Inspired by my peers using Microsoft Graph API to interact with the Microsoft 365 substrate and in particular Microsoft Teams, I decided to give it a whirl and see what I could break.

I came up with a valid problem that administrators will face as Teams proliferate through their organization. How to clean-up unused Teams. We accept there will be a lot of Teams created for test purposes. There may also be well used Teams created that have expired their usefulness and simply left dormant. What do we do with these?

Built into Microsoft 365 we have the ability to set group expiration policies. Two issues with these policies spring to mind. 1) They required AzureAD Premium P2 licensing and 2) they work on a fixed time duration approval basis. This means every X Days a Team / Group owner will need to reconfirm they still want the Team / Group to remain active. This may get annoying for Owners who have multiple Teams.

Using the Graph API, we have access to lots of information, some of which is inaccessible by any other means. I wanted to investigate if I could audit Teams and figure out if there has been any activity in that Team within a set number of days. If not, then post a message into that Team to warn members, unless they use it, it will be deleted or archived, whatever your policy dictates.

The metrics used are message creation date in any Team channel and any file activity on the Team drive. If there has been activity in either metric within a configured time period, consider these Teams active and ignore. If the last activity exceeds the configured time period, issue a warning to the General channel of the Team by posting a channel message containing the warning.

To get started, I enlisted the help of Lee Ford’s amazing post on getting started with Graph API and PowerShell. I suggest you head on over to his post to discover how to create the required AzureAD App Registration.

Back? Good. There are a few alterations to the AzureAD App permissions needed for the script to work. These are:

• ChannelMessage.Read.All
• Group.ReadWrite.All
• User.Read.All
• Files.Read.All
• Directory.Read.All

Delegated User permissions are needed to post messages in the channel, so you need to add the following for these:

• Group.ReadWrite.All

Unfortunately, we have to use both Application and Delegated permission because we cannot send a message to a Team as an Application. It has to be done by an account with membership to the Team in question. The end result will post a message in the offending Teams like this

The script will run, collect the information and then decide if it should post a message. If it does, then it will temporarily add the delegated user to the Team as an owner, post the message and subsequently remove the user from the Team to maintain information security. At the end the administrator will have the option to export the Teams that were affected to a CSV file for further analysis.

Below is the script:

<###########################################################################

SCRIPT: WARNUNUSEDTEAMS.PS1

THIS SCRIPT CAN BE LAUNCHED IN POWERSHELL AND YOU MUST HAVE AZUREAD POWERSHELL MODULE INSTALLED

TO INSTALL RUN INSTALL-MODULE AZUREAD

YOU MUST CREATE AN AZUREAD APP REGISTRATION FOR THIS SCRIPT. THIS SCRIPT REQUIRES BOTH APPLICATION
AND DELEGATED PERMISSIONS TO RUN

MORE INFORMATION HTTPS://blog.valeconsulting.co.uk

OFFERED WITHOUT WARRANTY, SUPPORT OR RESPONSIBILITY. USE AT YOUR OWN RISK

###########################################################################>


<###########################################################################

SCRIPT PARAMETERS - PLEASE MODIFY

###########################################################################>

#SET THE NUMBER OF DAYS FROM TODAY THE SCRIPT WILL CLASSIFY AS MINIMUM ACTIVITY

$days = "60"

#SET YOUR AZUREAD APP ID'S, SECRET AND SUPPORT UPN USED TO RUN AS USER TO POST MESSAGES IN TEAMS HERE

$clientId = ""
$tenantId = ""
$clientSecret = ''
$supportUPN = "itsupport@valeconsulting.co.uk"

<################################################################################################

PLEASE MODIFY THE CONTENT ELEMENT WITH YOUR CHOSEN MESSAGE YOU WANT POSTING IN THE TEAM

#################################################################################################>


$body = @"
{
"body": {
      "contentType": "html",
      "content": "Hello, we have noticed that this Team has not been used for at least $($days) Days. In line with our IT Policy, if there continues to be no activity for a further 30 Days, this team will be automatically deleted. Thank you. IT Support"
    }

}
"@

<#################################################################################################

DO NOT EDIT BELOW THIS LINE

##################################################################################################>

<#################################################################################################

CREDIT TO LEE FORD (WWW.LEE-FORD.CO.UK) FOR THIS SCRIPT ELEMENT

##################################################################################################>
# Construct URI
$uri = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"

# Construct Body
$body = @{
    client_id     = $clientId
    scope         = "https://graph.microsoft.com/.default"
    client_secret = $clientSecret
    grant_type    = "client_credentials"
}

# Get OAuth 2.0 Token
$tokenRequest = Invoke-WebRequest -Method Post -Uri $uri -ContentType "application/x-www-form-urlencoded" -Body $body -UseBasicParsing

# Access Token
$token = ($tokenRequest.Content | ConvertFrom-Json).access_token

Write-Host "Connected to AzureAD App and Acquired Token" -ForegroundColor Yellow

# Base URL
$uri = "https://graph.microsoft.com/beta/"
$headers = @{Authorization = "Bearer $token"}
$ctype = "application/json"
<#################################################################################################

END CREDIT

##################################################################################################>


#Get Support UPN Object ID
Write-Host "Getting Azure Object ID of Support UPN" -ForegroundColor Yellow
$objID = Invoke-WebRequest -Method GET -Uri "$($uri)users/$($supportUPN)" -ContentType $ctype -Headers $headers | ConvertFrom-Json

 
#Get all Teams
Write-Host "Getting All O365 Groups that are Teams Enabled" -ForegroundColor Yellow
$graph = Invoke-WebRequest -Method GET -Uri "$($uri)groups?`$filter=resourceProvisioningOptions/Any(x:x eq 'Team')" -ContentType $ctype -Headers $headers | ConvertFrom-Json

#For each Team now find their channels, last message and last modified file.

$results = @()
Write-Host "Analyzing Teams Activity. Please Wait..." -ForegroundColor Yellow

ForEach ($team in $graph.value){

        #Get files activity

            $drive = Invoke-WebRequest -Method GET -Uri "$($uri)groups/$($team.id)/drive" -ContentType $ctype -Headers $headers | ConvertFrom-Json

            $activity = Invoke-WebRequest -Method GET -Uri "$($uri)drives/$($drive.id)/activities?`$top=1" -ContentType $ctype -Headers $headers | ConvertFrom-Json

            $lastTime = $activity.value.times.recordedDateTime

        #Get Teams Owners

            $owners = Invoke-WebRequest -Method Get -Uri "$($uri)groups/$($team.id)/owners" -ContentType $ctype -Headers $headers | ConvertFrom-Json       

             
        #Get Channels from Team

           $channels = Invoke-WebRequest -Method GET -Uri "$($uri)teams/$($team.id)/channels" -ContentType $ctype -Headers $headers | ConvertFrom-Json

        #Loop through channels and get last message by date      

                ForEach ($ch in $channels.value){

                    $chmsg = Invoke-WebRequest -Method GET -Uri "$($uri)teams/$($team.id)/channels/$($ch.id)/messages?`$top=1" -ContentType $ctype -Headers $headers | ConvertFrom-Json

                    #if there was a message and it was posted over the time period set warning flag to true
                    
                    if ($chmsg.value.createdDateTime -ne $null){
                        
                        $time = New-TimeSpan -Start $chmsg.value.createdDateTime -End (Get-Date)

                        if ($time.Days -gt $days){

                            $warn = $true

                        }else{
                            
                            $warn = $false

                        }

                    }else{
                        
                        $warn = $true

                    }

                    #if there has been no chat activity, check file activity

                    if ($warn -eq $true){
                            
                            if ($lastTime -ne $null){
                                    
                                    $ftime = New-TimeSpan -Start $lastTime -End (Get-Date)                                    

                                    if ($ftime.Days -le $days){

                                        #if there has been file activity within the configured number of days, turn the warning flag off

                                        $warn = $false    
                                    }

                            }

                    }

                    #store all results in array
                    $results += New-Object -TypeName psobject -Property @{TeamID=$team.id;TeamName=$team.displayName;ChannelID=$ch.id;ChannelName=$ch.displayName;MessageDate=$chmsg.value.createdDateTime;MessageDaysOld=$time.Days;FileDate=$lastTime;FileDaysOld=$ftime.Days;Owners=$owners.value.mail;Warn=$warn}


                }
}

#filter the results so that only teams with warning flags set to true are used

$teamfilter = $results | Where {$_.Warn -eq $true -and $_.ChannelName -eq "General"}

Write-Host "Require User Authentication for Message Sending..." -ForegroundColor Yellow

<##################################################################################################

CREDIT TO LEE FORD (WWW.LEE-FORD.CO.UK) FOR THIS SCRIPT ELEMENT

###################################################################################################>

#authenticate with the IT user account to post a message to the general channel of these groups.

# Azure AD OAuth User Token for Graph API
# Get OAuth token for a AAD User (returned as $token)

# Add required assemblies
Add-Type -AssemblyName System.Web, PresentationFramework, PresentationCore

# Application (client) ID, tenant ID and redirect URI
$clientId = "08549aa5-f9e9-4297-a1cc-6c776c0c3a17"
$tenantId = "e7a63b11-d255-40fd-b586-9daaa76de185"
$redirectUri = "https://login.microsoftonline.com/common/oauth2/nativeclient"


# Scope - Needs to include all permisions required separated with a space
$scope = "User.Read.All Group.ReadWrite.All" # This is just an example set of permissions

# Random State - state is included in response, if you want to verify response is valid
$state = Get-Random

# Encode scope to fit inside query string 
$scopeEncoded = [System.Web.HttpUtility]::UrlEncode($scope)

# Redirect URI (encode it to fit inside query string)
$redirectUriEncoded = [System.Web.HttpUtility]::UrlEncode($redirectUri)

# Construct URI
$uri = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/authorize?client_id=$clientId&response_type=code&redirect_uri=$redirectUriEncoded&response_mode=query&scope=$scopeEncoded&state=$state"

# Create Window for User Sign-In
$windowProperty = @{
    Width  = 500
    Height = 700
}

$signInWindow = New-Object System.Windows.Window -Property $windowProperty
    
# Create WebBrowser for Window
$browserProperty = @{
    Width  = 480
    Height = 680
}

$signInBrowser = New-Object System.Windows.Controls.WebBrowser -Property $browserProperty

# Navigate Browser to sign-in page
$signInBrowser.navigate($uri)
    
# Create a condition to check after each page load
$pageLoaded = {

    # Once a URL contains "code=*", close the Window
    if ($signInBrowser.Source -match "code=[^&]*") {

        # With the form closed and complete with the code, parse the query string

        $urlQueryString = [System.Uri]($signInBrowser.Source).Query
        $script:urlQueryValues = [System.Web.HttpUtility]::ParseQueryString($urlQueryString)

        $signInWindow.Close()

    }
}

# Add condition to document completed
$signInBrowser.Add_LoadCompleted($pageLoaded)

# Show Window
$signInWindow.AddChild($signInBrowser)
$signInWindow.ShowDialog()

# Extract code from query string
$authCode = $script:urlQueryValues.GetValues(($script:urlQueryValues.keys | Where-Object { $_ -eq "code" }))

if ($authCode) {

    # With Auth Code, start getting token

    # Construct URI
    $uri = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"

    # Construct Body
    $body = @{
        client_id    = $clientId
        scope        = $scope
        code         = $authCode[0]
        redirect_uri = $redirectUri
        grant_type   = "authorization_code"
        client_secret = $clientSecret
    }

    # Get OAuth 2.0 Token
    $tokenRequest = Invoke-WebRequest -Method Post -Uri $uri -ContentType "application/x-www-form-urlencoded" -Body $body

    # Access Token
    $2token = ($tokenRequest.Content | ConvertFrom-Json).access_token

}
else {

    Write-Error "Unable to obtain Auth Code!"

}
<##############################################################################################################

END CREDIT

###############################################################################################################>

# Base URL
$headers = @{Authorization = "Bearer $2token"}
$uri = "https://graph.microsoft.com/beta/"


Write-Host "Posting Messages in Affected Teams..." -ForegroundColor Yellow

ForEach ($team in $teamfilter){
         
         
        #Add IT Support Account to the Team as an Owner

         $userbody = @"
                    { 
                    "@odata.id": "https://graph.microsoft.com/beta/users/$($objID.id)" 
                    }
"@
        
        try{
            Invoke-WebRequest -Method POST -Uri "$($uri)groups/$($team.TeamID)/owners/`$ref" -Body $userbody -Headers $headers -ContentType $ctype -ErrorAction Stop
        }catch{

        }

        #send message in Team Channel
        
        try{
            Invoke-WebRequest -Method POST -Uri "$($uri)teams/$($team.TeamID)/channels/$($team.ChannelID)/messages" -ContentType $ctype -Headers $headers -Body $body -ErrorAction Stop
        }catch{

        }

        
       
        #Remove IT Support UPN from Team

        try{
            Invoke-WebRequest -Method Delete -Uri "$($uri)groups/$($team.TeamID)/owners/$($objID.id)/`$ref" -Headers $headers -ContentType $ctype -body $userbody -ErrorAction Stop
        }catch{

        }

        

       
}

Write-Host "Cleaned Up Team Membership" -ForegroundColor Yellow

$report = Read-Host "Do you want to export the results to a CSV (y/n)"

if ($report -ieq "y"){

    $results | Export-Csv -Path C:\Temp\Teamsreport.csv -NoTypeInformation -Force

}

Write-Host "Finished" -ForegroundColor Green

The script can be downloaded here as well

In this article, I wanted to discuss how you could move to Microsoft Teams if you’re currently in a Hosted Skype for Business environment. Depending on your contract with your provider, you could be using dedicated compute and software instance for your Skype workload, or you could be using a multi-tenanted version of Lync 2013. Obviously, your existing hosting provider should and probably can help you on your journey to Microsoft Teams in either of these environments. However, what if you’re using Microsoft Teams as the driver to exit a contract or service altogther? Can it be done? And what are the penalities for doing so?

At first breath, you may be thinking that this challenge is a bridge to far and that you feel locked into a model that is no longer suitable for your organization to grow. However, the journey to Microsoft Teams can be simpler and less painful than you have initially envisioned.

First, talk to your hosting provider about their capabilities in moving you to a Microsoft Teams solution that is suitable to support your needs. This is often the path of least resistance. However, this may limit you to a service contract that you’re not entirely happy with and want to consider your options.

Your organization should own your Office 365 tenant (assuming you have one). You shouldn’t rent this from anyone other than Microsoft and you should have full control over its evolution. If you do not have an Office 365 tenant, then sign up for one.

Obviously there are many different scenarios you could find yourself in already that adds complexity to your move. However, as long as you’re not currently consuming Skype for Business Online as part of your hosted Skype Solution, you can read on. If you are, then this may not work as intended for you.

1. Tenant Preparation

You can do a lot of configuration in your tenant to support Teams without impacting your user’s Skype functionality. You can configure Identity and Access Management, Create Teams policies, Compliance settings etc. all without BAU being impacted.

2. Domain Registration

As Teams relies of UPN for chat and calling routing and not SIP, you can (with a caveat) register what is going to be your existing SIP domain with your tenant without impacting Skype. The caveat is, that you shouldn’t enable the Domain for Skype for Business Use. If you do then any federated partners you currently communicate with who have Skype for Business Online will not be able to reach you via Skype.

3. Configure Direct Routing

Registering your domain allows you to configure Direct Routing in advance of your move to Teams, without Skype for Business hybrid being set up. If you are concerned about your Domain registration, then use a sub-domain as a registered domain for your SBC configuration, and address the main domain further down the line.

Assuming you have made it this far, you can create all your calling policies for your users, test out calling scenarios and make sure that the solution is stable at your own pace.

4. Enabling Users for Teams

Although this is labelled as step 4, in reality you could do this alongside Step 3 as the two are not intrinsically linked. Enabling users for Teams for Chat, P2P AV, Meetings and Collaboration at this stage means users get to start using Teams whilst your hosted Skype service is unaffected for important workloads like Enterprise Voice. This gives you an advantage and head start with early adoption while you focus on the more complex voice element of your move.

An important consideration at this stage is users will need to continue to use Skype for their Voice and any federation communication with external partners.

Think of this stage as a Pseudo-Islands Mode, but your tenant is operating in Teams Only Mode.

5. Move Federation

When you are ready, you need to move federation away from Skype and to Teams. You can do this by enabling the Skype service on your Office 365 Domain and changing just the SRV record for sipfederationtls._tcp.domain.com to sipdir.online.lync.com in your public DNS. After propagation has completed, federated chat will move from Skype to Teams.

6. Move Enterprise Voice

You have two choices here, or may be a mix. New DDIs for Direct Routing or number porting. With the latter, initiate your port request if you need to your DR SIP service. Assign users their phone numbers in Teams in advance of the porting schedule so that when the port completes, calls will be delivered to Teams instantly causing very little disruption to services.

7. Say Goodbye to Your Hosting Provider

That’s it, you can now turn off your hosted Skype as your organization is now using Teams and you never had to tell them a thing!

This article is not chapter and verse, its about showing you a way to achieve something. Your mileage may vary depending on your complexity so please consider carefully before executing.

So you’ve got Microsoft Teams and you’ve got some calling plans. You don’t have enough to give every user one, so you come up with a business process that lets you be selective based on business justification. How do you integrate that business process to make it easy for IT and your users to follow?

Traditionally, you’d maybe make a shopping cart item in your service management portal and instruct the user to go there and place an order. On submission, it would trigger an approval process and may be even a provision on approval action. But what if you don’t have this expensive solution? What if you want to extract the value out of your Microsoft 365 subscription?

Well you can do this very easily and without too much hard work. In the following example I am using a simple online form that a user can submit and on submission, trigger a bunch of events that will ultimately lead to them being provisioned a phone number in Microsoft Teams.

For this exercise, we need the following components readily available of any Enterprise Subscription in Office 365

• Microsoft Forms – Used for the end user form
• Microsoft Flow – Used as a business process and conditional trigger / action solution (like IFTTT, but better)
• AzureAD – We need this for Azure Group Based Licensing (easier to manage)

In addition to these inclusive features of your Office 365 Subscription, we also need an Azure Subscription so we can use the benefits of Azure Automation Accounts. We use Automation Accounts to store Azure Runbooks which are scripts that are triggered by a job. We use Flow to trigger these jobs.

By the end of this article, you will have a basic, automated provisioning process template to build on. My job is to show you the way, and therefore devoid of any error checking, which in a production scenario you’d absolutely need.

The experience will be this:

• User will access request form online, complete and submit
• Request will be emailed to their manager who will then approve* or reject the request.
• On approval, the user will be licensed with the correct Office 365 licenses and automatically assigned a phone number from the Microsoft Cloud
• The user will get an e-mail upon completion confirming the action has been completed and their new phone number that has been allocated.
• *if the manager rejects, the user will get a rejection email

Creating Your Automation Account & Scripts

Head on over to the Azure Portal (https://portal.azure.com) and make sure that you have a valid subscription.

Go to Azure AD and create two AzureAD Security Groups (assume you know Azure Group Based Licensing):

1. Teams Standard Phone User
2. Teams International Phone User

In the standard user group assign the base O365 license e.g. E3 or E5 with Phone System and your domestic calling plan. In the international group assign the base license and your international calling plan, or communication credits.

Note down the Group Object ID of each of these groups. You’ll need them soon.

In the search bar type: automation accounts

This will take you to the Account page. Click the Add+ button and create an automation account (best to choose same data center location as your tenant)

Next, in the automation account you have just set up, click on the credentials blade and add a credential that will have the privileges to run your scripts. Give it a friendly name e.g. “Cred” (Change Scripts with correct name)

Now we need to load the required modules into the automation account. Open the modules blade and click on browse gallery

Search for the AzureAD Powershell Module

Add this module to your automation account. Next we need to load the SkypeOnline PS Module. This is not available in the gallery. Assuming you have this installed somewhere on your PC you will need to ZIP the contents of the SkypeOnlineConnector folder located in c:\program files\common files\skype for business online\modules folder.

Now that you have zipped this folder, upload it as a module to the modules blade in the automation account by clicking on Add a Module. You should see it become available after around 10 minutes.

Now click on the Runbooks blade and create 3 runbooks:

1. For Licensing the User
2. For Checking Provisioning Status of User
3. For Provisioning the User

Make sure both runbooks are PowerShell runbooks

You should have 3 blank runbooks created now like this

Now load the scripts into each runbook.

Open the Licensing User and Paste the following code in, replace as necessary (remember those Azure AD Licensing Group GUIDs? You need them now).

Save the runbook and publish it.

Now open the ProvisionCheck runbook and paste the following code in. Again replace as necessary. This script basically checks Skype continuously until provisioning has completed. We need this to halt the number assignment until we can actually implement it.

Save the Runbook and Publish.

Finally Open the TeamsPhoneUser Runbook and paste the activation code in

Save the Runbook and Publish.

That’s it for Azure Automation, now the fun stuff can begin.

Create the Form

Head on over to Microsoft Forms (https://forms.microsoft.com) and create yourself a form. In my example here we have a simple form that asks the following questions:

• What is your sign in address (UPN)
• What Site Are You Normally At (Dropdown)
• Who is Your Manager
• Do you Need International Calls
• What is Your Justification Reason

My form looks like this:

How you create your form, and how you word your questions will affect the flow, so for this example I recommend that you use the same wording as I have.

Now for the Flow..

Creating the Flow

Ok now before we go into Flow and start doing stuff, lets just recap what we need to do. We need to do something on Form submission, so this is the entry point into the flow.

Next we need to get the contents of the form so we have some data to use. Without it we are stuffed.

We then need to invoke and approval workflow that gives someone the authority to approve or reject the request. Then on either action we need to carry out the approvers commands

One of two things are going to happen at this point. If the approve approves the request, the flow will kick off all the cool stuff and provision the user. If they reject, the requestor is going to get a rejection email.

Now go to Microsoft Flow and create a flow.

Add your entry point by adding an action and searching for Microsoft Forms. Select Forms, then select Triggers and select “When a new Response is Submitted. Then choose the form Id

Now we need to apply the flow actions to each submission. Add a action and search for “Apply to Each”, then Select the Output “List of Response Notifications”

Inside this control we are going to house all our actions. Now we need to get the form content, so we search for forms again and then choose “Get Response Details”. Select the Form Id and select the Response Id from the menu

Now add another action, search for “start and approval”. In this example its a single user approval (their manager). Compile the approval email as you need. You can insert values from the form for clarity to them, like this:

Note I used the Managers email field from the form as the assigned to address so that they get the email.

Now we need a condition to decide what to do if we get an approval or rejection back. Add a action and search for “Condition”.

Add in the Response from the approval and what the expected value is e.g. “Approve”

Now you’ll get a Yes and No branch. The no is what to do if the response is not Approve. In this example, we are just going to send and email to the requestor.

In the No Branch add an action and search for “send email”. Fill out the email with the information you can pull from the submitted form e.g. the requestor UPN and any other information you want.

Step check, take a breather and when minimised you should now see this

Now for the Yes Branch.

The first thing we need to do is call our automation runbook for licensing the user with the appropriate requirements for calling. Add an action and search for “automation” choose Azure Automation and select Create a Job

Select your Azure Subscription, Resource Group and the Automation Account we created. Now select the Runbook LicenseUser. You should see it is asking for two input parameters. Choose the Email Address of the requestor from the form as the UPN and for International Calling the result from the International Calling Question in the Form, like this

The next step is we need to sit and wait for licensing and back end provisioning to complete before we can actually assign a number to the user. If we try now, it will fail. It can take up to 24 hours for this to work, so what do we do? This is where the second runbook comes in. It checks the users Skype and Teams licensing and back end provisioning repeatedly every 10 minutes until all the expected assigned plans have been provisioned. Only then will it return a value which we can then action on.

Create a new Azure Automation Job, doing the same as before, this time choosing the ProvisioningCheck Runbook

From this runbook, we are expecting something back and we need to tell Flow we are expecting something and what to do with it. Add an action and search for Azure Automation, choose “Get Job Output”. Here we are getting the job id of the previously submitted job so we can pull the output from it.

Now the putput from the job is in JSON format, so we need to tell flow to parse JSON. Add an action and search “Parse JSON”. The content will be the Content from the Azure Job and we need to tell flow content type and properties to expect in the content. In the schema enter the following.

We are expecting a JSON Object back, the “Status” is the property we are expecting back from the script and the content of that property is a string value.

 
{
    "type": "object",
    "properties": {
        "status": {
            "type": "string"
        }
    }
} 

Progress check. You should now have these actions under the Yes Branch

Now we need to add a condition. The condition is if the property “Status” is equal to “Ready” then go ahead and provision, If not send an email to IT Support telling them of a flow fail. Add this condition.

Now under the No Branch add a send email like before and this time send it to your IT Support desk

Now to the Yes branch, what do we want to do if the result is set to Ready?

Add an action and create a new Automation Job this time calling the TeamsPhone Provisioning Runbook and supplying the UPN and Location of the user from the form

Now again, we are expecting a result back from this job. It will contain the UPN of the user and the phone number we allocated them. So add another action to get the job output

Again, the format of the output is JSON, so we need to parse it to send an email to the requestor informing them of their new number. Add a parse json action and use the following schema

 
{
    "type": "object",
    "properties": {
        "upn": {
            "type": "string"
        },
        "phone": {
            "type": "string"
        }
    }
} 

The last action we need to do is send an email to the requestor informing them that their request has been approved and completed. Add an email action and place the phone property in the email body like so

The complete flow should look like this

Seeing It All In Action

User can now go to the form and complete. On submission, their manager gets an approval email

As the manager I click Approve and I am told that my response has been submitted

In Flow I can see that my flow completed

If I check Azure Automation I can see my Runbook Jobs Completed

If I want I can click in to each one and see the output

If I go into the Teams Admin Center, I can see if the user has been provisioned with this number

The user will receive their email like this:

And that is it. Seems quite complex when you write in a blog, but its very straighforward and only takes a hour if that to set up (longest bit was writing the simple scripts).

Obviously you can take this as far as you want. But for a simple self service phone number assignment tool, it does the job!