---
title: "Pre-requisites and Security Considerations"
canonical: "https://help.callroute.com/space/CKB/698843188/Pre-requisites%20and%20Security%20Considerations"
format: markdown
---
Further reading and explanations for requirements can be found on these pages:

> Macro (children)

![How To Connect Your Microsoft Teams Tenants To Callroute.mp4](media://7b270a97-0b15-4451-a1d0-baa7b07e6cb3)


## Understanding how the connection to your Microsoft tenant works

**Applies to** - [CALLROUTE] [ORTO] 

Callroute/Orto uses Delegated Access to connect with your Microsoft tenant. This has two components:

1. A client app that is created and granted scopes ([delegated permissions](https://callroute.atlassian.net/wiki/spaces/CKB/pages/860192770)) during the integration. These scopes describe which resources and operations the Callroute/Orto app is allowed to perform on behalf of the [service user](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442). These permissions are recorded in Microsoft Entra ID (Applications > Enterprise Applications > Callroute app > Permissions). More details can be found in [Checking Tenant Configuration](https://callroute.atlassian.net/wiki/spaces/CKB/pages/698253394/Checking+Tenant+Configuration#Checking-AzureAD-App-Registration). [Learn more on about Delegated Permissions](https://learn.microsoft.com/en-us/entra/identity-platform/delegated-access-primer)

2. A [service user](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442) you create in the target 365 tenant. This user needs to exist in the Microsoft tenant in perpetuity. For the initial integration (service deployment), the user must be granted a minimum set of roles, as detailed in [Creating a Service User Account](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442). After the initial deployment, some roles can be removed; noting the roles assigned to the service user will dictate the available functionality of the Callroute / Orto service.


> ℹ️ Callroute/Orto follows the principle of least privilege; where we do not request scopes that the app doesn’t need. More details on the requested permissions can be found in the [Permissions Deep Dive](https://callroute.atlassian.net/wiki/spaces/CKB/pages/860192770). This principle helps limit the security risk and makes it easier for security administrators to approve the integration.


The Callroute/Orto service maintains the connection to the 365 tenant using tokens granted by Microsoft during the set-up process. Permissions allow ongoing read/write access (the tokens are automatically refreshed as that permission is granted during set-up). 

If the [service user](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442) is descoped (roles revoked) below the minimum requirement, deleted or the password is changed, Callroute/Orto will lose connectivity and cannot perform the management functions. If the password is changed, the service account must be re-authorised.


> 📝 Callroute/Orto does not store passwords associated with the [service user](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442) account, only the UPN and associated access tokens.


![image-20240919-115829.png](media://28d2ee11-2949-42bc-9e10-19f0170118b4)

The minimum permissions on either the client app or the [service user](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442) dictate the level of access to your Microsoft tenant. In other words, the lesser permissions prevail.


> ℹ️ We strongly recommend [creating a dedicated service account](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442) instead of using your own M365 account. This is because we will seek user impersonation API permission from Teams PowerShell on behalf of the integration account. When applying changes to Teams, Azure AD auditing will log changes made by this account. 
> ℹ️ 
> ℹ️ Do not worry if you don’t have this now. If you have the above admin roles assigned, you can deploy with your account and replace the integration account with a dedicated service account in the future.