--- title: "User Synchronisation" canonical: "https://help.callroute.com/space/CKB/699039785/User%20Synchronisation" format: markdown --- ![image](media://9a2783d7-9c85-4f19-bd2a-25186f0c1ad6) To connect Callroute with your Microsoft tenant, several different elements must be provisioned to allow calls to flow between Teams and the Callroute infrastructure. This article explains what these elements are and why they are necessary. Removing the Callroute integration is also outlined within this article. As a guide the provisioning process typically takes between 2 – 5 minutes from start to finish assuming the [Callroute prerequisites](https://callroute.atlassian.net/wiki/spaces/CKB/pages/698843188) are met. There are 4 steps to the provisioning process, and you will be required to sign into your Microsoft account twice. ##### Top Tip: The key to a successful integration is not to sign in with your personal Microsoft account. We recommend you create a dedicated user in your Microsoft tenant for purposes of the Callroute connection, noting they must be assigned the correct ***Administrator*** roles as detailed in the [relevant help article](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442). > ℹ️ This is because the Callroute app will seek to obtain the impersonation token for this user to access Teams PowerShell. A service account is recommended for auditing and security purposes so that changes initiated by Callroute can be identified. ![Callroute Microsoft Teams integration screenshot]() ##### **Step 1: Authorise Callroute App**: This allows Callroute to obtain the required permissions via generation of an access token in order to gain read / write access to your Microsoft Azure tenant. The Microsoft account used to sign in must have the [correct roles](https://callroute.com/knowledge/callroute-for-microsoft-teams-requirements). ##### **Step 2: Run Readiness Check:** Callroute will use the access token generated during **Step 1** to verify all prerequisites are met. Callroute prerequisites are outlined in a [separate help article](https://callroute.atlassian.net/wiki/spaces/CKB/pages/721125442). ![image]() ##### **Step3: Integrate Callroute App:** > 📝 This section is for informational purposes only and describes what the Callroute app will be deploying into your tenant. You **aren’t** required to action any of these steps manually. You will be asked to sign into your Microsoft account for a 2nd time in order to generate a 2nd access (impersonation) token. This allows Callroute to impersonate and act on behalf of the user so that access to the Microsoft Teams admin centre is gained. This enables Callroute to create / update policies and other elements. Callroute will then commence domain provisioning. ##### **Domain Provisioning:** 1. Creation of a subdomain in the Callroute environment for the target Microsoft tenant to use as the virtual SBC. The subdomain will match your Microsoft ‘initial domain’ (e.g. `my-company.onmicrosoft.com` and will yield a Callroute SBC subdomain of `my-company.gbr-lon-tgw.callroute.io`). This subdomain is then pointed at the Callroute telephony infrastructure. 2. Creating a record of the above domain within your Microsoft tenant (see [Microsoft Admin Centre: Domains](https://admin.microsoft.com/AdminPortal/Home#/Domains)). 3. Verification of the domain. Please note that whilst this step typically takes a few minutes, factors relating to [DNS propagation](https://www.siteground.com/kb/what_is_dns_propagation_and_why_it_takes_so_long/) can result in a delay of 30-60 minutes and very rarely somewhat longer. This step is the most common reason for delays beyond the normal end to end provisioning time of 5 minutes. 4. Creation of a new user with a principal name of Teams Gateway (`callroute.teams@`) in your Microsoft tenant. 5. Assignment of an available `*Teams*` license within any of the following plans (Business Essentials, Business Premium, Teams Exploratory, F1, F3, E1, E3, or E5) The next step provisions the various policies and other resources within your Microsoft tenant to enable Direct Routing with Callroute, this uses the recently created subdomain as a virtual SBC.  These new resources will only be used by the Callroute enabled users and will not have any effect on any existing Users, Dial plans, Voice routing policies etc that may already be configured in your tenant for another voice provider. ##### **Provision Dial Plan** 1. Callroute does not deploy a custom dial plan. Instead, relies on the default tenant dial plan assigned to your users. This is controlled by the user’s license location as set in Microsoft 365. 2. Creation of a new Online Voice Routing Policy called ‘Callroute-E164’ (see [Voice Routing Policies](https://admin.teams.microsoft.com/policies/teamsonlinevoicerouting)). 3. Enabling ‘Global’ Online PSTN Usage for the new ‘Callroute-E164′ Online Voice Routing Policy (allows this policy to work within Teams’ internal telephony routing; from [Voice Routing Policies](https://admin.teams.microsoft.com/policies/teamsonlinevoicerouting), click ‘Global (Org-wide default)’ to edit the Global policy. 4. Creation and enablement of specific ‘Callroute-E164’ Online PSTN Usage for the ‘Callroute-E164’ online voice routing policy (enables this policy to work with the Callroute telephony routing, for failover and such). 5. Callroute uses the derived trunk connection model. Therefore, you will not see a PSTN Gateway listed in Teams Admin Center. However, you will notice the gateway set as an SBC in the Callroute-E164 voice route. 6. Creation of a new Online Voice Route called ‘Callroute-E164’ to allow usage of the above Online PSTN Gateway (see [Voice Routes](https://admin.teams.microsoft.com/direct-routing/v2/voice-routes)). 7. Addition of the following emergency numbers to the Global Emergency Calling Policy in Teams; 999, 111, 101, 112, 911, 190, 197 ##### **Step 4: Synchronise Users** Callroute will initially synchronise the users that have a Microsoft Phone System to the Callroute database. Once the synchronisation is complete all users that have the required Microsoft licensing will be displayed in Callroute as *Inactive*, these users are then ready to be activated (assigned a phone number). Users that are missing the required licensing can be viewed performing a full tenant synchronisation and then selecting the filter *Unlicensed*. **Tip:** If you make any changes to the Microsoft tenant directly (via 365 or Teams admin centre) that relates to user license assignment, user roles, addition or deletion of users or phone number assignment please be sure to synchronise the service. This can be done on a individual user or all user basis. Note large user counts can take a considerable time (for example 10,000 users takes between 1-2 hours for a full sync). Individual user syncs or user fetches take just a few seconds. ![Sync user button screenshot]() A full overview of the provisioning process that includes more information around the prerequisites are contained within the following video: ![image](media://9a2783d7-9c85-4f19-bd2a-25186f0c1ad6)