What do you need the Graph API permissions for?

Created by Tim Kefford, Modified on Mon, 8 Dec at 12:05 PM by Tim Kefford

When setting up your MS Teams tenant for inclusion to our platform, you are provided a list of API permissions that you need to set up in Microsoft Entra. This article provides further explanation and links to the official Microsoft Graph documentation, so you can gain a complete understanding.

API / Permission name	Type	Description	Reason	Further Info
Presence.Read.All	Application	Read presence information of all users in your organization	By reading the presence data we are able to quickly react to a User/device reporting as offline and alert accordingly. This is faster than MS Teams Admin Center (10-15 minutes).	Click Here
TeamworkDevice.ReadWrite.All (API being deprecated by Microsoft, continue to use for now. New permissions to replace it are below. Add all APIs to ensure easy transition)	Application	Read and write Teams devices	This is used to get the device type, hardware detail, activity state, and health status information for a device. Write permissions are so that we can update software and reboot the devices.	Click Here
Device.Read.All (NEW)	Application	Read all devices	Allows the app to read your organization's devices' configuration information.	Click Here
DeviceManagementManagedDevices.Read.All (NEW)	Application	Read all managed devices	Used to list the properties of MTR Pro devices, such as make, model and serial number.	Click Here
DeviceManagementManagedDevices.PrivilegedOperations.All (NEW)	Application	Perform remote actions on Microsoft Intune devices	Used to allow remote reboot commands on MTRs (MTR Pro or Intune licensed devices only)	Click Here
CallRecords.Read.All	Application	Read all call records	Call records provide usage and diagnostic information about the calls and online meetings that occur within your organization.	Click Here
User.Read.All	Application	Read all users' full profiles	Used to provide information on the User and the devices logged into by them. Used for license assignment identification of MTR Pro, MTR Basic, etc.	Click Here

Note: A 'User' is required for all Microsoft devices to register to the MS Teams platform. The reference to it in this guide relates to Teams devices as well as end-users.

Additional Graph APIs for Smart Buildings feature

You only require these permissions if you have - or are wanting to use - the Smart Buildings feature.

API / Permission name	Type	Description	Reason	Further Info
Place.Read.All	Application	Read all company places	Allows us to identify company meeting rooms to then query for the events using the below API.	Click Here
Calendars.ReadBasic.All *-OR-*	Application	Read basic details of calendars in all mailboxes	Allows us to read the Free/Busy data and Organiser of Calendar events.	Click Here
Calendars.ReadWrite	Application	Read and write events in calendars in all mailboxes	Allows us to read the calendar data plus book, extend and end meetings for Room Resources. Required for Door Panel Booking feature	Click Here

Note: Only one of the 'Calendars' APIs is required. If you plan on using the bookings via the Door Panels feature, you must use the 'Calendars.ReadWrite.All' API.

Optionally, the Room Calendars returned to our platform can be restricted using these instructions.