmingle. The student who clicked Join is present. A student who never clicked Join is absent.
8. Wait, then confirm the recording appears on the session. Transcript appears only if section 9 was completed.

If step 3 fails, section 8 is not in effect yet. If step 2 fails with a policy or authorization error, section 7 is missing or not propagated. If step 5 shows the tutor as a guest, that browser is not actually signed into the work account.

12. Day-to-day use

Tutor

1. Start the session from Edmingle.
2. Join Teams with the organizer account when host controls are required. Otherwise join with a work account in the same tenant.
3. Teach, then click End meeting in Teams.
4. End the session in Edmingle only after Teams has ended.

Student

1. Click Join in Edmingle. That click is what marks them present.
2. On the Teams screen, enter their name and join. No Microsoft account is required.
3. Closing the Edmingle tab without clicking Join leaves them absent, even if someone later forwards them the Teams link outside Edmingle.

Administrator

• Renew the client secret before it expires. An expired secret stops new meetings and recording downloads. Edmingle cannot warn Microsoft about your secret expiry.
• Do not delete the organizer user.
• Do not remove admin consent or the application access policy.
• If you change the Edmingle domain, tell Edmingle support. The Microsoft notification URL is tied to the host.

13. Attendance rules

This is intentional. A normal Teams meeting has no per-student registration. Anonymous guests are only a display name they typed themselves, so Edmingle does not match attendance by name.

14. Risks and limits

Edmingle will not register students with Microsoft, will not create a personal join link per student, and will not turn a tutor into host unless that tutor is the configured organizer. Those are limits of the Teams meeting product used here.

15. Troubleshooting

When you contact Edmingle support, send:

• Approximate time of the attempt
• Whether Test connection succeeded
• The exact error text, with the client secret removed
• Whether a private window could join without signing in
• Output of the confirmation commands in sections 7 and 8, with no secrets included

16. Setup checklist

• Organizer user exists, has signed in once, and has a Teams licence

• Organizer Object ID copied

• App registered in this tenant only

• Tenant id, client id, and secret value copied and stored safely

• Six application permissions added

• Admin consent granted

• Application access policy created and granted to the organizer

• Anonymous join enabled at tenant and on the organizer’s meeting policy

• Cloud recording enabled

• Transcription and Graph transcript access enabled, if transcripts are required

• Credentials saved in Edmingle and Test connection succeeded

• New test class: student joins without an account

• New test class: organizer has host controls

• Call ended in Teams, then session ended in Edmingle

• Present and absent match who clicked Join

• Recording appears on the session

• Secret expiry date is on the IT calendar

17. Commands in one place

Run after Connect-MicrosoftTeams, and only after Get-CsTenant shows the correct tenant. Replace the two placeholders.

New-CsApplicationAccessPolicy `
  -Identity "Edmingle-Live-Class" `
  -AppIds "<application-client-id>" `
  -Description "Allows Edmingle to create and read live-class meetings"

Grant-CsApplicationAccessPolicy `
  -PolicyName "Edmingle-Live-Class" `
  -Identity "<organizer-sign-in-address>"

Set-CsTeamsMeetingConfiguration -Identity Global -DisableAnonymousJoin $false
Set-CsTeamsMeetingConfiguration -Identity Global -EnableGraphTranscriptAccess $true

$policy = (Get-CsOnlineUser -Identity "<organizer-sign-in-address>").TeamsMeetingPolicy
if ([string]::IsNullOrWhiteSpace($policy)) { $policy = "Global" }

Set-CsTeamsMeetingPolicy -Identity $policy -AllowAnonymousUsersToJoinMeeting $true
Set-CsTeamsMeetingPolicy -Identity $policy -AllowCloudRecording $true
Set-CsTeamsMeetingPolicy -Identity $policy -AllowTranscription $true

If New-CsApplicationAccessPolicy says the policy already exists, skip that one command. Do not create a second policy for the same app.

Confirm:

Get-CsOnlineUser -Identity "<organizer-sign-in-address>" |
  Format-List ApplicationAccessPolicy, TeamsMeetingPolicy

Get-CsTeamsMeetingConfiguration -Identity Global |
  Format-List DisableAnonymousJoin, EnableGraphTranscriptAccess

Get-CsTeamsMeetingPolicy -Identity $policy |
  Format-List AllowAnonymousUsersToJoinMeeting, AllowCloudRecording, AllowTranscription