Booking System Preparation - Advanced M365

This article will cover preparing M365 using Graph APIs for and scoped permissions for Humly Control Panel integration.

Scoped Application Permissions (Advanced)

This section will prepare Microsoft Entra for the Humly Control Panel. First, you need to register a custom application. This process can be done from the Microsoft Entra admin center or PowerShell. We will go through the setup using the Entra Admin Center in the next steps below. If you prefer to do everything from PowerShell, skip everything and head to PowerShell.

Here is the process flow of creating the application, creating the needed groups, and assigning the required permissions
 

 

1. Log in to the Microsoft Entra admin center. To register an HCP application in Azure, click on App Registration to open the application registration blade, then click New Registration.

2. Select the name for your application and click Register

 

3. Once the application is created, the summary page should appear; make a note of the Application (client) ID and Directory (tenant) ID, as it will be needed later when connecting the Humly Control Panel to Microsoft 365

 

4. Go to Enterprise Apps section, search the app you created in the previous steps (Register an application), go to its properties and Object ID from there (this is different from the object id from “App Registration” page). 
Save this as “Object Id” for use with Exchange PowerShell in the coming steps. 

5. SSO Setup 

If you want to allow login using single sign on SSO, you should whitelist your Humly Control Panel URL in the application, you can do this by heading to Authentication, then click  Add a platform and select Single-page application. Type in your cloud URL or on-prem URL followed by /sso/redirect, and click Configure. examples below 

6. Configure Client secret by clicking on Certificates &, secrets then click New client secret, enter the description you want in the newly opened blade, and set the expiry as per the policy you have. Please note that the secret should be valid for HCP to work, once expired, meetings from Microsoft to Humly control panel will stop syncing so you will have to replace the expired client secret with a new one and reauthenticate once again to Microsoft.

7. Go to the App registration and select API permissions setting and click the Add a permission button, then select Microsoft Graph

8. In the permission selection page, select Application Permission, which will open the list of permissions for application access. Search for and check mark User.Read.All and click add permission.

Repeat the same step again, search for and check mark Group.Read.All then click add permissions.

 

 

Resources and Senders Groups

In this section, we will create two Mail Enabled Security Groups or Microsoft 365 groups in the Microsoft Entra admin center. The first group is for all resources (Rooms, Desks, and Parking spaces) that we want to allow to be added to the Humly Control Panel. The second group is for the account that can send email notifications related to the Humly Control Panel functions. If you prefer to do everything from PowerShell, skip this section and head to PowerShell. 

 

1. Create a Resources Group: The example below shows how to create your Mail-Enabled Security Group.
In the Exchange Admin Center, select groups and click Add Group.

 

Choose Mail-Enabled Security for the group type, and click next.

 

Add a group name of your choice, and optionally add some description. Then click next.

 

Assign a group owner; the owner could be any account. Click next

 

Add members to the group, which could be a room, desk, and/or parking resources.

 

The group is created and ready to be used.

 

 

2. Now that the group is created and the resources have been added, go to Microsoft Entra

 

Find the group you created by searching for its name. Copy the resource group Object ID. This object ID will be used later in the service principle creation section.

 

 

 

3. Create Senders Group: Repeat the previous two steps, but instead of adding resources, add the users you want to use in the Humly Control Panel for sending email notifications. One user should be enough, but you can add more if you want. 

 

Collect the Object ID for the Senders group as well, it will be needed later in the service principle creation section.

 

Application Role Based Access Control

In this section, we will create a service principle and assign the permissions to the groups we have created in the previous section.

1. Connect to Exchange Online

Set-ExecutionPolicy RemoteSigned

Replace the <UPN> by the office global admin account, an example below:

Connect-ExchangeOnline -UserPrincipalName support@humly.dev

2. Create a service principle by doing the below cmdlet, replace the AppId by the application ID you have created in this step  . And replace the AppObjectId by the object ID from this step , the application name can be any name you prefer.

New-ServicePrincipal -AppId <<AppId>> -ObjectId <<AppObjectId>> -DisplayName "Some Display Name"

3. Create a management role assignment for the resources group, replace the AppId by the application ID you have created in this step . Replace the CalendarObjectID by the calendars group object ID which you have created in this step

New-ManagementRoleAssignment -App <<AppObjectId>> -Role "Application Calendars.ReadWrite"  -RecipientGroupScope <<CalendarObjectID>>

4. Create a management role assignment for the senders group, replace the AppId by the application ID you have created in this step . Replace the SenderObjectID by the senders group object ID you have created in this step.

New-ManagementRoleAssignment -App <<AppObjectId>> -Role "Application Mail.Send" -RecipientGroupScope <<SenderObjectID>>

Now you should be able to proceed to the next step of installing and configuring Humly Control Panel