Configure the MS Entra ID for the Byner calendar integration

In this article:

• Step 1: Register the Application
• Step 2: Configure API Permissions
• Step 3: Configure Application Access Policy for Teams Meeting Notes & Transcripts
• Step 4: Generate a Client Secret
• Microsoft account configuration checklist for technical users

The calendar integration is used to synchronize calendar events between Byner and Microsoft bi-directionally. On the Microsoft side the Graph api must be enabled and configured. This document describes how to do this.

Step 1: Register the Application

1. Sign in to the Azure Portal / Microsoft Entra ID.

2. Navigate to Microsoft Entra ID > App registrations and select New registration.

3. Fill in the required application details:

1. Name: Enter a descriptive name for your application (e.g., Byner Calendar Integration).
2. Supported account types: Select Single tenant only (Accounts in this organizational directory only).

4. Click Register.

5. Once created, copy and securely save the Directory (tenant) ID and Application (client) ID shown on the Overview page.

Step 2: Configure API Permissions

1. From your app registration, go to API permissions > Add a permission > Microsoft Graph.

2. Select Application permissions.

3. Search for and add the following permissions:

1. Calendars.ReadWrite – Read and write calendars in all mailboxes
2. OnlineMeetingAiInsight.Read.All – Read all AI Insights for online meetings
3. OnlineMeetings.Read.All – Read online meeting details
4. OnlineMeetingTranscript.Read.All – Read all transcripts of online meetings
5. User.Read.All – Read all users' full profiles

4. Click Grant admin consent for [Your Organization] to approve these permissions.

Step 3: Configure Application Access Policy for Teams Meeting Notes & Transcripts

1. Open the Cloud Shell terminal by clicking the terminal icon (>_) in the top-right toolbar of the Azure Portal. Ensure the environment is set to PowerShell.

A new terminal window appears at the bottom.

2. Install and import the Microsoft Teams PowerShell module by running:

# Install the module (run once if not installed)

Install-Module MicrosoftTeams -Scope CurrentUser

# Import the module for the current session

Import-Module MicrosoftTeams

3. Connect to Microsoft Teams using your admin credentials:

Connect-MicrosoftTeams -UseDeviceAuthentication

4. Create a new application access policy (replace YOUR_APP_ID with your Application/Client ID from Step 1):

New-CsApplicationAccessPolicy -Identity Byner-Policy -AppIds "YOUR_APP_ID" -Description "This policy is used for Calendar integration by Byner"

5. Grant the policy to a specific user (replace USER_ID with the target user's Object ID or UPN):

Grant-CsApplicationAccessPolicy -PolicyName Byner-policy -Identity "USER_ID"

Alternatively, grant the policy to all users across the entire tenant:

Grant-CsApplicationAccessPolicy -PolicyName Byner-policy -Global

6. Enable Graph API access to meeting transcripts and speaker attribution:

Set-CsTeamsMeetingConfiguration -Identity Global -EnableGraphTranscriptAccess $true -EnableAttributedTranscripts $true

Step 4: Generate a Client Secret

1. In the Microsoft Entra admin center, navigate to App registrations > select your app > Certificates & secrets.

2. Select the Client secrets tab and click New client secret.

3. Enter a description (e.g., Byner Calendar Integration), select an expiration period (e.g., 12 months), and click Add.

Important: Copy and securely save the client secret Value immediately. It will not be shown again after you leave the page.

Microsoft account configuration checklist for technical users

This checklist is intended for engineers troubleshooting a Microsoft Graph integration that uses application permissions, Teams Application Access Policies, online meetings, transcripts, and AI Insights.

The goal is to verify that the Microsoft tenant, user, Teams configuration, and Entra application are configured correctly.

1. Application Registration

Identify the application by its Application (Client) ID.

Example:

Application (Client) ID:

77c39f22-b660-4da3-a47b-793d991fda5b

Verify that the App Registration exists:

$appId = "YOUR-APP-ID"

Get-MgApplication -Filter "appId eq '$appId'" | Select-Object Id, AppId, DisplayName

Expected result:

• App Registration exists.
• AppId matches the application used to obtain the Graph token.

2. Admin Consent / App Role Assignments

Adding a permission to the App Registration is not enough. The tenant must actually grant the corresponding Microsoft Graph app roles.

Check the Service Principal:

$sp = Get-MgServicePrincipal ` -Filter "appId eq '$appId'"

Get-MgServicePrincipalAppRoleAssignment ` -ServicePrincipalId $sp.Id | Select-Object ` AppRoleId, PrincipalDisplayName, ResourceDisplayName, ResourceId

Expected:

• Microsoft Graph is the resource.
• The required Application permissions are present as app role assignments.
• In particular, verify:

OnlineMeetings.Read.All

OnlineMeetingTranscript.Read.All

OnlineMeetingAiInsight.Read.All

3. Application Access Policy

For application access to Teams online meetings, verify the Teams ApplicationAccessPolicy.

Check the policies:

Get-CsApplicationAccessPolicy |

    Format-List Identity, AppIds, Description, ConfigMetadata

The application's Client ID must be present in the relevant policy:

YOUR-APP-ID

For a tenant-wide configuration, check the Global policy:

Get-CsApplicationAccessPolicy -Identity Global |

    Format-List Identity, AppIds, Description, ConfigMetadata

Expected:

Identity : Global

AppIds   : {YOUR-APP-ID}

4. User Policy Assignment

If the application access policy is assigned specifically to users, verify the assignment:

Get-CsUserPolicyAssignment `

    -Identity "user@tenant.onmicrosoft.com" `

    -PolicyType ApplicationAccessPolicy

If the user has no individual policy, the Global Application Access Policy can apply.

Check the user's current effective object as well:

Get-CsOnlineUser -Identity "user@tenant.onmicrosoft.com" |

    Select-Object UserPrincipalName, ApplicationAccessPolicy

Avoid having unnecessary competing policies while troubleshooting. Keep the configuration as simple as possible.

5. Teams Meeting Configuration

For transcript access through Microsoft Graph, verify:

Get-CsTeamsMeetingConfiguration -Identity Global |

    Format-List *

Important settings include:

EnableGraphTranscriptAccess : True

If this is disabled, Graph transcript access can fail even when the application has the correct Graph permission and Application Access Policy.

For troubleshooting, also check:

EnableAttributedTranscripts