Dialogue Cloud

On Premises

Microsoft Graph Presence Source (Get) Configuration

Introduction

The Microsoft Graph Cloud Communications Presence APIs are used by AnywhereNow for two distinct presence actions, Get Presence states of agents and Set Presence state of agents:

  1. This article: Microsoft Graph Presence Source enables the UCC A Unified Contact Center, or UCC, is a queue of interactions (voice, email, IM, etc.) that are handled by Agents. Each UCC has its own settings, IVR menus and Agents. Agents can belong to one or several UCCs and can have multiple skills (competencies). A UCC can be visualized as a contact center “micro service”. Customers can utilize one UCC (e.g. a global helpdesk), a few UCC’s (e.g. for each department or regional office) or hundreds of UCC’s (e.g. for each bed at a hospital). They are interconnected and can all be managed from one central location. to continuously get (collect) presence of Teams users, and

  2. See other article: Microsoft Graph Presence Publisher which enables the UCC to set presence of Teams users on-demand by AnywhereNow components.

For more information on the Graph API, see Microsoft’s documentation on https://learn.microsoft.com/en-us/graph/api/resources/presence?view=graph-rest-1.0

Important

While it is technically possible to create one "super" App to control all AnywhereNowGraph API calls to Microsoft 365, we recommend registering the Microsoft Graph Presence Publisher (set) and the Microsoft Presence Source (get) as two separate apps in your Microsoft Entra ID Formerly known as Azure Active Directory (or Azure AD, or AAD).

  1. Firstly, either the Presence Publisher app or the Presence Source app , could generate a higher load/volume in the Microsoft Graph API than expected, which could lead to throttling Throttling, in the context of a software cloud delivery service, is the practice of temporarily suspending or diminishing access to a service offering to a cloud customer. Because cloud platforms are mostly multi-tenant, shared platforms and the usage at any moment of many customers is unpredictable, throttling is a normal and logical procedure of retaining a cloud service for all customers, sometimes at the expense of one or a handful of customers who are at that time using too many resources for the backend platform. Not only a customer itself, but also a "noisy neighbour" on the same platform can be the cause of throttling. Usually service will be resumed at a normal level after a short cool-down period, but can even take up to 24 hours or more. In Microsoft 365 throttling is usually indicated by "429 errors" or "server too busy" messages in logfiles or replies. or other issues.

  2. Secondly, Publishing other users' Presence with the Publisher app may not be desired or legally permitted in your company, region or country, making this an optional feature.

High Level Steps

In order to start collecting presence for Microsoft Teams users, there are two requirements per tenant:

  1. Microsoft Entra ID Formerly known as Azure Active Directory (or Azure AD, or AAD) App Registration:

    1. Register an app in Microsoft Entra ID to query the Microsoft Graph APIs.

  2. Choose Authentication Method:

    1. Application Permissions (recommended):

      Authenticate using a Client ID and Client Secret. This is the recommended approach as it does not require a dedicated user account and avoids the security concerns associated with disabling MFA on a service account.

      Note

      Introduced in DC2024.02: The option to make this available via the OnePortal Formerly known as Partner Portal. A redesigned web portal for managing Dialogue Cloud deployments. was enabled with the release of Bundle A bundle is a fixed combination of our software platform elements of very specific versions. These are designed and tested to optimally work together to assure their intended function and interoperability. DC2024.02b.

    2. Delegated Permissions:

      Authenticate using a user account (username and password). Note that this method requires a service-style user account with MFA disabled, which is why Application Permissions is preferred.

Microsoft Entra Id App Registration setup

Tip

As Microsoft enabled throttling to prevent an overload off API calls, it is advised to use a separate Microsoft Entra ID App registration per UCC Service.
In order to prevent throttling, AnywhereNow queries a maximum of 650 users per request. With the limitation of a maximum of 1.500 requests per 30 seconds. This way AnywhereNow is able to collect presence of 15.000 uniquely configured Agents per App registration.

Please find below the steps to setup an App Registration in Azure.

  1. Navigate to: https://entra.microsoft.com/

  2. Under Applications -> App registrations create a new App registration

    1. Provide a Name for the application, for example: AnywhereNow Graph Get Presence Application

    2. Select the account type Single tenant only

    3. Click “Register”

  3. On the API permissions tab,

    • Application Permissions (recommended)
    • Delegated Permissions

    Add the following Delegated Microsoft Graph permissions:

    Description: Allows the app to read a basic set of profile properties of other users in your organization on your behalf. Includes display name, first and last name, email address and photo.

    Why is this required? To allow the Graph Presence Source to translate UPN In Windows Active Directory, a User Principal Name (UPN) is the name of a system user in an email address 'like' format. A UPN (for example: john.doe@domain.com) consists of the user name (logon name), separator (the @ symbol), and domain name (UPN suffix). to ID, ID is required to retrieve presence from user.

    Permission name: Microsoft Graph / User.ReadBasic.All

    Description: Allows the app to read data in your organization's directory.

    Why is this required? To allow the Graph Presence Source to cache user details (display name, sip address, id, UPN) from all employees, in order to minimize the number of request to graph.

    Permission name: Microsoft Graph / Directory.Read.All

    Description: Allows the app to read presence information of all users in the directory on your behalf. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.

    Why is this required? To allow the Graph Presence Source to retrieve current presence from users utilizing a single service account.

    Permission name: Microsoft Graph / Presence.Read.All

    Note

    Introduced in DC2024.02: The option to make this available via the OnePortal was enabled with the release of Bundle DC2024.02b.

    Add the following Application Microsoft Graph permissions:

    Description: Allows the app to read presence information of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.

    Why is this required? To allow the Graph Presence Source to retrieve current presence from users.

    Permission name: Microsoft Graph / Presence.Read.All

    Description: Allows the app to read all domain properties without a signed-in user.

    Why is this required? To allow the Graph Presence Source to retrieve the domains from the tenant.

    Permission name: Microsoft Graph / Domain.Read.All

    Description: Allows the app to read user profiles without a signed in user.

    Why is this required? To allow the Graph Presence Source to translate UPN to ID, ID is required to retrieve presence from user.

    Permission name: Microsoft Graph / User.Read.All

  4. Since the Admin consent are required, click the button “Grant admin consent for <tenant>”.

    Note

    Only a tenant administrator can grant the admin consent

  5. On the Authentication tab, change “Allow public client flows” to “Yes”.

    • Click “Save”

    Note:

    This is a setting mainly required for Delegated authentication permissions method. If all your Graph Presence services are setup for Application authentication permissions this op is not required.

    Why Allow public client flows is required: This setting enables the app to authenticate as a public client using delegated permissions. It allows AnywhereNow to retrieve presence data via Microsoft Graph without storing a client secret, using secure token flows like OAuth 2.0 with PKCE. This is essential for service accounts configured per tenant.

  6. On the Overview tab, copy both the Application (client) ID and the Directory (tenant) ID

    • These IDs can then be shared with your AnywhereNow contact to be entered in OnePortal.

Authentication Methods

  • Application Permissions (recommended)
  • Delegated Permissions

User Account

Note

You will need one user account for each tenant.

Note

Account should be cloud only and not federated When using AnywhereNow in combination with Federation you can add agents working with a Skype for Business or Teams account to your UCC. with an on premise ADFS.

The user account that is used to retrieve presence must be a Microsoft Entra ID Useraccount. This useraccount has the default ability to retrieve presence of other users in the same tenant.

The account does not require any permissions, nor does it need any licenses. Simply create an new user account without any licenses to use it like a service account.

Note

During the setup procedure, the account requires access to Teams to read the presence and complete the setup.

  • This username and password can then be shared with your AnywhereNow contact

Password policy

Client Secret

Note

Introduced in DC2024.02: The option to make this available via the OnePortal was enabled with the release of Bundle DC2024.02b.

An App authenticated with a ClientId and ClientSecret is used to get presence via the Graph API. The ClientSecret needs to be created separately (and periodically renewed) on the Entra ID App registration.

  1. Navigate to the Application you created in Microsoft Entra Id App Registration setup

  2. On the Client secret tab, click on New client secret:

  3. Enter a Description and set the Expires value

  4. On the next screen, copy the Value of this secret (so not the Secret ID)

    • The Value can then be shared with your AnywhereNow contact

Configure Agents for presence collection via MS Graph

In order to collect presence for Agents using Microsoft Graph, make sure that the UPN field in the SharePoint Agent list is populated with the correct UPN of the Agent.

Configure the Presence Source

In Dialogue Cloud, the Microsoft Graph Presence Source is configured through OnePortal at service level.

First Time configuration

First time configuration of the Presence Source is done when creating a new Service in OnePortal. See Presence Configuration

Editing an existing configuration

Note

The procedure below assumes the service already has a Presence Source configured with delegated permissions (UsernamePassword) and you want to change it to application permissions using ClientIdSecret, or to edit an existing Presence App.

  1. Open AnywhereNow OnePortal.

  2. Select the customer and then select the relevant service.

  3. Open the Replace dropdown and select Graph Client ID.

  4. Verify that the expected Microsoft Entra ID application is shown in Current Client ID. If not, enter the correct value in New Client ID and click Submit.

  5. Open the Change dropdown and select Graph Connection Type.

  6. Change the connection type to Client ID/Secret, enter the application secret in Graph Secret, and click Submit.

  7. Apply the change by performing a restart, see: Restart Options and service behavior.

    If the restart dialog provides the options, include Clear UCC Cache, Clear Graph Cache, and App Pool Restart so the updated Graph connection settings are reloaded cleanly.

Tip

After the restart, verify that presence collection resumes as expected for agents whose UPN values are correctly populated in the Agent list.