---
title: "Connect Microsoft 365"
canonical: "https://help.callroute.com/space/CKB/2632515589/Connect%20Microsoft%20365"
format: markdown
---
Voice4Teams requires a connection to your **Microsoft 365 tenant** so that Callroute can synchronise your Microsoft 365 users and apply the Microsoft Teams configuration required by the service.

For customers migrating from legacy Voice4Teams, the Microsoft 365 connection is initiated from the **8x8 Admin Console**.

Once the connection has been successfully established, the remaining Voice4Teams migration process is automatic. You do not need to access Callroute or manually start the migration.

## Before you start

The Microsoft 365 user completing the initial authorisation must have the following administrator roles:

- **Teams Administrator**
- **Domain Name Administrator**
- **User Administrator**
- **Application Administrator**

A **Global Administrator** has the required permissions, but Global Administrator is not specifically required. The individual roles above can instead be assigned to the user completing the authorisation.

You will also need to have a **suitable Microsoft 365 licence available** in the tenant. This is temporarily required by Callroute during the Direct Routing setup process.

See **[Microsoft 365 administrator permissions](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2633662476)** for more information.

> ℹ️ **Best practice:** We recommend completing the initial Microsoft 365 authorisation using an administrator account with the required elevated permissions, then switching the ongoing connection to a dedicated service account with only the **Teams Telephony Administrator (TTA)** role.
> ℹ️ 
> ℹ️ This helps ensure the permissions required for ongoing Voice4Teams operation remain in place, even when individual administrator permissions are changed or revoked.
> ℹ️ 
> ℹ️ See **[Best practice – Use a dedicated Microsoft 365 service account](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2632515589/Connect+Microsoft+365#Best-practice-%E2%80%93-Use-a-dedicated-Microsoft-365-service-account)** below.

## Connect Microsoft 365

Start the Microsoft 365 connection from the **8x8 Admin Console** and follow the instructions displayed.

> 📝 ### IMPORTANT: Grant consent on behalf of your organisation
> 📝 
> 📝 During Microsoft 365 authorisation, Microsoft will ask you to approve the permissions required by Callroute.
> 📝 
> 📝 **You must select "Consent on behalf of your organisation" when prompted.**
> 📝 
> 📝 This ensures the required application permissions are granted across your Microsoft 365 organisation, rather than only to the administrator completing the authorisation.
> 📝 
> 📝 **Why is this important?** After Voice4Teams has been deployed, we recommend switching the Microsoft 365 connection to a dedicated service account with the Teams Telephony Administrator (TTA) role. Without organisation-wide consent, this account may receive a **Need admin approval** error when attempting to authorise.

As part of the connection process, Callroute performs a series of **pre-flight checks** before allowing you to continue with the Microsoft 365 authorisation.

These checks are designed to identify configuration, permission or licensing issues that could prevent Voice4Teams from being successfully configured.

Some checks are **mandatory**, while others are **advisory**.

![image-20260923-114139.png](media://223d343b-3652-49d1-9afc-2e97fc8c801b)


## Microsoft 365 pre-flight checks

### Mandatory checks

A mandatory check must pass before you can continue with the Microsoft 365 authorisation.

These checks include:

- **Administrator roles** – confirms that the Microsoft 365 user completing the authorisation has the administrator roles required to establish the connection.
- **Available Microsoft 365 licence** – confirms that there is a suitable free licence available in the tenant.

The available licence is required because Callroute temporarily creates and licenses a Microsoft 365 user as part of the **Microsoft Direct Routing setup process**. This allows Callroute to complete the required domain verification.

The temporary user and licence are used as part of the automated setup process; you do not need to manually perform the domain-verification process.

If a mandatory check fails, you **cannot continue** with the authorisation. Resolve the issue shown and rerun the check.

### Advisory checks

Callroute also performs checks that may identify something you should be aware of but which does not prevent you from continuing.

For example, Callroute checks the availability of a suitable **Microsoft Teams Phone / Phone System licence**.

If none is currently available, Callroute will display an **advisory**.

Unlike a failed mandatory check, an advisory does **not** prevent you from continuing. Review the information provided and continue if appropriate.

### Understanding pre-flight check results

| **Result** | **What it means** | **Can you continue?** |
| --- | --- | --- |
| **Passed** | The requirement has been successfully validated. | **Yes** |
| **Failed** | A mandatory requirement has not been met. | **No.** Resolve the issue and rerun the check. |
| **Advisory** | Callroute has identified something that may require attention but does not prevent setup. | **Yes.** Review the advisory and continue if appropriate. |

Once all mandatory checks have passed, you can continue with the Microsoft 365 authorisation.

## Authorise Microsoft 365

The connection process will redirect you to Microsoft, where you will be asked to sign in and approve the permissions required by Callroute.

Sign in using a Microsoft 365 administrator account with the elevated permissions required for the initial setup.

You can switch the ongoing connection to a dedicated service account with reduced permissions once the Voice4Teams migration has completed.

> 📝 When Microsoft displays the permissions requested by Callroute, review them, **select "Consent on behalf of your organisation"**, and then select **Accept** to continue.
> 📝 
> 📝 **Important:** Organisation-wide consent is required to allow the Microsoft 365 connection to be subsequently reauthorised using a dedicated service account with reduced administrator permissions.

![image-20260923-114254.png](media://c0fbe9d0-759c-4369-9c52-52a88687b421)

> ℹ️ **Important:** Make sure you use the **same Microsoft 365 user throughout the authorisation process**. Switching to a different Microsoft 365 account between authorisation steps can prevent the connection from completing successfully.

Callroute will then perform the required setup in Microsoft 365, including the configuration required to provide Voice4Teams using Microsoft Direct Routing.

## Complete the authorisation

Once Microsoft 365 has been successfully authenticated, you will see a confirmation page.

![upgrade succesful.png](media://28b5fba7-5589-46ae-8b38-47212b6bb90f)

*Example of the confirmation page displayed at the end of the Microsoft 365 authorisation process.*

You can return to the **8x8 Admin Console** immediately or wait to be redirected automatically.

There is **nothing else you need to do to start the migration**.

Once authorisation has completed, your Voice4Teams upgrade is automatically queued for processing. The upgrade will take place during a scheduled migration window, with no further action required to initiate it.

## After Microsoft 365 is connected

Once Microsoft 365 has been successfully authorised, Callroute automatically begins synchronising the information required from your tenant.

For customers migrating from legacy Voice4Teams, the next stages happen **automatically**.

Callroute will:

1. Synchronise the required Microsoft 365 user information.
2. Identify the existing legacy Voice4Teams users and numbers.
3. Validate that the users are ready to migrate.
4. Refresh the identification information immediately before migration.
5. Migrate the whole Voice4Teams tenant to the Callroute-powered service.
6. Apply the required Microsoft Teams routing configuration and Calling Policies.
7. Enable the Callroute registration to the underlying 8x8 service.
8. Once migration has completed successfully, disable the legacy Voice4Teams registration capability.

#### Important – Action following your migration

Following migration, some users may experience issues receiving inbound calls while Microsoft Teams updates its calling configuration.

> ⚠️ **All Microsoft Teams users – Sign out and back in**
> ⚠️ 
> ⚠️ To avoid potential calling issues, we strongly recommend that **ALL** users sign out of Microsoft Teams on ALL devices (including desktop and mobile) and then sign back in.
> ⚠️ 
> ⚠️ <span style="color: #ff5630">**Administrators: Please ensure this instruction is communicated to all Microsoft Teams users following the migration.**</span>

There is no requirement to log in to Callroute or manually trigger any migration stages. The Teams sign-out and sign-in is a recommended post-migration action, not part of the migration process itself.

See **[About the migration](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2633760769)** for more information.

## Ongoing Microsoft 365 connection

The elevated administrator permissions required to establish the initial connection are not all required for normal ongoing operation.

After the connection has been established, the authorised Microsoft 365 user needs to retain either:

- **Teams Administrator**, or
- **Teams Communications Administrator, **or
- **Teams Telephony Administrator** **(TTA)**

> ℹ️ **Important:** The authorised Microsoft 365 account must retain one of the supported administrator roles. If these permissions are removed, ongoing Voice4Teams management operations (Moves, Adds, Changes and Deletes) may stop working until the required permissions are restored.

This allows Callroute to maintain the Microsoft 365 connection and perform ongoing synchronisation.

### Best practice – Use a dedicated Microsoft 365 service account

We strongly recommend using a **dedicated Microsoft 365 service account** for the ongoing Callroute connection.

Although an administrator account with elevated permissions is required for the initial Direct Routing deployment, these elevated permissions are not required for normal ongoing operation.

In many organisations, administrator permissions are subsequently reduced or revoked as part of routine security management. If this happens to the account used for the Callroute connection, ongoing Voice4Teams management operations may stop working.

**Recommended setup**

1. Complete the initial Microsoft 365 authorisation using an administrator account with all the required roles, ensuring **Consent on behalf of your organisation** is selected when approving the Callroute application permissions.
2. **Wait until the Voice4Teams migration has completed successfully **before changing the Microsoft 365 account used for the connection.
3. **Create or identify a dedicated Microsoft 365 service account** with the Teams Telephony Administrator (TTA) role.
4. In Callroute, navigate to **Services > Voice4Teams for Microsoft Teams > Health**.
5. Use the Health Checker to **delete the existing Microsoft 365 authentication tokens**.
6. **Reauthorise the Microsoft 365 connection** using the dedicated service account. Once authorisation is complete, select Check again in the Health Checker to confirm the Microsoft 365 connection is healthy.

> ℹ️ **Receiving "Need admin approval" when switching to a dedicated service account?**
> ℹ️ 
> ℹ️ This may indicate that organisation-wide consent was not granted during the initial Microsoft 365 authorisation.
> ℹ️ 
> ℹ️ To resolve this, reauthorise the Microsoft 365 connection using a Global Administrator, selecting **Consent on behalf of your organisation**. Once completed, delete the authentication tokens again and reauthorise using your dedicated Teams Telephony Administrator (TTA) account.
> ℹ️ 
> ℹ️ See **Troubleshoot Microsoft 365 connection issues** for detailed instructions.

Once reauthorisation is complete, Callroute will use the dedicated service account for ongoing Microsoft 365 synchronisation and management operations.

**Why is this recommended?**

Using a dedicated service account makes it easier to maintain the required permissions on a permanent basis, independently of individual administrators, staff changes or routine permission reviews.

**Important:** The dedicated service account must retain the Teams Telephony Administrator role and remain enabled for as long as Callroute Voice4Teams is in use.

See **[Microsoft 365 user synchronisation](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2633695233)**.

## If the connection later becomes unhealthy

After migration, the health of the Microsoft 365 connection can be viewed in:

**Services > Voice4Teams for Microsoft Teams > Health**

The Health Checker can identify issues such as the authorised Microsoft 365 user being **deleted** or **descoped**.

If a problem is identified, follow the prompts in the Health Checker to restore the connection.

If the connection becomes unhealthy because the authorised account has been deleted or its permissions revoked, restore the required permissions or reauthorise using a dedicated Microsoft 365 service account.

See **[Best practice – Use a dedicated Microsoft 365 service account](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2632515589/Connect+Microsoft+365#Best-practice-%E2%80%93-Use-a-dedicated-Microsoft-365-service-account)** above for instructions on changing the connected account.

See **[Troubleshoot Microsoft 365 connection issues](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2649817091)**