Dialogue Cloud Microsoft Entra ID Enterprise Applications

Warning

The description in this article is not for creating new sites, only for granting consent to Dialogue Cloud for accessing sites you should have already created.

For creating new Dialogue Cloud UCC Sites you can use your own created App and certificate. Please refer to the steps on:
UCC Site Creator (Modernized) - Overview & Prerequisites

Microsoft  AppOnly is Microsoft's only model to grant an application access to SharePoint Online. This article describes the steps that are required, after you have created your SharePoint UCC Sites, to enable this authentication method for Dialogue Cloud to access your SharePoint Online.

Note

As of DC2025.01 we will be providing support for Azure Secure Vault services (configurable through ) to allow storage of authentication credentials more securely. We will leverage this same Enterprise Application as an access consent to your selected Secure Vaults. Also see: Secure Vault

Summary

Authentication consists of the following three steps:

  1. Grant consent to a regional Dialogue Cloud Microsoft Entra ID Enterprise Application.
  2. Set permissions for this consented Enterprise App for all your UCC SharePoint Sites (PowerShell script available).
  3. Have this new authentication method applied to your UCCs (via OnePortal).

Detailed Steps

Step 1: Granting consent to the Dialogue Cloud Microsoft Entra ID Enterprise App

To make it possible for our Microsoft Entra ID Enterprise Application to connect to one or more of your SharePoint Site Collections (and possibly other future selected services), it should be trusted by your organization. There is a different Microsoft Entra ID Enterprise App in each of our eight Data-center regions, please grant consent to the application of the region in which your UCCs are currently hosted. If you have UCCs in multiple regions, please grant consent to each corresponding regional Microsoft Entra ID Application.

To grant consent to the Microsoft Entra ID Enterprise Application

  1. Select the hyperlink that applies to your installation:

    2. The Microsoft 365 sign in form will appear.

    Microsoft Office365 sign in screen capture

  2. Sign in with a Microsoft 365 administrator account that has the necessary authorizations to grant tenant-wide consent. Users authorized to consent on behalf of an organization include:

    • Global Administrator or Privileged Role Administrator for granting consent for apps requesting any permission, for any API.
    • Application Administrator or Cloud Application Administrator for granting consent for apps requesting any permission, for any API.
    • A custom directory role that includes the permission to grant permissions to applications, for the permissions required by the application.

    Warning

    These administrator roles are not users who are only SharePoint Administrators. These roles cannot grant tenant-wide consent.

    3. After successfully signing in, the Permissions requested window appears, listing the permissions that need to be accepted (i.e. Access selected site collections and Sign in and read user profile).

    Permissions requested screen

    Note

    The Dialogue Cloud Microsoft Entra ID Enterprise App will only be able to access selected SharePoint Sites (formerly known as site collections).

  3. Click the "Accept" button. You will be redirected to the AnywhereNow corporate website (https://www.anywhere.now/)

  4. Open the Azure Portal (https://portal.azure.com/) and sign in using a Microsoft administrator account (Global Administrator, Application Administrator or Cloud Application Administrator).

  5. In the search bar on Microsoft Azure portal the main page, search for and select Enterprise Applications. A list of all Enterprise Applications in your organization will appear.

  6. Find the application for the region whose permissions you want to set by using the following name or Application IDs:

    • emea-weu-p-sharepoint: 18efff03-033a-4f27-beb6-ee7d4a6a4fab
    • emea-gwc-p-sharepoint: b087e5fb-3463-46b7-a74d-047a9dee095d
    • emea-neu-p-sharepoint: 103e3a4b-b13e-47a8-b998-d496e7f9fa5a
    • emea-szn-p-sharepoint: f39e70b7-f075-4f1b-adde-5db2e55efabe
    • nora-cus-p-sharepoint: ab03865a-8f0c-435e-bcee-55d98f72c391
    • nora-eu2-p-sharepoint: 5dfb6af5-9d1a-471f-b9ee-29c0ba334470
    • apac-sea-p-sharepoint: 108437ec-1388-43b4-b87c-2f0f7c40b1c9
    • apac-aue-p-sharepoint: b69d533f-c413-4df6-877d-f3a74a9cfd18
    • You can use filters to find the correct application.

  7. Click on the desired application's name. The overview pane for that application will appear.

  8. Select Permissions from the left menu. A list of Applications along with their permissions parameters will appear. Office 365 SharePoint Online should appear in this list with the "Claim value" set to Sites.Selected, and "Granted through" set to Admin consent

Step 2: Configure permissions to selected SharePoint Site Collections

Once consent is granted to the Enterprise Application for your Microsoft 365 tenant, the Enterprise Application still requires permissions to the SharePoint sites (previously known as Site Collections) that are used by your AnywhereNow UCCs.

It is essential to grant full control permissions to these Site Collections in order to allow Dialogue Cloud to perform all required operations, such as retrieving settings, uploading voicemails and recordings, etc.

There are three ways to grant these permissions.

1. Using a convenient PowerShell script (preferred and advised):

For a script which eases the below steps for multiple UCC sites see our dedicated instructions page on:
Granting permission to Multiple Sites - PowerShell Script

2. Using PnP PowerShell for one SharePoint site

For a single SharePoint site, use the PnP Entra ID App Site Permission cmdlets to grant the regional AnywhereNow application FullControl access to the site.

Connect to the customer SharePoint Online site using an account or application with sufficient SharePoint Administrator permissions. Then run the following command.

Note

Change the -AppId value based on the AnywhereNow region for your deployment. The example below uses the Application ID for the EMEA-GWC region. The Application IDs for all regions are listed in Step 1.

PowerShell
Grant-PnPEntraIDAppSitePermission `
  -AppId "b087e5fb-3463-46b7-a74d-047a9dee095d" `
  -DisplayName "AnywhereNow-Regional-SharePoint-App" `
  -Site "https://CUSTOMER-NAME.sharepoint.com/sites/YOUR-UCC-HERE" `
  -Permissions FullControl

This grants the regional AnywhereNow application FullControl access to the specified SharePoint site. The command is intended for applications using the Sites.Selected permission model.

Validate assigned permissions

To verify the application permissions assigned to the SharePoint site, run:

PowerShell
Get-PnPEntraIDAppSitePermission `
  -Site "https://CUSTOMER-NAME.sharepoint.com/sites/YOUR-UCC-HERE"

This returns the Entra ID applications that have been granted permissions on the specified site, together with their assigned roles.

Note

Older deployment documentation may reference Grant-PnPAzureADAppSitePermission and Get-PnPAzureADAppSitePermission. Use Grant-PnPEntraIDAppSitePermission and Get-PnPEntraIDAppSitePermission instead.

3. To manually configure SharePoint Site Collection permissions

Note

Microsoft Graph Explorer uses Delegated Permissions. It is therefore essential for the administrator executing the requests to have Site Collection Administrator permissions to the Site Collection used by Anywhere365.

the manual steps (25 steps) to be taken, using Microsoft Graph Explorer:

  1. Open the Microsoft Graph Explorer in your browser (https://developer.microsoft.com/en-us/graph/graph-explorer)

  2. Click the Sign in button and sign in using a Microsoft 365 administrator account (Global Administrator, Application Administrator or Cloud Application Administrator) that has Site Collection Administrator permissions for the Site Collections used by AnywhereNow.

  3. If this is the first time you sign in to Graph Explorer, you will be prompted to accept the requested permissions. Select Accept to continue.

    After successfully signing in, your name will appear in the bar.

  1. In the Query Builder, select Modify permissions (Preview).

  2. In the blue drop down menu, change GET to POST (it will turn from blue to green).


  3. Select the Open the permissions panel.

  4. Using the List (Sites > Sites.FullControl.All) or the search field, select Sites.FullControl.All and click Consent at the bottom of the pane.

  5. If these permissions have not yet been granted to Graph Explorer, the Permissions requested screen will appear. Select Accept to the requested permissions.

  6. The permissions panel will now that Sites.FullControl.All has been consented.

  7. Close the Permissions pane.

  8. In the drop down menu, change POST back to GET. and change the value for the hyperlink from

    https://graph.microsoft.com/v1.0/me

    to

    https://graph.microsoft.com/v1.0/sites/<tenantname>.sharepoint.com:/<sites>/<sitecollectionname>

    Note

    There is a " : "(colon) between the host name and the relative path to the site collection.

  9. Select Run query to request the details from this specific SharePoint Site Collection.

  10. From the response collect the SharePoint Site Collection id (the of the middle section of the id; between the two commas).

  11. In the query builder replace the host name and relative path to the site collection with the SharePoint Site Collection id and select Run query again. You should get the same as in the previous query.

  12. Compose a new query to grant the Microsoft Entra ID Application write permissions to this SharePoint Site Collection, by changing the value of the drop down menu from to POST and by adding '/permissions' to the end of the hyperlink.


  13. Click Request body.

  14. Supply below request body (matching the regional Microsoft Entra ID Application that you want to grant access) in the field that opens.

    EMEA-WEU:

    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "18efff03-033a-4f27-beb6-ee7d4a6a4fab","displayName": "Anywhere365 - EMEA-WEU"}}]}

    EMEA-GWC

    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "b087e5fb-3463-46b7-a74d-047a9dee095d","displayName": "Anywhere365 - EMEA-GWC"}}]}

    EMEA-NEU

    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "103e3a4b-b13e-47a8-b998-d496e7f9fa5a","displayName": "Anywhere365 - EMEA-NEU"}}]}

    NORA-CUS:

    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "ab03865a-8f0c-435e-bcee-55d98f72c391","displayName": "Anywhere365 - NORA-CUS"}}]}

    NORA-EU2:

    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "5dfb6af5-9d1a-471f-b9ee-29c0ba334470","displayName": "Anywhere365 - NORA-EU2"}}]}

    APAC-SEA:

    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "108437ec-1388-43b4-b87c-2f0f7c40b1c9","displayName": "Anywhere365 - APAC-SEA"}}]}

    APAC-AUE:

    Request Body
    {"roles": ["write"],"grantedToIdentities": [{"application": {"id": "b69d533f-c413-4df6-877d-f3a74a9cfd18","displayName": "Anywhere365 - APAC-AUE"}}]}

  15. Select Run query.

  16. If the result indicates the permissions is created, the Microsoft Entra ID Application now has write permissions to the selected SharePoint Site Collection.

  17. Finally, these write permissions should be upgraded to full control permissions. To do this, collect the permission id from the response of the latest query.

  18. Build the latest query by changing the value of the drop down menu from POST to PATCH and adding the permissions id to the end of the hyperlink.

    Note

    Don't forget to include the " / " (forward slash) between permissions and the permissions id.

  19. Supply the request body as below and select Run query.

  20. If the response is OK and the Response Preview shows the role 'fullcontrol' the patch was successful and AnywhereNow should have permissions to this SharePoint Site Collection.

  21. Take a screenshot of this result to share with your AnywhereNow contact (Professional Service Engineer during project delivery or through an AnywhereNow Support ticket for an operational platform).

  22. If AnywhereNow is setup for multiple SharePoint UCC Sites, please go back to step 13 and follow all subsequent steps for each SharePoint Site.

Step 3: Have this Authentication method applied for the UCCs running in Dialogue Cloud

Apply this new Authentication method to your UCC nodes

Once the AnywhereNow Dialogue Cloud Microsoft Entra ID Enterprise Application for SharePoint has full control access to the SharePoint UCC Site(s) that are used by Dialogue Cloud, contact your AnywhereNow contact (Professional Service Engineer during project delivery or through an AnywhereNow Support ticket for an operational platform), or your technical delivery Partner, to have this authentication method enabled for your UCCs via the OnePortal. See: From Client Id / Client Secret to AppOnly/Certificate (the AnywhereNow Dialogue Cloud Enterprise App)