Lifesize® Icon™ Series 300/500/700

Last Updated: Sep 26, 2024

Configure Auto-admit

Setting up the Synergy SKY® Auto-admit Feature

A Lifesize Icon system that joins a Microsoft Teams® meeting with Connect Plus Gateway always joins the meeting as a guest. Synergy SKY’s auto-admit feature allows the Icon to join the meeting without manual intervention.

Before you are able to use the auto-admit feature with Lifesize Connect Plus Gateway, in your Microsoft environment you must configure an Azure Communication Service, register an app, configure a designated user, and create an access policy.

Setting Up an Azure Communication Service

Use the Azure Portal to create and configure a communication service.

  1. Sign in to the Azure Portal.
  2. Under Azure services, select + Create a resource.
  3. On the New page, search for and then from the results, select Communication Services.
  4. Select Create.
  5. Configure your communication service. Specify the following:
    • the subscription
    • the resource group
    • the name of your communication services resource
    • the geography to associate the resource with
  6. Review your setup and Create your resource.

See Create Azure Communication Services Resource for detailed instructions.

Collecting your Connection String

Later in the configuration you will need the connection string that allows API calls to your communication service. Find and save your connection string so it is available when you complete the configuration of Connect Plus Gateway.

  1. Sign in to the Azure Portal.
  2. Search for and then from the results, select Communication Services.
  3. On the Communication Services page, select the name of your resource.
  4. Select Keys from the menu on the left.
  5. Under Primary Key, click the Copy icon beside the Connection String field.
  6. Paste and save this information so that it is available later, when you configure Connect Plus Gateway.

Note: This connection string will be used in the Azure Communication Service Connection String field on the Admin Console > Connect Plus Gateway tab.

See Access your Connection Strings and Service Endpoints for detailed instructions.

Managing your Application

You will need to register a client app and create a client secret so that you can generate a token to use in your REST API request.

Registering the App

  1. Sign in to the Azure Portal.
  2. On the Active Directory Overview page, under Manage in the side menu, select App Registrations.
  3. Select New registration.
  4. Enter a Name for your application.
  5. Select Register.
  6. On the App registrations page, select the name of your application.
  7. Take note of the Application (client) ID and the Directory (tenant) ID so that it is available later, when you configure Connect Plus Gateway.

Note: The Application (client) ID and the Directory (tenant) ID will be used during the configuration of Connect Plus Gateway on the Admin Console > Connect Plus Gateway tab.

Obtaining the Client Secret

  1. From the side menu, select Certificates & secrets.
  2. On the Client secrets tab, select New client secret.
  3. Enter a Description.
  4. Select or enter when the secret Expires.
  5. Select Add.
  6. On the Client secrets tab, click the Copy icon beside the client secret you just created.
  7. Paste and save this client secret value so that it is available later, when you configure Connect Plus Gateway.

Note: This client secret value will be used in the Application Client Secret field on the Admin Console > Connect Plus Gateway tab.

Applying Permissions

  1. From the side menu, select API Permissions.
  2. Under Configured Permissions, select Add a Permission.
  3. In the Add Permissions menu, select Azure Communications Services.
  4. Select the following permissions:
    • Teams.ManageCalls
    • Teams.ManageChats
  5. Click Add Permissions
  6. In the Add Permissions menu, select Microsoft Graph.
  7. Select Delegated permissions.
  8. Select the following permissions:
    • Open ID
    • User.Read
  9. Click Add Permissions.
  10. Select Application permissions.
  11. Select the following permissions:
    • OnlineMeetings.Read.ALL
    • User.Read.All
  12. Click Add Permissions.

Important: Once you add all permissions, a user with an Administrator role must click Grant admin consent.

Allowing Public Client Flows

  1. From the side menu, select Authentication.
  2. Under Advanced Settings, click Yes to Allow public client flows.

See Register an App to request authorization tokens and work with APIs for detailed information on registering your application.

See Add the Communication Service permissions in the application for information on adding permissions.

Creating a Microsoft 365 User

An Administrator must create a dedicated Microsoft 365 user licensed to use Microsoft Teams. This user’s username and password is used to join online meetings.

Important: Two-factor authentication must be turned off for this user.

  1. Log into Microsoft 365 admin center.
    Note: Adding a user requires Administrator permissions.
  2. From the side menu select Users > Active Users.
  3. Select Add a user.
  4. Complete the basic user information for this user.
  5. In the Assign product licenses pane, select the location and the appropriate license to assign.
  6. Select Next.
  7. In the Optional settings pane, expand Roles to make the user an admin.
  8. Select Next.
  9. Review the details and click Finish adding.
  10. Select Close.

Configuring an Application Access Policy

Policies are collections of settings that can be applied to one or more applications. An administrator must configure a policy to allow your application to access online meetings with application permissions. You will configure the application access policy using PowerShell, while logged in as an admin user.

Note: You may need to install the Teams PowerShell module. You will need the application (Client) ID of the application you registered for Connect Plus Gateway.

  1. Open a Windows PowerShell command prompt window.
  2. Run the following commands:
    Import-Module MicrosoftTeams
    Connect-MicrosoftTeams
  3. When prompted, enter your administrator account name and password.
  4. Select Sign in.
  5. If necessary, follow the instructions to authenticate and verify the log in.

You will create a new application access policy or edit an existing one.

To see if you have an existing policy, run the following command:
Get-CsApplicationAccessPolicy

    If an access policy exists, add your application to it with the following command:
    Set-CsApplicationAccessPolicy -Identity <your_access_policy> -AppIds @{Add=”<applicationid>”}

      Where <your_access_policy> is the name of the access policy to update and <applicationid> is the ID of your registered application.

      If an access policy does not exist, create a new policy and add the app registration with the following command:
      New-CsApplicationAccessPolicy -Identity <your_access_policy> -AppIds <applicationid>

        Where <your_access_policy> is the name of the access policy to create and <applicationid> is the ID of your registered application.

        Once the policy is created or updated, it must be granted access to online meetings for all users/rooms with the following command:
        Grant-CsApplicationAccessPolicy -PolicyName  <your_access_policy>  -Global

          Where <your_access_policy> is the name of the access policy that contains your registered applicationId.

          Configuring Connect Plus Gateway

          After you have completed the pre-requisites in Microsoft Azure and Microsoft Entra, you must add specific information to the configuration tab for Connect Plus Gateway in Admin Console. Navigate to the Admin Console > Connect Plus Gateway tab.

          Microsoft Teams Lobby Auto-admit Configuration

          Enter the information you collected while performing the set ups.

          • Azure Communication Service Connection String – the Connection String assigned to the Primary Key for your communication service. Navigate to your communications services resource and select Keys from the navigation menu.
          • Application Client ID – the Application (Client) ID for your registered app.
          • Application Client Secret – the Client Secret value for your registered app.
          • Application (Microsoft 365) Tenant ID – the Directory (Tenant) ID for your registered app.
          • Microsoft 365 Username – the username for the dedicated user that allows the room system to join Microsoft Teams meetings.
          • Microsoft 365 Password – the password for the dedicated user that allows the room system to join Microsoft Teams meetings.

          Note: The Bot Username and Password are stored and used by Connect Plus Gateway to automatically admit the room system to Microsoft Teams meetings. Enghouse suggests you create a dedicated Microsoft 365 Username and Password for the auto-admit bot.