> For the complete documentation index, see [llms.txt](https://kb.mago.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kb.mago.io/mago/requirements/video-conferencing/authenticated-calls/authenticated-calls-with-microsoft-teams.md).

# Authenticated Calls with Microsoft Teams

## Prerequisites

{% hint style="warning" %}
**An active Azure subscription is required.**\
Registering the Azure Communication Services (ACS) service principal in your tenant only works if the tenant has an **active Azure subscription** linked. If you don't have one, create/activate a subscription in the [Azure portal](https://portal.azure.com/) before proceeding. Otherwise the service principal creation will fail.

If your tenant doesn't have one, follow the official Microsoft guide to create it: <https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription>
{% endhint %}

You will also need:

* **Global Administrator** (or Privileged Role Administrator) rights on the Microsoft 365 tenant
* Your **Tenant ID** (Entra ID → Overview)
* PowerShell 5.1 or PowerShell 7+

## Requirements

To enable authenticated calls with Microsoft Teams, the following prerequisites must be met.

{% stepper %}
{% step %}

### Azure Communication Services service principal

Microsoft Teams interoperability for third party applications relies on **Azure Communication Services (ACS)**.

To allow authenticated calls, the Microsoft tenant must contain the **Azure Communication Services service principal**. This component allows applications to authenticate Teams identities and join meetings through the Microsoft communication APIs.

#### 🔍︎ Check if the Azure Communication Services service principal is installed

An administrator can verify whether the ACS service principal already exists in the tenant.

1. Sign in to the [Azure portal](https://portal.azure.com/)
2. Go to Microsoft Entra ID > Enterprise Applications > **All Applications**

<figure><img src="/files/fbkeFIefBSuxKz3Zripn" alt=""><figcaption></figcaption></figure>

3. Clear any filters that may be applied

<figure><img src="/files/VLNFF0vvYjPPdpthGfbb" alt=""><figcaption></figcaption></figure>

4. In the search field, search for "Azure Communication Services"

<figure><img src="/files/RAcDIUJVtlYlv9cHRKJf" alt=""><figcaption></figcaption></figure>

If the application appears in the list, the **ACS service principal is already installed** and no further action is required.

If the application does not appear in the list, follow the next steps to **proceed with the installation**.

#### ✅ Installing the Azure Communication Services service principal

If the ACS service principal is not present in the tenant, it must be created by an administrator.

#### Step 1. Open PowerShell

Open the Azure Portal and start a PowerShell session with administrative privileges.

<figure><img src="/files/01GmaLz0Qj3KZrYX6fVT" alt=""><figcaption></figcaption></figure>

#### Step 2. Install the Microsoft Graph module (if not already installed)

```
Install-Module Microsoft.Graph -Scope CurrentUser
```

#### Step 3. Connect to your tenant

Replace `TENANT_ID` with your tenant ID. Find your tenant ID [here](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView).

```
Connect-MgGraph -TenantId "TENANT_ID" -Scopes "Application.ReadWrite.All"
```

A Microsoft authentication URL or window will appear where the administrator must sign in.

#### Step 4. Create the Azure Communication Services service principal

Run the following command:

```
New-AzureADServicePrincipal -AppId "1fd5118e-2576-4263-8130-9503064c837a"
```

This registers the **Azure Communication Services service principal** in the tenant and enables authenticated Teams calls for supported applications.

#### (Optional) Using Azure CLI instead

If you prefer not to install PowerShell modules, you can achieve the same with the Azure CLI:

```
az login --tenant TENANT_ID
az ad sp create --id 1fd5118e-2576-4263-8130-9503064c837a
```

{% endstep %}

{% step %}

### Microsoft Teams license

An account with an active Microsoft Teams license is required in order to authenticate and join Teams meetings. The specific license type depends on the organization’s Microsoft 365 subscription.
{% endstep %}
{% endstepper %}

## Setup scenarios

<figure><img src="/files/7f6Gxi0FeyXZodocxW9j" alt=""><figcaption></figcaption></figure>

## When authentication is not configured

If authentication is not enabled, Mago can still join meetings as a guest participant.

In this scenario:

• the system may enter the meeting lobby\
• the participant appears as a generic device name\
• some meeting features may behave differently depending on the host organization’s policies