MS Teams Online Meetings Integration with 3rd-Party Apps (MS Graph API)

Field

Details

Document Type

Microsoft Teams Online Meetings Integration with 3rd-Party Apps (MS Graph API)

Applies To

Microsoft Entra ID, App Registraion & Third-Party Application

Audience

MS Teams Administrator / IT Engineer

Author

AK. Udofeh

Last Updated

June 2026
Overview
Overview

This configuration enables a third-party application to create and manage Microsoft Teams online meetings using Microsoft Graph API integration.

The integration is typically used by:

The implementation uses:

This approach allows controlled programmatic creation of Teams meeting links while maintaining governance and restricting which user accounts the application may act on.

This configuration is important because it:

Prerequisites

Licensing

Ensure the following licenses/services are available:

Required Roles

The implementing administrator should have:

Required PowerShell Modules

Install the following PowerShell modules:

Install-Module Microsoft.Graph -Scope CurrentUser
Install-Module MicrosoftTeams -Scope CurrentUser
Required Permissions

The Entra ID application registration will require:

Microsoft Graph Application Permissions
Certificate Authentication (Recommended)

Certificate-based authentication is strongly recommended over client secrets for:

Step 1: Create the Entra ID Application Registration
Navigate to:

Entra Admin Center > Applications > App registrations

Create the Application

Select:

Configure:

Select:

Record the following values

Save:

These values will be required for:

Step 2: Configure API Permissions
Navigate to:

App Registration > API permissions

Add Microsoft Graph Application Permissions

Add:

OR for reduced exposure:

Select:

Validate Permission Status

Ensure all permissions display:

Step 3: Configure Certificate Authentication

Generate Certificate

Run PowerShell:

$cert = New-SelfSignedCertificate `
    -Subject "CN=TeamsMeetingsIntegration" `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -KeySpec Signature `
    -KeyLength 2048 `
    -KeyExportPolicy Exportable `
    -HashAlgorithm SHA256 `
    -NotAfter (Get-Date).AddYears(2)

Export Public Certificate

Export-Certificate `
    -Cert $cert `
    -FilePath "C:\Temp\TeamsMeetingsIntegration.cer"

Upload Certificate to App Registration

Navigate to:
App Registration > Certificates & secrets > Certificates

Upload:

Record Certificate Thumbprint

Run:

$cert.Thumbprint

Save the thumbprint securely.

Step 4: Create the Teams Application Access Policy

Connect to Microsoft Teams PowerShell

Connect-MicrosoftTeams

Create the Policy

New-CsApplicationAccessPolicy `
    -Identity "Tag:TeamsMeetingsIntegration" `
    -AppIds "<ApplicationClientID>" `
    -Description "Restricts Teams meeting creation to approved operator accounts"
Validate Policy Creation
Get-CsApplicationAccessPolicy

Record the exact policy identity name.

Step 5: Assign the Application Access Policy

Purpose

The Application Access Policy controls which user accounts the application may act on when creating Teams meetings using application permissions.

Without this policy:

Assign Policy to Approved Users

Example:

Grant-CsApplicationAccessPolicy `
    -Identity user@domain.com `
    -PolicyName "Tag:TeamsMeetingsIntegration"

Validate Assignment

Get-CsOnlineUser -Identity user@domain.com |
Select UserPrincipalName, ApplicationAccessPolicy

Important Notes

Step 6: Testing / Validation

Start with:

Validate Graph Authentication

Example:

Connect-MgGraph `
    -TenantId "<TenantID>" `
    -ClientId "<ClientID>" `
    -CertificateThumbprint "<Thumbprint>"

Validate Teams PowerShell Authentication

Connect-MicrosoftTeams `
    -TenantId "<TenantID>" `
    -ApplicationId "<ClientID>" `
    -CertificateThumbprint "<Thumbprint>"

Test Meeting Creation Using Postman

Token Endpoint

Use:

Grant type:

client_credentials
Important Distinction

Ensure testing uses:

NOT:

This is critical because:

Test Online Meeting Creation

POST request:

POST https://graph.microsoft.com/v1.0/users/{user-id}/onlineMeetings

Example payload:

{
  "startDateTime": "2026-06-11T10:00:00Z",
  "endDateTime": "2026-06-11T10:30:00Z",
  "subject": "Teams Integration Test",
  "participants": {},
  "lobbyBypassSettings": {
      "scope": "everyone",
      "isDialInBypassEnabled": true
  },
  "allowedPresenters": "everyone"
}
Expected Behaviour
Users WITH policy assignment
Users WITHOUT policy assignment
Step 7: Monitoring & Validation
Entra Sign-In Logs

Navigate to:
Entra Admin Center > Monitoring > Sign-in logs

Review:

Audit Logs

Review:

Teams PowerShell Validation

Validate assigned users:

Get-CsOnlineUser |
Where-Object {
    $_.ApplicationAccessPolicy -eq "Tag:TeamsMeetingsIntegration"
}
Microsoft Graph Monitoring

Monitor:

Step 8: Enforcement / Go-Live

Before Production Rollout

Validate:

Go-Live Activities

Post-Go-Live Monitoring

Pay close attention to:

Important Considerations
Delegated vs Application Authentication

This is one of the most important concepts in this integration.

Delegated Authentication
Application Authentication

Improper testing using delegated authentication can lead to incorrect assumptions about policy enforcement.

Cross-Tenant Meeting Access

External tenant users may:

Summary

This implementation enables secure integration between Microsoft Teams and third-party applications using Microsoft Graph OnlineMeetings APIs.

The solution uses:

The configuration provides:

Proper implementation and testing of Application Access Policies is critical to ensuring the integration operates securely and as intended.

Revision #4
Created 2026-06-11 09:31:57 UTC by AK. Udofeh
Updated 2026-06-11 09:49:44 UTC by AK. Udofeh