SharePoint Online Authentication for Anywhere 365 Dialogue Cloud Azure AD App-Only

Azure AD App-Only is Microsoft's preferred model to grant an application access to SharePoint Online. This article describes the steps that are required to enable this authentication method for Anywhere365 Dialogue Cloud to access your SharePoint Online, once you have created your UCC A Unified Contact Center, or UCC, is a queue of interactions (voice, email, IM, etc.) that are handled by Agents. Each UCC has its own settings, IVR menus and Agents. Agents can belong to one or several UCCs and can have multiple skills (competencies). A UCC can be visualized as a contact center “micro service”. Customers can utilize one UCC (e.g. a global helpdesk), a few UCC’s (e.g. for each department or regional office) or hundreds of UCC’s (e.g. for each bed at a hospital). They are interconnected and can all be managed from one central location. SharePoint sites and Site Collections.

Note: For a similar method using your own Azure AD App to create Anywhere365 UCC Site Collections and Sites please refer to the Ucc.Creator installation manual on Anywhere365 SharePoint UCC Site Creator

Summary

Authentication consists of the following three steps:

Grant consent to the Anywhere365 Dialogue Cloud Azure AD Application.
Configure permissions for this Azure AD App on one or more specific SharePoint Site Collections.
Apply this Authentication Method to your UCCs.

Detailed Steps

Step 2: Configure permissions to selected SharePoint Site Collections

Once consent is granted to the Azure AD Application for your Microsoft 365 tenant, the Azure AD Application still requires permissions to the SharePoint Site Collections that are used by your Anywhere365 UCC's.

It is essential to grant full control permissions in order to allow Anywhere365 to perform all required operations, such as retrieving settings, uploading voicemails and recordings, etc.

Note: Please note that Microsoft Graph Explorer uses Delegated Permissions. It is therefore essential for the administrator executing the requests to have Site Collection Administrator permissions to the Site Collection used by Anywhere365.

There are multiple ways to grant these permissions. Below are the manual steps (25 steps) to be taken using Microsoft Graph Explorer.

Tip: An alternative method is to use a Powershell script described here, Learn More or use a method or tool you already may be familiar with.

To configure SharePoint Site Collection permissions

Open the Microsoft Graph Explorer in your browser (https://developer.microsoft.com/en-us/graph/graph-explorer)
Click the Sign in button and sign in using a Microsoft 365 administrator account (Global Administrator, Application Administrator or Cloud Application Administrator) that has Site Collection Administrator permissions for the Site Collections used by Anywhere365.
If this is the first time you sign in to Graph Explorer, you will be prompted to accept the requested permissions. Select Accept to continue.
After successfully signing in, your name will appear in the bar.

In the Query Builder, select Modify permissions (Preview).
In the blue drop down menu, change GET to POST (it will turn from blue to green).
Select the Open the permissions panel.
Using the List (Sites > Sites.FullControl.All) or the search field, select Sites.FullControl.All and click Consent at the bottom of the pane.
If these permissions have not yet been granted to Graph Explorer, the Permissions requested screen will appear. Select Accept to the requested permissions.
The permissions panel will now that Sites.FullControl.All has been consented.
Close the Permissions pane.
In the drop down menu, change POST back to GET. and change the value for the hyperlink from
```
https://graph.microsoft.com/v1.0/me 
```
to
```
https://graph.microsoft.com/v1.0/sites/<tenantname>.sharepoint.com:/<sites>/<sitecollectionname>
```
Note: There is a " : "(colon) between the host name and the relative path to the site collection.
Select Run query to request the details from this specific SharePoint Site Collection.
From the response collect the SharePoint Site Collection id (the GUID GUID stands for Globally Unique Identifier and is a pseudo random number used in software applications that is assumed to be unique. The total number of unique keys (2<sup>128</sup> of 3.4028×10<sup>38</sup>) is very large and the probability of the creating the same GUID twice is very small, though not 100% guaranteed. of the middle section of the id; between the two commas).
In the query builder replace the host name and relative path to the site collection with the SharePoint Site Collection id and select Run query again. You should get the same as in the previous query.
Compose a new query to grant the Azure AD Application write permissions to this SharePoint Site Collection, by changing the value of the drop down menu from to POST and by adding '/permissions' to the end of the hyperlink.
Click Request body.

Supply below request body (matching the regional Azure AD Application that you want to grant access) in the field that opens.
EMEA:

Copy

Request Body

{
    "roles": [
        "write"
    ],
    "grantedToIdentities": [
        {
            "application": {
                "id": "18efff03-033a-4f27-beb6-ee7d4a6a4fab",
                "displayName": "Anywhere365 - EMEA"
            }
        }
    ]
}

NORA:

Copy

Request Body

{
    "roles": [
        "write"
    ],
    "grantedToIdentities": [
        {
            "application": {
                "id": "ab03865a-8f0c-435e-bcee-55d98f72c391",
                "displayName": "Anywhere365 - NORA"
            }
        }
    ]
}

APAC:

Copy

Request Body

{
    "roles": [
        "write"
    ],
    "grantedToIdentities": [
        {
            "application": {
                "id": "108437ec-1388-43b4-b87c-2f0f7c40b1c9",
                "displayName": "Anywhere365 - APAC"
            }
        }
    ]
}

Select Run query.
If the result indicates the permissions is created, the Azure AD Application now has write permissions to the selected SharePoint Site Collection.
Finally, these write permissions should be upgraded to full control permissions. To do this, collect the permission id from the response of the latest query.
Build the latest query by changing the value of the drop down menu from POST to PATCH and adding the permissions id to the end of the hyperlink.
Note: Don't forget to include the " / " (forward slash) between permissions and the permissions id.
Supply the request body as below and select Run query.
If the response is OK and the Response Preview shows the role 'fullcontrol' the patch was successful and Anywhere365 should have permissions to this SharePoint Site Collection.
Take a screenshot of this result to share with your Customer Success Manager.
If Anywhere365 is setup for multiple SharePoint Site Collections, please go back to step 13 and follow all subsequent steps for each SharePoint Site Collection.

SharePoint Online Authentication for Anywhere 365 Dialogue Cloud Azure AD App-Only

Summary

Detailed Steps

To grant Azure AD application consent

To configure SharePoint Site Collection permissions

Apply this authentication method to your UCC nodes