Configure Compliance Policy and Users

In order to configure Teams to automatically invite the QMS Recording Service bot into a Teams user’s calls, we need to register the bot as an Application Instance with Teams. We also will need to create a compliance recording policy and assign the application instance to the policy. Finally we will need to assign the compliance recording policy to each Teams user that will be recorded by QMS. To do this we will need to execute some powershell commands using the credentials of a Teams tenant administrator. If configuring the QMS Call Recording Service to record multiple Teams Tenants, the steps below will need to be repeated for each Teams Tenant.

Login to Powershell

Before you can execute any of the following commands you will need to import the MicorosoftTeams module into your powershell session.

From a server with the MicrosoftTeams module installed run the following in PowerShell and provide the credentials for the Teams tenant admin account:

Import-Module MicrosoftTeams
$credential = Get-Credential
Connect-MicrosoftTeams -Credential $credential

Create Application Instance

Once the Teams tenant admin account has been logged into the powershell session you can now run commands to manage the Teams environment. To create a new application instance you will run the following powershell command:

New-CsOnlineApplicationInstance -UserPrincipalname <UPN> -DisplayName "<DisplayName>" -ApplicationId <BotAppID>

  • The UPN should be a unique name for the bot. For example if your recording server machine name is QMS-MAIN you could use, qms-main_RecordingBot@myteamsdomain.com

  • The DisplayName should be something informative to describe the recording bot. For example if the recording server name is QMS-MAIN then DisplayName could be "QMS-MAIN Recording Bot"

  • The BotAppID should be the App Id from the Azure Bot creation performed earlier.

Once the Application Instance has been registered the ObjectID for the application instance will be displayed in the powershell window. Save this ObjectID as you will need it later. If you need to retrieve the object ID later you can do so with the following powershell command:

Get-CsOnlineApplicationInstance | Where-Object {$_.DisplayName -eq "<DisplayName>"}

  • The DisplayName should be the same as what was entered for the New-CsOnlineApplicationInstance above.

Next, we need to sync the application instance with the following powershell command:

Sync-CsOnlineApplicationInstance -ObjectId <ObjectID> -ApplicationId <BotAppID>

  • The ObjectID should be the object ID that was returned after executing the New-CsOnlineApplicationInstance described above.

  • The BotAppID should be the App Id from the Azure Bot creation performed earlier.

Create and Configure Compliance Recording Policy

Once the application is registered and synced we need to create a Compliance Recording Policy in Teams by executing the following powershell command:

New-CsTeamsComplianceRecordingPolicy -Tenant <TenantID> -Enabled $true -Description "<PolicyDesc>" -Identity "<PolicyName>"

  • The TenantID should be your Microsoft Teams Tenant ID. (Note: this parameter has been removed in newer versions of the Microsoft Teams Powershell Module)

  • The PolicyDesc should be something informative to describe the policy. For example, "QMS Native Recording for Teams".

  • The PolicyName should be something informative to identify the policy. For example, "QMSTeamsComplianceRecording"

Once the compliance recording policy has been created, if we are setting up a non-HA QMS recording instance, we need to add the application instance to the policy by executing the following powershell command:

New-CsTeamsComplianceRecordingApplication -Tenant <TenantID> -Parent "Tag:<PolicyName>" -Id <ObjectID>

  • The TenantID should be your Microsoft Teams Tenant ID. (Note: this parameter has been removed in newer versions of the Microsoft Teams Powershell Module)

  • The PolicyName should be the same value entered for the New-CsTeamsComplianceRecordingPolicy command described above.

  • The ObjectID should be the object ID that was returned after executing the New-CsOnlineApplicationInstance described above.

If you are setting up a QMS HA pair of recorders you will first need to create a second bot and a second application instance for the second HA recorder. Once that is complete you will need to add the second application instances to the policy by executing the above New-CsTeamsComplianceRecordingApplication powershell command a second time

You can verify that the compliance recording policy has been added and the current settings by executing the following powershell command:

Get-CsTeamsComplianceRecordingPolicy | Where-Object {$_.Identity -eq "Tag:<PolicyName>"}

  • The PolicyName should be the same value entered for the New-CsTeamsComplianceRecordingPolicy command described above.

Once the application has been added to the compliance recording policy, we need to configure the compliance recording application. By default, a compliance recording policy requires the bot to answer and if for any reason the bot is unable to answer calls will fail. We change this behavior to not require the bot to answer before letting a call itself to connect by executing the following powershell command (Note: if you setting up a QMS HA pair of recorders you will run this command for each recorder using the corresponding ObjectID):

Set-CsTeamsComplianceRecordingApplication -Identity "<ApplicationIdentity>" -RequiredBeforeCallEstablishment $false -RequiredDuringCall $false -RequiredBeforeMeetingJoin $false -RequiredDuringMeeting $false

  • The ApplicationIdentity is built based on the PolicyName and ObjectID from the previous commands and takes the form "Tag:<PolicyName>/<ObjectID>". For example, if your PolicyName is "QMSTeamsComplianceRecording" and your ObjectID is "dd833e27-c980-49eb-a4e8-9f72ca5bd954" then your ApplicationIdentity would be "Tag:QMSTeamsComplianceRecording/dd833e27-c980-49eb-a4e8-9f72ca5bd954"

Grant Compliance Recording Policy to Teams Users

After setting up the compliance recording policy, we now need to grant the policy to the Teams users that QMS will be monitoring. You can grant the recording policy to a single user by executing the following powershell command (can take several minutes to be applied):

Grant-CsTeamsComplianceRecordingPolicy -Identity <TeamsUserIdentity> -PolicyName "<PolicyName>"

  • The TeamsUserIdentity should be the Teams user’s Universal Principal Name, which by convention is typically the Office 365 username/email address. For example user@domain.com.

  • The PolicyName should be the same value entered for the New-CsTeamsComplianceRecordingPolicy command described above.

You can also grant the policy to an entire department by executing the following powershell command (can take several minutes to be applied):

Get-CsOnlineUser -Filter {Department -eq "<DepartmentName>"} | Grant-CsTeamsComplianceRecordingPolicy -PolicyName <PolicyName>

  • The DepartmentName

You can verify what users have been granted the compliance recording policy by executing the following powershell command:

Get-CsOnlineUser | Where-Object {$_.TeamsComplianceRecordingPolicy -like "<PolicyName>"} | Select UserPrincipalName

  • The PolicyName should be the same value entered for the New-CsTeamsComplianceRecordingPolicy command described above.

You can revoke the policy from a single user by executing the following powershell command:

Grant-CsTeamsComplianceRecordingPolicy -Identity <TeamsUserIdentity> -PolicyName $null

  • The TeamsUserIdentity should be the Teams user’s Universal Principal Name, which by convention is typically the Office 365 username/email address. For example user@domain.com.

Disable And Enable Compliance Recording Policy

There is a known limitation with Teams where long delays in call setup for compliance recording Teams users can occur if all of the QMS Call Recording Services for the compliance policy have been shut down. The most common case for this would be during maintenance windows that occur during periods of time where live calls are taken by compliance recording users. These delays can be avoided by temporarily disabling the compliance recording policy during outages.

You can disable the compliance recording policy as a whole by executing the following powershell command:

Set-CsTeamsComplianceRecordingPolicy -Identity <PolicyName> -Enabled $false

  • The PolicyName should be the same value entered for the New-CsTeamsComplianceRecordingPolicy command described previously.

You can then re-enable the compliance recording policy by executing the following powershell command:

Set-CsTeamsComplianceRecordingPolicy -Identity <PolicyName> -Enabled $true

  • The PolicyName should be the same value entered for the New-CsTeamsComplianceRecordingPolicy command described previously.