> For the complete documentation index, see [llms.txt](https://kb.mago.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kb.mago.io/mago/requirements/third-party-providers/microsoft-365.md).

# Microsoft 365

## How add the Mago enterprise application in your Microsoft 365 tenant and grant admin consent

When using Mago with Microsoft 365 room resources and users, the Mago app for display and Mago mobile app access Microsoft 365 services through the Microsoft Graph and Azure Communication Services APIs. To enable these features, a tenant administrator must grant consent to the Mago enterprise application.

{% hint style="success" %}
Mago is a verified enterprise application in the **Microsoft Entra app gallery** (application ID `17781659-6867-4c77-9ba3-40670305181c)` and it is listed under the official **Azure Marketplace** (see <https://marketplace.microsoft.com/nb-no/product/saas/aad.valarea?tab=overview>).
{% endhint %}

{% stepper %}
{% step %}

### Add the Mago application to your tenant

Open [admin.mago.io](https://admin.mago.io/) and sign in with a Microsoft 365 account that has **Global Administrator**, **Application Administrator**, or **Cloud Application Administrator privileges**. When prompted, review the requested permissions and select "Accept" on behalf of your organization. The Mago application is now registered in your tenant.

<figure><img src="/files/zYDsjC6FpYfqqvHKspyf" alt="" width="375"><figcaption><p>Mago Admin Center (https://admin.mago.io)</p></figcaption></figure>

<figure><img src="/files/pZDSSpiZNi1BvrBgggSw" alt="" width="375"><figcaption><p>Mago app Permission Request</p></figcaption></figure>
{% endstep %}

{% step %}

### Grant admin consent to the required scopes

To review and grant admin consent to the required scopes in the Mago application permissions:

* Open the [**Azure portal**](https://portal.azure.com/) and sign in with a Microsoft 365 Administrator account.
* Go to Microsoft Entra ID > Enterprise Applications (or search directly for "**Enterprise Applications**").

<figure><img src="/files/fbkeFIefBSuxKz3Zripn" alt=""><figcaption></figcaption></figure>

* Under the Application list, search for "**Mago**" (Application ID `17781659-6867-4c77-9ba3-40670305181c`).

<figure><img src="/files/6n1ZFExh43Mn61i3ZanR" alt=""><figcaption></figcaption></figure>

* Enter the Mago application, go to **Security** > **Permissions** and verify that admin consent has been granted to the required scopes. To grant admin consent to all the required scopes, click the "Grant admin consent for *YourCompanyName*" button.

<figure><img src="/files/HAUOhfV9oMhJEHxje7O7" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## Advanced consent options

Below are the official Microsoft guides to grant consent to the Mago app in different ways.

### Tenant-wide consent

{% embed url="<https://learn.microsoft.com/azure/active-directory/manage-apps/grant-admin-consent>" %}

### Single user consent

{% embed url="<https://learn.microsoft.com/entra/identity/enterprise-apps/grant-consent-single-user?pivots=msgraph-powershell>" %}

### Microsoft Intune

In case the device is managed through **Microsoft Intune**, check the app access policies in the Intune settings and allow access to the "Mago" app. Refer to the following guide:

{% embed url="<https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent?pivots=portal>" %}

## Required features and scopes

### Permissions requested by the Mago room app

All permissions are **delegated** permissions, granted on behalf of the Microsoft 365 account linked to the room. Mago requests no application (app only) permissions, so the room can never access data the linked account cannot already access.

Permissions are requested **per capability**. When an administrator enables a capability in the Mago console, the consent screen carries only that capability's scopes. Capabilities left disabled are never requested.

Every capability includes the baseline scopes `openid`, `profile` and `offline_access`.

#### Capabilities and their scopes

<table><thead><tr><th width="165.3984375">Capability</th><th width="184.75">Mago Admin Center</th><th width="231.59765625">Additional scopes</th><th>API</th></tr></thead><tbody><tr><td><strong>Account connection</strong></td><td>"Connect"</td><td><p><code>User.ReadBasic.All</code> <code>Calendars.ReadWrite</code></p><p><code>Mail.Read</code></p><p><code>Mail.Send</code></p></td><td>Graph</td></tr><tr><td><strong>Calendar</strong></td><td>"Calendar"</td><td><p><code>User.ReadBasic.All</code></p><p><code>Calendars.ReadWrite</code></p><p><code>Mail.Read</code></p><p><code>Mail.Send</code></p></td><td>Graph</td></tr><tr><td><strong>Join with connected account (*)</strong></td><td>"Join meetings using the connected account"</td><td><p><code>Teams.ManageCalls</code></p><p><code>Teams.ManageChats</code></p></td><td>Azure Communication Services</td></tr><tr><td><strong>Instant meetings</strong></td><td>"Enable instant meetings"</td><td><p><code>User.ReadBasic.All</code></p><p><code>OnlineMeetings.ReadWrite</code></p></td><td>Graph</td></tr><tr><td><strong>Meeting chat</strong></td><td>"Enable chat"</td><td><p><code>User.ReadBasic.All</code></p><p><code>Chat.ReadWrite</code></p><p><code>ChatMessage.Send</code></p></td><td>Graph</td></tr><tr><td><strong>Join by ID and passcode</strong></td><td>"Join meetings via ID and Passcode"</td><td>none, no account required</td><td>—</td></tr></tbody></table>

(\*) "Join meetings using the connected account" must be enabled before "Enable instant meetings" and "Enable chat", and disabling it also disables both. It requires the linked account to hold a Teams license (see [Licensing requirements](/mago/requirements/video-conferencing/licensing-requirements.md)).

#### What each scope is used for

<table data-search="false"><thead><tr><th width="236.80859375">Scope</th><th>Purpose</th></tr></thead><tbody><tr><td><code>openid</code>, <code>profile</code></td><td>Sign in with the room account and read its name and email address</td></tr><tr><td><code>offline_access</code></td><td>Keep the room signed in without an administrator reauthorizing it every 60 minutes</td></tr><tr><td><code>Calendars.ReadWrite</code></td><td>Read the room agenda to display upcoming meetings, create the event when a meeting is booked from the room, write the join link into the event, extend the event when a meeting runs longer than scheduled, and release the room when a meeting ends early</td></tr><tr><td><code>Mail.Read</code></td><td>Read invitation messages in the room mailbox to recover the meeting join link. This runs as part of the ordinary calendar refresh: for the events in the displayed time window the room also reads the matching invitation, because a forwarded or accepted invitation frequently carries the join link only in the mail body and not in the calendar item</td></tr><tr><td><code>Mail.Send</code></td><td>Send meeting material and invitations from the room account</td></tr><tr><td><code>User.ReadBasic.All</code></td><td>Look up participants in the organization directory when inviting them to a meeting, and resolve participant names and addresses in the call roster. Reads basic directory profile data only, never mailbox content</td></tr><tr><td><code>OnlineMeetings.ReadWrite</code></td><td>Create an ad hoc Teams meeting when an instant meeting is started from the room</td></tr><tr><td><p><code>Chat.ReadWrite</code></p><p><code>ChatMessage.Send</code></p></td><td>Read and send messages in the chat of the meeting in progress</td></tr><tr><td><p><code>Teams.ManageCalls</code></p><p><code>Teams.ManageChats</code></p></td><td>Azure Communication Services scopes: Join Teams meetings as the connected account</td></tr></tbody></table>

#### Notes for administrators

* Connecting the Microsoft 365 account already consents to the calendar and mail scopes, before any individual capability is enabled.
* At runtime the room's access token carries every scope consented for the Mago application, not only those of the capability in use. The per capability separation applies at consent time.
* Disabling a capability in the Mago console updates the Mago configuration only. It does not revoke the consent or the refresh token, which must be revoked in Microsoft Entra ID.
* **Mago Whiteboard for Windows (version <= 7.5)** additionally uses `Files.ReadWrite.All` and `User.Read` to open and save whiteboard recaps and session documents on OneDrive and SharePoint document libraries.
* A room calendar can also be connected through **Microsoft Exchange on premises** (EWS with a service account), which requires no OAuth scopes at all.

### Permissions requested by the Mago mobile app (iOS / Android)

All permissions are **delegated** permissions, granted on behalf of the signed in Microsoft 365 user. The app requests them **incrementally**: each scope is requested when the user first uses the capability that needs it, not all at sign in.

<table><thead><tr><th width="220.54296875">Capability</th><th width="211.00390625">Scope</th><th>API</th></tr></thead><tbody><tr><td>Sign in</td><td><code>User.Read</code></td><td>Graph</td></tr><tr><td>Personal calendar</td><td><code>Calendars.ReadWrite</code></td><td>Graph</td></tr><tr><td>OneDrive files</td><td><code>Files.ReadWrite.All</code></td><td>Graph</td></tr><tr><td>SharePoint document libraries</td><td><code>Sites.Read.All</code></td><td>Graph</td></tr><tr><td>Join Teams meetings</td><td><p><code>Teams.ManageCalls</code></p><p><code>Teams.ManageChats</code></p></td><td>Azure Communication Services</td></tr></tbody></table>

<table><thead><tr><th width="243.421875">Scope</th><th>Purpose</th></tr></thead><tbody><tr><td><code>User.Read</code></td><td>Sign in and read the signed in user's own profile</td></tr><tr><td><code>Calendars.ReadWrite</code></td><td>Read the user's calendar to list meetings, and create or update an event when a meeting is booked from the app</td></tr><tr><td><code>Files.ReadWrite.All</code></td><td>Browse, open, import and save documents on the user's OneDrive</td></tr><tr><td><code>Sites.Read.All</code></td><td>Browse and open documents in SharePoint document libraries the user can access</td></tr><tr><td><p><code>Teams.ManageCalls</code></p><p><code>Teams.ManageChats</code></p></td><td>Join Teams meetings and take part in the meeting chat as the signed in user</td></tr></tbody></table>