Required Admin Consent for CyberGate

Permission

Display Name

Description

Reason

Calls.AccessMedia.All

Access media streams in a call as an app

Allows the app to get direct access to media streams in a call, without a signed-in user.

Access to the media of the Teams call is required to send it to the SIP device and vice-versa

Calls.Initiate.All

Initiate outgoing 1 to 1 calls from the app

Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user.

Enables CyberGate to setup a call to a Teams user

Calls.InitiateGroupCall.All

Initiate outgoing group calls from the app

Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user.

The CyberGate ‘two-way video support’ feature (video in Teams and on the intercom) needs to be able to initiate a group call so that the video from Teams can be send to the intercom

Calls.JoinGroupCall.All

Join group calls and meetings as an app

Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined with the privileges of a directory user to meetings in your organization.

The CyberGate ‘Meeting’ feature needs to be able to join an existing meeting

GroupMember.Read.All

Read all group memberships

Allows the app to read memberships and basic group properties for all groups without a signed-in user.

Log in to the portal based on group membership.
Compose device list in CyberGate Teams app based on group membership.
Add group membership to recordings to be able to filter recordings based on groups.

User.ReadBasic.All

Read all users' basic profiles

Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo.

CyberGate needs to lookup users in the Tenant AAD to find the matching Teams user to call.

Domain.Read.All

Read domains

Allows the app to read all domain properties without a signed-in user.

Look up the actual domain of the user when no mult-ring group is used.
GUI has domain selection when assigning users.
Matching of the correct application instance (display name of intercom) is based on the on-microsoft domain of the tenant. This domain need to be resolved by the service.