# Microsoft 365

## How add the Mago enterprise application in your Microsoft 365 tenant and grant admin consent

When using Mago with Microsoft 365 room resources and users, the Mago app for display and Mago mobile app access Microsoft 365 services through the Microsoft Graph and Azure Communication Services APIs. To enable these features, a tenant administrator must grant consent to the Mago enterprise application.

{% hint style="success" %}
Mago is a verified enterprise application in the **Microsoft Entra app gallery** (application ID `17781659-6867-4c77-9ba3-40670305181c)` and it is listed under the official **Azure Marketplace** (see <https://marketplace.microsoft.com/nb-no/product/saas/aad.valarea?tab=overview>).
{% endhint %}

{% stepper %}
{% step %}

### Add the Mago application to your tenant

Open [admin.mago.io](https://admin.mago.io/) and sign in with a Microsoft 365 account that has **Global Administrator**, **Application Administrator**, or **Cloud Application Administrator privileges**. When prompted, review the requested permissions and select "Accept" on behalf of your organization. The Mago application is now registered in your tenant.

<figure><img src="https://2978719120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2FbpP2hYI1Myy7hMs_%2Fuploads%2FSBktWH6jXKKddXFxxkng%2Fmago-admin-center-signin.jpg?alt=media&#x26;token=c43b0523-dd1e-41c8-ad4f-3128de74f9f6" alt="" width="375"><figcaption><p>Mago Admin Center (https://admin.mago.io)</p></figcaption></figure>

<figure><img src="https://2978719120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2FbpP2hYI1Myy7hMs_%2Fuploads%2FN9mgBPd1TFeHfU552urg%2Fmago-admin-consent.webp?alt=media&#x26;token=e5c8903b-50cf-4b05-a05d-8cfe473e7949" alt="" width="375"><figcaption><p>Mago app Permission Request</p></figcaption></figure>
{% endstep %}

{% step %}

### Grant admin consent to the required scopes

To review and grant admin consent to the required scopes in the Mago application permissions:

* Open the [**Azure portal**](https://portal.azure.com/) and sign in with a Microsoft 365 Administrator account.
* Go to Microsoft Entra ID > Enterprise Applications (or search directly for "**Enterprise Applications**").

<figure><img src="https://2978719120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2FbpP2hYI1Myy7hMs_%2Fuploads%2FiBdqVUpQpQSLQNL4Bkj2%2Fenterprise-apps.webp?alt=media&#x26;token=bb4655ed-312c-4e3f-b80f-c39eb9fc2b96" alt=""><figcaption></figcaption></figure>

* Under the Application list, search for "**Mago**" (Application ID `17781659-6867-4c77-9ba3-40670305181c`).

<figure><img src="https://2978719120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2FbpP2hYI1Myy7hMs_%2Fuploads%2FWFi1wmwO2BlhLbgwTSM2%2Fenterprise-apps-mago.webp?alt=media&#x26;token=d07d68d8-774a-43d5-af96-76624b67bc67" alt=""><figcaption></figcaption></figure>

* Enter the Mago application, go to **Security** > **Permissions** and verify that admin consent has been granted to the required scopes. To grant admin consent to all the required scopes, click the "Grant admin consent for *YourCompanyName*" button.

<figure><img src="https://2978719120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2FbpP2hYI1Myy7hMs_%2Fuploads%2F5Hql2RRyQEziNdUZfP4Z%2Fenterprise-apps-mago-grant.webp?alt=media&#x26;token=d6b8ad4b-6d29-468c-b84f-0830557e8703" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## Advanced consent options

Below are the official Microsoft guides to grant consent to the Mago app in different ways.

### Tenant-wide consent

{% embed url="<https://learn.microsoft.com/azure/active-directory/manage-apps/grant-admin-consent>" %}

### Single user consent

{% embed url="<https://learn.microsoft.com/entra/identity/enterprise-apps/grant-consent-single-user?pivots=msgraph-powershell>" %}

### Microsoft Intune

In case the device is managed through **Microsoft Intune**, check the app access policies in the Intune settings and allow access to the "Mago" app. Refer to the following guide:

{% embed url="<https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent?pivots=portal>" %}

## Required features and scopes

| Mago – Feature                                                                                                                                                    | Required Scope Permissions                                                                                                        |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Log in with room account and view room name and email address                                                                                                     | <p><code>openid</code></p><p><code>profile</code></p>                                                                             |
| Select the room calendar to list upcoming meetings on the display                                                                                                 | <p><code>Calendars.Read</code></p><p><code>Calendars.Read.Shared</code></p>                                                       |
| Support meeting access from more than 15 video conferencing systems by analyzing join URLs included in invitation messages in the room account inbox              | `Mail.Read`                                                                                                                       |
| Create a new instant meeting as a Host and book the room calendar                                                                                                 | <p><code>Calendars.ReadWrite</code></p><p><code>Calendars.ReadWrite.Shared</code></p><p><code>OnlineMeetings.ReadWrite</code></p> |
| Search for Azure directory contacts to add recipients to meeting invitations                                                                                      | `User.Read`                                                                                                                       |
| Use the meeting room inbox to send: meeting invitations, Mago Workspace objects (e.g. imported images or files, PDF meeting summaries), room status notifications | `Mail.Send`                                                                                                                       |
| Maintain access without an administrator reauthorizing room access every 60 minutes                                                                               | `offline_access`                                                                                                                  |
| Browse, import, open and view cloud storage files (OneDrive) during a Mago Workspace or Mago Stage session (file presentation)                                    | `Files.ReadWrite.All`                                                                                                             |
| Browse, import, and view cloud storage files (SharePoint Sites) during a Mago Stage session (file presentation)                                                   | `Sites.Read.All`                                                                                                                  |
| Manage calls in Teams meetings                                                                                                                                    | `Teams.ManageCalls`                                                                                                               |
| Manage chats in Teams meetings                                                                                                                                    | <p><code>Teams.ManageChats</code><br><code>Chat.ReadWrite</code><br><code>ChatMessage.Send</code></p>                             |

| Mago mobile app - Feature                                                                                                                            | Required Scope Permissions                                                                                                  |
| ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Sign in to Mago Workspace using a personal Microsoft 365 account, view your account name and email address                                           | <p><code>openid</code></p><p><code>profile</code></p>                                                                       |
| Choose a personal calendar to list your personal meetings in the app and start them in the meeting room                                              | <p><code>Calendars.Read</code></p><p><code>Calendars.Read.Shared</code></p>                                                 |
| Support meeting access from more than 15 video conferencing systems by analyzing join URLs included in invitation messages in the room account inbox | `Mail.Read`                                                                                                                 |
| Create a new instant meeting as a Host and book the room calendar                                                                                    | <p><code>Calendars.ReadWrite</code><br><code>Calendars.ReadWrite.Shared</code><br><code>OnlineMeetings.ReadWrite</code></p> |
| Search for Azure directory contacts to add recipients to meeting invitations                                                                         | `User.Read`                                                                                                                 |
| Use the meeting room inbox to send: meeting invitations, Mago Workspace objects (e.g. imported images or files, PDF summaries of meetings)           | `Mail.Send`                                                                                                                 |
| Maintain access without having to reauthorize the app every 60 minutes or if it goes into the background                                             | `offline_access`                                                                                                            |
| Browse, import, open and view cloud storage files (OneDrive) during a Mago Workspace or Mago Stage session (file presentation)                       | `Files.ReadWrite.All`                                                                                                       |
| Browse, import, and view cloud storage files (SharePoint Sites) during a Mago Stage session (file presentation)                                      | `Sites.Read.All`                                                                                                            |