Register a Microsoft Graph Application

The Teams meeting pipeline reads meeting transcripts, recordings, and related artifacts from Microsoft Graph using app-only (daemon) authentication — no user sign-in, no interactive consent per meeting. That requires an Azure AD application registration with admin-consented application permissions.

This guide walks through:

1. Creating the app registration
2. Creating a client secret
3. Granting the Graph API permissions the pipeline needs
4. Admin-consenting those permissions
5. (Optional) Scoping the app to specific users with an Application Access Policy

You need tenant admin rights (or an admin to grant consent on your behalf) to finish this. Bookmark the values you collect — they go into ~/.hermes/.env at the end.

• A Microsoft 365 tenant with Teams Premium or Teams licenses that produce meeting transcripts and recordings
• Admin access to the Azure portal at entra.microsoft.com ↗
• A publicly reachable HTTPS endpoint for Graph change notifications (set up later, in the webhook listener step)

1. Sign in to entra.microsoft.com ↗ as a tenant admin.
2. Navigate to Identity → Applications → App registrations.
3. Click New registration.
4. Fill in:
5. Name: Hermes Teams Meeting Pipeline (or any name you'll recognize).
6. Supported account types: Accounts in this organizational directory only (Single tenant).
7. Redirect URI: leave blank — app-only auth does not need one.
8. Click Register.

You'll land on the app's overview page. Copy two values:

• Application (client) ID → MSGRAPH_CLIENT_ID
• Directory (tenant) ID → MSGRAPH_TENANT_ID

1. In the left nav, open Certificates & secrets.
2. Click New client secret.
3. Description: hermes-graph-secret. Expires: pick a value that matches your rotation policy (6-24 months is typical).
4. Click Add.
5. Copy the Value column immediately — it's only shown once. That value is MSGRAPH_CLIENT_SECRET.

The Secret ID column is not the secret. You want the Value column.

The pipeline uses a minimum-viable set of application permissions. Add only what you need; each one widens what the app can read tenant-wide.

1. In the left nav, open API permissions.
2. Click Add a permission → Microsoft Graph → Application permissions.
3. Add the permissions from the table below that match what you want the pipeline to do.
4. After adding, click Grant admin consent for <your tenant>. The Status column should flip to a green checkmark for every permission.

Required for transcript-first summaries

Required for recording fallback (when a transcript is unavailable)

Required for outbound summary delivery (Graph mode only)

If platforms.teams.extra.delivery_mode is graph, the pipeline posts summaries into a Teams channel or chat via the Graph API. Skip these if you use incoming_webhook delivery mode instead.

Not recommended

• OnlineMeetings.ReadWrite.All / Chat.ReadWrite without .All — broader than the pipeline needs.
• Delegated permissions — the pipeline uses app-only (client-credentials) flow; delegated permissions won't work without user sign-in.

By default, application permissions like OnlineMeetings.Read.All grant the app access to every meeting in the tenant. For partner demos and dev tenants that's fine; for production you almost certainly want to restrict which users' meetings the app can read.

Microsoft provides Application Access Policies for Teams exactly for this. The policy is a PowerShell-only surface; there's no portal UI for it.

From an admin PowerShell with the MicrosoftTeams module installed and connected (Connect-MicrosoftTeams):

# Create a policy scoped to the Hermes app
New-CsApplicationAccessPolicy `
  -Identity "Hermes-Meeting-Pipeline-Policy" `
  -AppIds "<MSGRAPH_CLIENT_ID>" `
  -Description "Restrict Hermes meeting pipeline to allow-listed users"

# Grant the policy to specific users whose meetings the pipeline may read
Grant-CsApplicationAccessPolicy `
  -PolicyName "Hermes-Meeting-Pipeline-Policy" `
  -Identity "alice@example.com"

Grant-CsApplicationAccessPolicy `
  -PolicyName "Hermes-Meeting-Pipeline-Policy" `
  -Identity "bob@example.com"

Propagation can take up to 30 minutes after granting. Verify with:

Test-CsApplicationAccessPolicy -Identity "alice@example.com" -AppId "<MSGRAPH_CLIENT_ID>"

Without the policy, any user's meetings are readable — that's what the permission technically grants. Don't skip this step on a production tenant.

Put the three values you collected into ~/.hermes/.env:

MSGRAPH_TENANT_ID=<directory-tenant-id>
MSGRAPH_CLIENT_ID=<application-client-id>
MSGRAPH_CLIENT_SECRET=<client-secret-value>

Set file permissions so only you can read the secret:

chmod 600 ~/.hermes/.env

Hermes ships a Graph auth smoke-test. From your Hermes install:

python -c "

from tools.microsoft_graph_auth import MicrosoftGraphTokenProvider
provider = MicrosoftGraphTokenProvider.from_env()
token = asyncio.run(provider.get_access_token())
print('Token acquired, length:', len(token))
print(provider.inspect_token_health())
"

A successful run prints a long token string and a health dict showing cached: True and an expires_in_seconds value near 3600. Failures produce a MicrosoftGraphTokenError with the Azure error code — the most common are:

Azure client secrets have a hard expiry. Before yours expires:

1. Create a second client secret in step 2 without deleting the first one.
2. Update MSGRAPH_CLIENT_SECRET in ~/.hermes/.env with the new value.
3. Restart the gateway so the new secret is picked up: hermes gateway restart.
4. Verify with the smoke test above.
5. Delete the old secret from the Azure portal.

Once credentials verify cleanly, continue with:

• Webhook listener setup — stand up the msgraph_webhook gateway platform that receives Graph change notifications.
• Pipeline configuration — configure the Teams meeting pipeline runtime and operator CLI.
• Outbound delivery — wire summaries back into a Teams channel or chat.

Those pages land alongside the PRs that add the corresponding runtime. This credentials setup is a standalone prerequisite and is safe to complete in advance.