Secure Connection using Delegated Token

If the customer purchased a Hosted Essentials Plus or Hosted Pro license then they must grant consent to the Service Provider or Channel administrator for accessing their M365 platform. The consent is secured using Token authentication between the Live Platform and the customer M365 tenant. The Token connection is initially established through a Token wizard using the credentials of the customer Azure account. Once the Token connection is securely established, the account credentials can be used to create the new customer and then in Day Two for synchronizing the Live Platform database with their M365 platform. For example, configuration of M365 Voice Routing templates or retrieving a list pf new employees added to the customer Active Directory. The Token Invitation wizard is used for establishing the Token connection with the customer M365 platform.

The Token connection should be secured using a customer-defined M365 Azure Service account. Using this method, the following Microsoft Graph API permissions must be consented by the customer:

■

openid: Access directory as the signed in user

■

profile:Read all users' full profiles

The Delegated Token connection should be secured using a Service account, requiring the following:

■

Create Customer Service Account: Create a Service account to be used for Onboarding and Background Synchronization

■

Assign Administrator Roles to Service Account: Assign Admin Roles to Service account

■

Setup Admin Consent Workflow Permissions: Setup Admin Consent Workflow permissions

Once this setup is performed, then at the start of the Onboarding wizard, you trigger an email that is sent to the customer M365 Service account which includes a link to the Invitation wizard.

■

Run Invitation wizard using Delegated Token: Run the Token Invitation wizard with the Service account