---
title: "Microsoft 365 administrator permissions"
canonical: "https://help.callroute.com/space/CKB/2633662476/Microsoft%20365%20administrator%20permissions"
format: markdown
---
Voice4Teams requires access to your Microsoft 365 tenant to configure and manage the Microsoft Teams components used by the service.

Different Microsoft administrator permissions are required when **initially connecting Microsoft 365** and for **ongoing operation**.

## Permissions required for initial authorisation

The Microsoft 365 user completing the initial Voice4Teams authorisation must have the following administrator roles:

- **Teams Administrator**
- **Domain Name Administrator**
- **User Administrator**
- **Application Administrator**

A **Global Administrator** has the required permissions, but the Global Administrator role is **not specifically required**.

Instead, the four roles above can be assigned to the user completing the initial authorisation.

These elevated permissions are required to establish and authorise the connection between Voice4Teams and Microsoft 365.

### Grant consent on behalf of your organisation

During initial Microsoft 365 authorisation, the administrator must select **Consent on behalf of your organisation** when approving the permissions requested by Callroute.

This grants the required application permissions across your Microsoft 365 organisation rather than only to the administrator completing the authorisation.

**Important:** Without organisation-wide consent, switching the connection to a dedicated service account with reduced administrator permissions may result in a **Need admin approval** error.

See [Connect Microsoft 365](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2632515589) for the complete authorisation procedure.


> ⚠️ ## IMPORTANT: Permissions required after authorisation
> ⚠️ 
> ⚠️ Once the initial Microsoft 365 deployment has completed successfully, the connected user does not need to retain all of the elevated administrator roles required during initial authorisation.
> ⚠️ 
> ⚠️ For ongoing Voice4Teams operation, the connected user must retain either:
> ⚠️ 
> ⚠️ - **Teams Administrator**, or
> ⚠️ - **Teams Communications Administrator, **or
> ⚠️ - **Teams Telephony Administrator** **(TTA)**
> ⚠️ 
> ⚠️ These permissions allow Callroute to maintain the connection and perform the Microsoft Teams operations required by Voice4Teams.

## Using a dedicated service account

We recommend using a **dedicated Microsoft 365 service account** for the ongoing Voice4Teams connection.

The initial Microsoft 365 authorisation should be completed using an administrator account with the elevated roles required for deployment, ensuring **Consent on behalf of your organisation** is selected.

Once the Voice4Teams migration has completed successfully, the connection can be switched to a dedicated service account with the **Teams Telephony Administrator (TTA)** role.

This avoids relying on an individual administrator account whose permissions may subsequently be changed or revoked.

To switch accounts, use the **Health Checker** to delete the existing Microsoft 365 authentication tokens and reauthorise using the dedicated service account.

After reauthorisation, select **Check again** to confirm the connection is healthy.

See **[Connect Microsoft 365](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2632515589)** for detailed instructions.

## What happens after authorisation?

For customers migrating from the legacy Voice4Teams service, completing the Microsoft 365 authorisation is the final customer action required to start the migration.

Once authorisation has completed successfully, Callroute automatically synchronises the required Microsoft 365 information, identifies and validates the existing Voice4Teams users, and proceeds with the migration when the required checks have completed successfully.

You do not need to sign in to Callroute or manually start the migration.

For more information, see **[Connect Microsoft 365](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2632515589)** and **[Migrate from legacy Voice4Teams](https://callroute.atlassian.net/wiki/spaces/CKB/pages/2633465862)**.

> ⚠️ **Important – maintain the required Microsoft 365 permissions**
> ⚠️ 
> ⚠️ If the connected Microsoft 365 account is removed, disabled, or **descoped below the required permissions**, Voice4Teams may continue to handle existing calls, but Callroute will no longer be able to make or manage changes in Microsoft Teams.
> ⚠️ 
> ⚠️ Callroute monitors the connected account's permissions through the **Health Checker** and will report the service as **Unhealthy** if the required administrator role is no longer present.

## More information

For a detailed explanation of the Microsoft permissions used by Callroute, see [M](https://help.callroute.com/space/CKB/2776137730/Microsoft+Graph+Permissions+Overview)**[icrosoft Permissions Deep Dive](https://help.callroute.com/space/CKB/2776137730/Microsoft+Graph+Permissions+Overview)****.**