Provision a service account for Live Hub

Live Hub manages your Teams tenant through a dedicated service account. Provisioning it takes four steps, the last of which is optional:

1. Create the service account.
2. Assign it administrator roles.
3. Exclude it from conditional access rules that force re-authentication.
4. Configure it as an admin consents reviewer, but only if you skipped the Application Administrator role.

Create the service account

The service account is an ordinary Microsoft 365 user, created without a product license.

To create a service account for Live Hub:

1. Open the Microsoft 365 Admin Center.

2. Sign in as a user with the Customer Administrator or Global Administrator role.

3. In the Navigation pane, select Users > Active Users, and then click Add a User.

   

4. In the Add a user > Basics pane:

   1. In the 'Display name' field, enter Live Hub.
   2. In the 'Username' field, enter livehub.
   3. Clear the 'Require this user to change password when they first sign in' check box.
   4. Click Next.

   

5. In the Product licenses pane, select Create user without product license, and then click Next.

   

6. In the Optional settings pane, click Next.

7. In the Finish pane, click Finish adding.

8. Click Show to reveal the generated password, and then write down the username and password.

   

Assign administrator roles

The service account needs the roles in the following table. Some of them are needed only while the tenant and Teams connections are being established, and can be removed afterwards.

Role	Type	Why
Skype for Business Administrator	mandatory	Normal Live Hub operation.
Teams Communication Administrator	mandatory	Normal Live Hub operation.
Application Administrator	recommended	Establishing the tenant connection; can be removed afterwards. Instead of granting it, you can make the account an admin consents reviewer.
Domain Name Administrator	mandatory	Adding the Teams connection; can be removed afterwards.
User Administrator	mandatory	Adding the Teams connection; can be removed afterwards.

To assign the roles:

1. Open the Azure portal.

2. Sign in as a user with a Customer Admin role, such as Global Administrator.

3. Search for Entra ID, and then open the Microsoft Entra ID screen.

4. In the Navigation pane, select Users.

   

5. Search for livehub, and then select the Live Hub service account.

   

6. In the Navigation pane, select Assigned roles, and then click Add assignments.

   

7. Select the roles from the table above, and then click Add.

8. Click Refresh, and then check that every role is assigned and Active.

   

Exclude the service account from conditional access re-authentication

If a conditional access policy requires users to reauthenticate periodically, it invalidates the Live Hub access token. To prevent connection failures, exclude the Live Hub service account from any policy that enforces periodic reauthentication.

To exclude the service account:

1. On the Microsoft Entra ID screen, in the Navigation pane, select Enterprise applications. You can also reach it by searching the Azure portal for Enterprise applications.

   

2. In the Navigation pane, select Conditional Access.

   

3. Open each configured policy in turn.

   

4. Check whether Access controls > Sessions sets either Sign in frequency or Persistent browser session.

   

5. If it does, add the Live Hub service account to the policy's exclusions, under Users.

   

Make the service account an admin consents reviewer

Complete this step only if you did not assign the Application Administrator role to the service account.

To configure the account as an admin consents reviewer:

1. On the Microsoft Entra ID screen, in the Navigation pane, select Enterprise applications.

   

2. In the Navigation pane, select Consent and permissions.

   

3. Select Admin consent settings, and then:

   1. Set Admin consent requests to Yes.
   2. Under Reviewers, click Add user, and then select the Live Hub service account.
   3. Click Save.