Register a Microsoft Graph Application for Teams Meetings

A Teams meeting pipeline can read transcripts and recordings through Microsoft Graph without asking a user to sign in for every meeting. That app-only model requires a single-tenant Microsoft Entra application, admin-consented application permissions, and a deliberate user scope.

Grant only the required access

Create an app registration with no redirect URI, then record its tenant and client identifiers. Create a client secret whose expiry matches the organization's rotation policy; copy the secret value once and protect it. For transcript-first summaries, grant only the meeting metadata and transcript permissions. Add recording or outbound-message permissions only when those functions are actually enabled.

Application permissions can read across a tenant by default. In production, use a Teams Application Access Policy to restrict the app to approved meeting organizers. This policy is managed through MicrosoftTeams PowerShell and may take time to propagate.

Registration checklist

• Create a single-tenant Entra app registration.
• Leave redirect URI blank for app-only authentication.
• Copy the secret value, not its identifier.
• Add only required Microsoft Graph application permissions.
• Obtain tenant-admin consent.
• Restrict production access with an Application Access Policy.
• Schedule secret rotation before expiration.

Pitfalls

Delegated permissions do not satisfy a daemon flow. A token can be issued even when the later Graph call lacks required consent, so token acquisition alone is not end-to-end proof. Removing an old client secret before the new one is deployed creates an outage. Application Access Policies can take up to 30 minutes to propagate. Never print a bearer token or secret in a wiki, screenshot, or support report.

Verification steps

1. Acquire a token using the configured tenant, client, and secret values without printing the token.
2. Inspect token health and expected expiration only.
3. Call the narrowest required Graph endpoint for one approved organizer.
4. Confirm an unapproved organizer is denied after policy propagation.
5. Create a second secret, switch the runtime, restart, and verify before deleting the old secret.
6. Verify webhook and outbound-delivery permissions separately.

Follow the official Microsoft Graph application registration guide for current permission names, admin-consent steps, access-policy commands, and rotation guidance.