Microsoft Teams setup for Pexip CVI

This article explains how to make your environment ready for using Pexip's Cloud Video Interop (CVI) Service for Microsoft Teams. (For information on how to integrate Microsoft Teams with Pexip Infinity, please go here.)

It covers the standard steps for configuring your environment, and the optional additional steps to enable SIP Guest Join.

Configuring your environment

If you are a new customer on the Pexip service and/or you have not already configured your DNS records for the custom calling domain to use, and/or if you have not yet verified your Microsoft 365 domain, then this must be done. Please see Domain hosting DNS records and Verifying Microsoft 365 tenant domains for instructions.

To complete the setup steps below, you must have the Global administrator role in your Office 365 tenant.

  1. After requesting access to the service, you will receive an email asking you to authorize the Pexip CVI application. Click the link Initiate consent for your Tenant link.

  2. This opens a web page where you again need to click on Initiate consent for your Tenant.

    The tenant domain you consent with must be the same Microsoft 365 domain that you have previously verified via a DNS TXT record.

  3. Follow the instructions to log in with your O365 account and then click Accept when prompted.

    1. Sign in.

    2. Accept the request.

      Information about the permissions required by the Pexip CVI app is provided in the following table:

      Permission Details More information
      Read all users' full profiles

      The User.Read.All application permission provides access to properties and permissions for operations listed at https://docs.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0, in particular the methods and properties listed at https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0 that require the User.Read.All permission.

      It is used to:

      • Show the user's UPN (user@domain) instead of GUID in logs for an administrator to know which user was in which call.
      • Display the photo of a user if the user has not started their video.
      • Allow point-to-point call capabilities.
      		 Application permissions: https://docs.microsoft.com/en-us/graph/permissions-reference#application-permissions-38
      Initiate outgoing 1 to 1 calls from the app The Calls.Initiate.All application permission is used to support point-to-point calling scenarios. Calls permissions: https://docs.microsoft.com/en-us/graph/permissions-reference#calls-permissions
      Initiate outgoing group calls from the app The Calls.InitiateGroupCall.All application permission is not currently used. It may be used in the future for creating ad hoc calls (e.g. to implement point-to-point calling scenarios).
      Join group calls and meetings as an app The Calls.JoinGroupCall.All application permission allows VTC devices to join a Teams meeting as a trusted participant (permits lobby bypass).
      Join group calls and meetings as a guest The Calls.JoinGroupCallAsGuest.All application permission allows VTC devices to join a Teams meeting as a guest/untrusted participant.
      Access media streams in a call as an app The Calls.AccessMedia.All application permission is used to access the media streams of participants that are attending a Teams meeting.
      Read online meeting details The OnlineMeetings.Read.All application permission is used to resolve the VTC meeting coordinate from the invite body into a Teams meeting. Online meetings permissions: https://docs.microsoft.com/en-us/graph/permissions-reference#online-meetings-permissions
      Read and create online meetings The OnlineMeetings.ReadWrite application permission is no longer used by the Pexip CVI app.
      Sign in and read user profile The User.Read delegated permission is added by default for Microsoft Entra ID tenant apps, but is not used by the Pexip Teams Connector. User permissions: https://docs.microsoft.com/en-us/graph/permissions-reference#user-permissions
      Any permissions that are not currently used are included in the current consent process as it is not practical to re-consent existing apps as new functionality becomes available via the SDK and/or as we add additional functionality to the Teams Connector itself.

  4. A confirmation page verifies that the consent was successfully provided. On this page, you'll also find a PowerShell script and further instructions. Copy and run the script as described on the page.

    The instructions contained on this page to complete the setup are repeated here for your convenience.

    1. Start a PowerShell session as Administrator and run the following commands:

      Uninstall-Module MicrosoftTeams -AllVersions -Force

      Install-Module MicrosoftTeams -MinimumVersion "4.0.0" -AllowClobber

      (These commands ensure the appropriate MicrosoftTeams module is installed, and that it replaces any existing SkypeOnlineConnector module that may already be installed.)

    2. Run the following commands to sign in to your Teams tenant:

      • In all standard deployments run:

        Import-Module MicrosoftTeams

        Connect-MicrosoftTeams

      • If this is a GCC High / Azure US Government Cloud deployment then use these commands instead:

        Import-Module MicrosoftTeams

        Connect-MicrosoftTeams -TeamsEnvironmentName TeamsGCCH

  5. Create a new video interop service provider with your App ID set as trusted.

    Use the New-CsVideoInteropServiceProvider command as contained in your email as it includes your personalized information.

    To run the command, you need the Global administrator role.

  6. Grant interop for all users or specific individuals.

    During normal rollout we recommend granting access for everyone in the organization (all users in the tenant):

    Grant-CsTeamsVideoInteropServicePolicy -PolicyName PexipServiceProviderEnabled -Global

    During trials you may want to only grant access to selected individuals in your company, by using the -Identity switch instead of -Global, for example:

    Grant-CsTeamsVideoInteropServicePolicy -PolicyName PexipServiceProviderEnabled -Identity "name@pexample.com"

    To grant interoperability to an AD group:

    Grant-CsTeamsVideoInteropServicePolicy -PolicyName PexipServiceProviderEnabled -Group <name of the Azure AD group>

  7. After this, the settings need to propagate and you will receive a final email from us when the service is ready:

  8. You can verify that your domain has been correctly set up here: dns.pexip.com.

Please note:

  • It may take several hours before the new meeting template is displayed.

  • Outlook users: the first time you invite, you may see that the meeting invite does not contain any new information. This is due to Outlook caching the previous meeting information. You therefore need to make two invitations for the new information to appear.

Using SIP Guest Join

Pexip's standard Microsoft Teams interoperability solution allows your own video conferencing endpoints (and your guests) to join Microsoft Teams meetings that you are hosting. The "SIP Guest Join" (SGJ) feature lets you join Microsoft Teams meetings with your own video conferencing endpoints where that meeting is being hosted by an external third-party organization who has not enabled Pexip interoperability themselves.

Note that this is a guest join experience, therefore someone has to be in the Microsoft Teams meeting to admit you from the lobby.

Scope and limitations

This is a Teams commercial focused capability, thus all Teams meetings for Work or School i.e. used by enterprises and most governments in the commercial cloud are supported.

Note that the following are not supported:

  • Teams meetings with "teams.live.com" (part of Teams for Home or Small Business)
  • Teams meetings with "gov.teams.microsoft.us" (part of the Microsoft Government cloud)

Prerequisites

As a prerequisite to enabling Guest Join you must:

  • Enable One-Touch Join — either using One-Touch Join for Pexip Service (controlled via Pexip Control Center) or via a self-hosted Pexip Infinity platform that is dedicated to managing OTJ. See About One-Touch Join for more information.
  • Register your endpoints to the Pexip Service or have the Trusted Devices add-on (this is included in the ERC Premium license bundle).

Enabling guest join

If you are using One-Touch Join for Pexip Service (controlled via Pexip Control Center) then no additional configuration is required — you are automatically able to use the guest join feature.

Using a self-hosted Pexip Infinity platform for OTJ

If you are using a self-hosted Pexip Infinity platform for OTJ, then you need to add a suitable OTJ Meeting Processing Rule to handle invitations to Microsoft Teams meetings (see Adding One-Touch Join meeting processing rules for general details on how to do this).

  1. Add an OTJ Meeting Processing Rule (One-Touch Join > OTJ Meeting Processing rules) with a Meeting type of Microsoft Teams SIP Guest Join.
  2. Save the rule. Your endpoints can now join externally-hosted Teams meetings.

Troubleshooting

This table provides guidance on troubleshooting issues with SIP Guest Join for Teams.

Symptom Possible cause Resolution

An external Microsoft Teams meeting has been scheduled but there is no Join button.

Your Microsoft Exchange environment uses a security application (such as Office 365 ATP, or Mimecast) to re-write URLs, meaning that One-Touch Join could not obtain the join URL. For more information, see Allowing forwarding of external invitations (for Exchange on-premises) or Allowing forwarding of external invitations (for O365).

Ensure that the security application's URL re-write rules include an exception for any URL starting with the domain https://teams.microsoft.com/

More information

These articles provide further details about the CVI interop service and explain how to invite and join a Teams meeting from a video system and Skype for Business:

If you need to remove Pexip's CVI service, see Removing Microsoft Teams CVI.