Dialogue Cloud

On Premises

SharePoint Online Authentication for Anywhere 365 Dialogue Cloud Microsoft Entra ID App-Only

Microsoft Entra ID Formerly known as Azure Active Directory (or Azure AD, or AAD) App-Only is Microsoft's preferred and soon only model to grant an application access to SharePoint Online. This article describes the steps that are required, after you have created your SharePoint UCC A Unified Contact Center, or UCC, is a queue of interactions (voice, email, IM, etc.) that are handled by Agents. Each UCC has its own settings, IVR menus and Agents. Agents can belong to one or several UCCs and can have multiple skills (competencies). A UCC can be visualized as a contact center “micro service”. Customers can utilize one UCC (e.g. a global helpdesk), a few UCC’s (e.g. for each department or regional office) or hundreds of UCC’s (e.g. for each bed at a hospital). They are interconnected and can all be managed from one central location. Sites, to enable this authentication method for AnywhereNow Dialogue Cloud to access your SharePoint Online.

Warning

The description in this article is not for creating new UCC sites, only for granting consent to access Dialogue Cloud for sites you should have already created.

For creating new AnywhereNow UCC Sites you can use your own created Microsoft Entra ID Formerly known as Azure Active Directory (or Azure AD, or AAD) App and certificate. Please refer to the steps on:
Creating a OneUCC Site using PnP.PowerShell

Summary

Authentication consists of the following three steps:

  1. Grant consent to a regional AnywhereNow Dialogue Cloud Microsoft Entra ID Enterprise Application.
  2. Set permissions for this consented Enterprise App for all your UCC SharePoint Sites (PowerShell script available).
  3. Have this new authentication method applied to your UCCs (OnePortal Formerly known as Partner Portal. A redesigned web portal for managing Dialogue Cloud deployments. request).

Detailed Steps

To make it possible for our Microsoft Entra ID Enterprise Application to connect to one or more of your SharePoint Site Collections, it should be trusted by your organization. There is a different Microsoft Entra ID Application in each of our five Data-center regions, please grant consent to the correct application belonging to the region in which your UCCs are currently hosted. If you have UCCs in multiple regions, please grant consent to each corresponding regional Microsoft Entra ID Application.

To grant Microsoft Entra ID Enterprise Application consent

  1. Select the hyperlink that applies to your installation:

    2. The Microsoft 365 sign in form will appear.

    Microsoft Office365 sign in screen capture

  2. Sign in with a Microsoft 365 administrator account that has the necessary authorizations to grant tenant-wide consent. Users authorized to consent on behalf of an organization include:

    • Global Administrator or Privileged Role Administrator for granting consent for apps requesting any permission, for any API.
    • Application Administrator or Cloud Application Administrator for granting consent for apps requesting any permission, for any API.
    • A custom directory role that includes the permission to grant permissions to applications, for the permissions required by the application.

    Warning

    These administrator roles do not refer to users who are only SharePoint Administrators. They cannot grant tenant-wide consent.

    3. After successfully signing in, the Permissions requested window appears, listing the permissions that need to be accepted.

    Permissions requested screen

    Note

    The AnywhereNow Dialogue Cloud Microsoft Entra ID Enterprise App will only be able to access selected SharePoint Sites (formerly known as site collections).

  3. Click the "Accept" button. You will be redirected to the AnywhereNow corporate website (https://www.anywhere3.now/)

  4. Open the Azure Portal (https://portal.azure.com/) and sign in using a Microsoft administrator account (Global Administrator, Application Administrator or Cloud Application Administrator).

  5. In the search bar on Microsoft Azure portal the main page, search for and select Enterprise Applications. A list of all Enterprise Applications in your organization will appear.

  6. Find the application for the region whose permissions you want to set by using the following Application IDs:

    • emea-weu-p-sharepoint: 18efff03-033a-4f27-beb6-ee7d4a6a4fab
    • emea-gwc-p-sharepoint: b087e5fb-3463-46b7-a74d-047a9dee095d
    • emea-neu-p-sharepoint: 103e3a4b-b13e-47a8-b998-d496e7f9fa5a
    • nora-cus-p-sharepoint: ab03865a-8f0c-435e-bcee-55d98f72c391
    • nora-eu2-p-sharepoint: 5dfb6af5-9d1a-471f-b9ee-29c0ba334470
    • apac-sea-p-sharepoint: 108437ec-1388-43b4-b87c-2f0f7c40b1c9
    • apac-aue-p-sharepoint: b69d533f-c413-4df6-877d-f3a74a9cfd18
    • You can use filters to find the correct application.

  7. Click on the desired application's name. The overview pane for that application will appear.

  8. Select Permissions from the left menu. A list of Applications along with their permissions parameters will appear. Office 365 SharePoint Online should appear in this list with the "Claim value" set to Sites.Selected, and "Granted through" set to Admin consent

Once consent is granted to the Enterprise Application for your Microsoft 365 tenant, the Enterprise Application still requires permissions to the SharePoint sites (previously known as Site Collections) that are used by your AnywhereNow UCCs.

It is essential to grant full control permissions in order to allow AnywhereNow to perform all required operations, such as retrieving settings, uploading voicemails and recordings, etc.

Note

Please note that Microsoft Graph Explorer uses Delegated Permissions. It is therefore essential for the administrator executing the requests to have Site Collection Administrator permissions to the Site Collection used by Anywhere365.

There are two ways to grant these permissions.

1. Using a convenient PowerShell script

For a script which eases the below steps for multiple simultaneously created UCC sites see our separate instruction page on:
Granting permission to Multiple Sites - PowerShell Script

2. To manually configure SharePoint Site Collection permissions

the manual steps (25 steps) to be taken using Microsoft Graph Explorer.

  1. Open the Microsoft Graph Explorer in your browser (https://developer.microsoft.com/en-us/graph/graph-explorer)

  2. Click the Sign in button and sign in using a Microsoft 365 administrator account (Global Administrator, Application Administrator or Cloud Application Administrator) that has Site Collection Administrator permissions for the Site Collections used by AnywhereNow.

  3. If this is the first time you sign in to Graph Explorer, you will be prompted to accept the requested permissions. Select Accept to continue.

    After successfully signing in, your name will appear in the bar.

  1. In the Query Builder, select Modify permissions (Preview).

  2. In the blue drop down menu, change GET to POST (it will turn from blue to green).


  3. Select the Open the permissions panel.

  4. Using the List (Sites > Sites.FullControl.All) or the search field, select Sites.FullControl.All and click Consent at the bottom of the pane.

  5. If these permissions have not yet been granted to Graph Explorer, the Permissions requested screen will appear. Select Accept to the requested permissions.

  6. The permissions panel will now that Sites.FullControl.All has been consented.

  7. Close the Permissions pane.

  8. In the drop down menu, change POST back to GET. and change the value for the hyperlink from

    https://graph.microsoft.com/v1.0/me

    to

    https://graph.microsoft.com/v1.0/sites/<tenantname>.sharepoint.com:/<sites>/<sitecollectionname>

    Note

    There is a " : "(colon) between the host name and the relative path to the site collection.

  9. Select Run query to request the details from this specific SharePoint Site Collection.

  10. From the response collect the SharePoint Site Collection id (the GUID GUID stands for Globally Unique Identifier (format is always like 2ed153b4-f632-4766-b846-5b2a769b36d1) and is a pseudo random number used in software applications that is assumed to be unique. The total number of unique keys (2<sup>128</sup> of 3.4028×10<sup>38</sup>) is very large and the probability of the creating the same GUID twice is very small, though not 100% guaranteed. The term GUID is generally used by developers working with Microsoft technologies, while UUID is used everywhere else. of the middle section of the id; between the two commas).

  11. In the query builder replace the host name and relative path to the site collection with the SharePoint Site Collection id and select Run query again. You should get the same as in the previous query.

  12. Compose a new query to grant the Microsoft Entra ID Application write permissions to this SharePoint Site Collection, by changing the value of the drop down menu from to POST and by adding '/permissions' to the end of the hyperlink.


  13. Click Request body.

  14. Supply below request body (matching the regional Microsoft Entra ID Application that you want to grant access) in the field that opens.

    EMEA-WEU:

    Copy
    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "18efff03-033a-4f27-beb6-ee7d4a6a4fab","displayName": "Anywhere365 - EMEA-WEU"}}]}

    EMEA-GWC

    Copy
    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "b087e5fb-3463-46b7-a74d-047a9dee095d","displayName": "Anywhere365 - EMEA-GWC"}}]}

    EMEA-NEU

    Copy
    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "103e3a4b-b13e-47a8-b998-d496e7f9fa5a","displayName": "Anywhere365 - EMEA-NEU"}}]}

    NORA-CUS:

    Copy
    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "ab03865a-8f0c-435e-bcee-55d98f72c391","displayName": "Anywhere365 - NORA-CUS"}}]}

    NORA-EU2:

    Copy
    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "5dfb6af5-9d1a-471f-b9ee-29c0ba334470","displayName": "Anywhere365 - NORA-EU2"}}]}

    APAC-SEA:

    Copy
    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "108437ec-1388-43b4-b87c-2f0f7c40b1c9","displayName": "Anywhere365 - APAC-SEA"}}]}

    APAC-AUE:

    Copy
    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "b69d533f-c413-4df6-877d-f3a74a9cfd18","displayName": "Anywhere365 - APAC-AUE"}}]}

  15. Select Run query.

  16. If the result indicates the permissions is created, the Microsoft Entra ID Application now has write permissions to the selected SharePoint Site Collection.

  17. Finally, these write permissions should be upgraded to full control permissions. To do this, collect the permission id from the response of the latest query.

  18. Build the latest query by changing the value of the drop down menu from POST to PATCH and adding the permissions id to the end of the hyperlink.

    Note

    Don't forget to include the " / " (forward slash) between permissions and the permissions id.

  19. Supply the request body as below and select Run query.

  20. If the response is OK and the Response Preview shows the role 'fullcontrol' the patch was successful and AnywhereNow should have permissions to this SharePoint Site Collection.

  21. Take a screenshot of this result to share with your AnywhereNow contact (Professional Service Engineer during project delivery or through an AnywhereNow Support ticket for an operational platform).

  22. If AnywhereNow is setup for multiple SharePoint UCC Sites, please go back to step 13 and follow all subsequent steps for each SharePoint Site.

Apply this new Authentication method to your UCC nodes

Once the AnywhereNow Dialogue Cloud Microsoft Entra ID Enterprise Application for SharePoint has full control access to the SharePoint UCC Site(s) that are used by AnywhereNow, contact your AnywhereNow contact (Professional Service Engineer during project delivery or through an AnywhereNow Support ticket for an operational platform), or your technical delivery partner, to have this authentication method enabled for your UCCs via the OnePortal. See: From Client Id / Client Secret to AppOnly Certificate (the AnywhereNow Dialogue Cloud Enterprise App)