Microsoft 365
How add the Mago enterprise application in your Microsoft 365 tenant and grant admin consent
When using Mago with Microsoft 365 room resources and users, the Mago app for display and Mago mobile app access Microsoft 365 services through the Microsoft Graph and Azure Communication Services APIs. To enable these features, a tenant administrator must grant consent to the Mago enterprise application.
Mago is a verified enterprise application in the Microsoft Entra app gallery (application ID 17781659-6867-4c77-9ba3-40670305181c) and it is listed under the official Azure Marketplace (see https://marketplace.microsoft.com/nb-no/product/saas/aad.valarea?tab=overview).
Add the Mago application to your tenant
Open admin.mago.io and sign in with a Microsoft 365 account that has Global Administrator, Application Administrator, or Cloud Application Administrator privileges. When prompted, review the requested permissions and select "Accept" on behalf of your organization. The Mago application is now registered in your tenant.
Grant admin consent to the required scopes
To review and grant admin consent to the required scopes in the Mago application permissions:
Open the Azure portal and sign in with a Microsoft 365 Administrator account.
Go to Microsoft Entra ID > Enterprise Applications (or search directly for "Enterprise Applications").
Under the Application list, search for "Mago" (Application ID
17781659-6867-4c77-9ba3-40670305181c).
Enter the Mago application, go to Security > Permissions and verify that admin consent has been granted to the required scopes. To grant admin consent to all the required scopes, click the "Grant admin consent for YourCompanyName" button.
Advanced consent options
Below are the official Microsoft guides to grant consent to the Mago app in different ways.
Tenant-wide consent
Single user consent
Microsoft Intune
In case the device is managed through Microsoft Intune, check the app access policies in the Intune settings and allow access to the "Mago" app. Refer to the following guide:
Required features and scopes
Permissions requested by the Mago room app
All permissions are delegated permissions, granted on behalf of the Microsoft 365 account linked to the room. Mago requests no application (app only) permissions, so the room can never access data the linked account cannot already access.
Permissions are requested per capability. When an administrator enables a capability in the Mago console, the consent screen carries only that capability's scopes. Capabilities left disabled are never requested.
Every capability includes the baseline scopes openid, profile and offline_access.
Capabilities and their scopes
Account connection
"Connect"
User.ReadBasic.All Calendars.ReadWrite
Mail.Read
Mail.Send
Graph
Calendar
"Calendar"
User.ReadBasic.All
Calendars.ReadWrite
Mail.Read
Mail.Send
Graph
Join with connected account (*)
"Join meetings using the connected account"
Teams.ManageCalls
Teams.ManageChats
Azure Communication Services
Instant meetings
"Enable instant meetings"
User.ReadBasic.All
OnlineMeetings.ReadWrite
Graph
Meeting chat
"Enable chat"
User.ReadBasic.All
Chat.ReadWrite
ChatMessage.Send
Graph
Join by ID and passcode
"Join meetings via ID and Passcode"
none, no account required
—
(*) "Join meetings using the connected account" must be enabled before "Enable instant meetings" and "Enable chat", and disabling it also disables both. It requires the linked account to hold a Teams license (see Licensing requirements).
What each scope is used for
openid, profile
Sign in with the room account and read its name and email address
offline_access
Keep the room signed in without an administrator reauthorizing it every 60 minutes
Calendars.ReadWrite
Read the room agenda to display upcoming meetings, create the event when a meeting is booked from the room, write the join link into the event, extend the event when a meeting runs longer than scheduled, and release the room when a meeting ends early
Mail.Read
Read invitation messages in the room mailbox to recover the meeting join link. This runs as part of the ordinary calendar refresh: for the events in the displayed time window the room also reads the matching invitation, because a forwarded or accepted invitation frequently carries the join link only in the mail body and not in the calendar item
Mail.Send
Send meeting material and invitations from the room account
User.ReadBasic.All
Look up participants in the organization directory when inviting them to a meeting, and resolve participant names and addresses in the call roster. Reads basic directory profile data only, never mailbox content
OnlineMeetings.ReadWrite
Create an ad hoc Teams meeting when an instant meeting is started from the room
Chat.ReadWrite
ChatMessage.Send
Read and send messages in the chat of the meeting in progress
Teams.ManageCalls
Teams.ManageChats
Azure Communication Services scopes: Join Teams meetings as the connected account
Notes for administrators
Connecting the Microsoft 365 account already consents to the calendar and mail scopes, before any individual capability is enabled.
At runtime the room's access token carries every scope consented for the Mago application, not only those of the capability in use. The per capability separation applies at consent time.
Disabling a capability in the Mago console updates the Mago configuration only. It does not revoke the consent or the refresh token, which must be revoked in Microsoft Entra ID.
Mago Whiteboard for Windows (version <= 7.5) additionally uses
Files.ReadWrite.AllandUser.Readto open and save whiteboard recaps and session documents on OneDrive and SharePoint document libraries.A room calendar can also be connected through Microsoft Exchange on premises (EWS with a service account), which requires no OAuth scopes at all.
Permissions requested by the Mago mobile app (iOS / Android)
All permissions are delegated permissions, granted on behalf of the signed in Microsoft 365 user. The app requests them incrementally: each scope is requested when the user first uses the capability that needs it, not all at sign in.
Sign in
User.Read
Graph
Personal calendar
Calendars.ReadWrite
Graph
OneDrive files
Files.ReadWrite.All
Graph
SharePoint document libraries
Sites.Read.All
Graph
Join Teams meetings
Teams.ManageCalls
Teams.ManageChats
Azure Communication Services
User.Read
Sign in and read the signed in user's own profile
Calendars.ReadWrite
Read the user's calendar to list meetings, and create or update an event when a meeting is booked from the app
Files.ReadWrite.All
Browse, open, import and save documents on the user's OneDrive
Sites.Read.All
Browse and open documents in SharePoint document libraries the user can access
Teams.ManageCalls
Teams.ManageChats
Join Teams meetings and take part in the meeting chat as the signed in user