> For the complete documentation index, see [llms.txt](https://docs.pockethrms.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pockethrms.com/feature-guides/microsoft-teams-integration.md). # Microsoft Teams Integration ### **Overview** The Microsoft Teams Integration connects a customer's Microsoft 365 tenant to Pocket HRMS so that Teams meeting links are generated automatically when an interview is scheduled. Once configured, any recruiter scheduling an interview through Pocket HRMS with the Online mode and Microsoft Teams platform selected gets an auto-generated meeting link, and every interviewer added to the panel receives a calendar invite for the same slot. This helps in: * Removing the manual step of creating a Teams meeting for every interview * Keeping interview links consistent and attached directly to the interview record * Automatically blocking interviewers' calendars for the scheduled slot ### **Before You Begin** This integration has two parts — a one-time setup performed by the customer's IT team in Microsoft 365, and a linking step performed inside Pocket HRMS. Ensure the following before starting: * The customer has a Microsoft 365 tenant with Global Administrator access available * Each recruiter who will schedule interviews has an active Microsoft 365 account in the same tenant, with an Exchange Online mailbox and a Microsoft Teams license assigned * You have access to Pocket HRMS Cloud Settings ### **Part A — Microsoft 365 / Azure Setup** ### **1. Register the App in Microsoft Entra** Path: **Microsoft Entra admin center → App registrations** Register a new app registration for Pocket HRMS, then copy the Application (client) ID and Directory (tenant) ID from its Overview page. Both values are required to link Pocket HRMS later. ### **2. Create a Client Secret** Path: **Certificates & secrets → New client secret** Copy the secret Value immediately after it is created. **Important:** Microsoft shows the secret Value only once. If it is not copied at this point, it cannot be retrieved later, and a new secret must be generated. **Important:** The Secret ID shown alongside the secret is only a reference label used inside the Entra portal. It is not used anywhere in the Pocket HRMS setup — only the Secret Value is required.

### **3. Add API Permissions** Path: **API permissions → Add a permission → Microsoft Graph → Application permissions** | **Permission** | **Type** | **Purpose** | | ---------------------------- | ----------- | ----------------------------------------- | | Calendars.ReadWrite | Application | Read and write calendars in all mailboxes | | Mail.Send | Application | Send mail as any user | | OnlineMeetings.ReadWrite.All | Application | Read and create online meetings | | User.Read.All | Application | Read all users' full profiles | | User.Read | Delegated | Sign in and read user profile | Click Grant admin consent for the tenant. All five permissions must show a green Granted status before continuing.

### **4. Grant the Application Access Policy** API permissions alone do not allow the application to create or manage Teams meetings on a user's behalf. A separate Application Access Policy must also be granted through Microsoft Teams PowerShell. **Step 1 — Connect to Microsoft Teams PowerShell:** Connect-MicrosoftTeams **Step 2 — Create the access policy:** New-CsApplicationAccessPolicy \`\ -Identity "PocketHRMSMeetingPolicy" \`\ -AppIds "\" \`\ -Description "Allow Pocket HRMS to create Teams meetings" **Step 3 — Grant the policy tenant-wide:** Grant-CsApplicationAccessPolicy \`\ -PolicyName "PocketHRMSMeetingPolicy" \`\ -Global **Important:** The -Global scope grants Pocket HRMS the ability to create and manage Teams meetings for every user in the tenant, not only recruiters. Confirm this scope is acceptable to the customer's IT/security team before applying it. **Important:** Policy changes can take time to propagate. If auto-link generation does not work immediately after this step, wait and retry before troubleshooting further.

### **Part B — Linking Pocket HRMS** Path: **Cloud → Settings → Integrations → Microsoft Teams** * Enter the Application (Client) ID noted from Microsoft Entra * Enter the Directory (Tenant) ID noted from Microsoft Entra * Enter the Client Secret Value — not the Secret ID * Click Linked to Pocket HRMS to confirm ### **What Happens When an Interview is Scheduled?** Once linked, scheduling an interview with the Online mode and Microsoft Teams platform selected auto-generates the meeting link. The Interview Link field is disabled and displays the system-generated link instead of accepting manual entry. Every interviewer added to the panel receives a calendar invite for the scheduled slot, which appears as a block on their calendar through standard Teams/Outlook invite behaviour. **Important:** Auto-generation only works for recruiters within the same Microsoft 365 tenant the integration was configured for. ### **Verifying the Setup (Using Postman)** Postman is a free tool for sending test requests to an API and seeing the response directly, with no coding involved. It is available as a desktop app or at postman.co — either works for the steps below. ### **Getting Started with Postman** This guide assumes Postman is already open. Before building the first request, here is a quick tour of what is on the screen — the same layout is used for every request below. * Method dropdown — a small box on the far left of the request bar, usually showing GET. Clicking it opens a list of request types (GET, POST, and others). * URL field — the long text box next to the method dropdown, where a web address is typed or pasted. * Send button — the blue button to the right of the URL field. Clicking it fires the request. * Tabs row — just below the URL field: Params, Authorization, Headers, Body, Scripts, Settings. Each tab holds a different part of the request's setup. Only Body and Authorization are used in this guide. * Response area — the lower half of the screen. Once a request is sent, the result appears here: a colored status badge first (for example, green 200 OK, or red 401, 403, 404), followed by the actual reply as text. **Step 1 — Open a New Request Tab:** At the very top of the window is a row of tabs, one per request. Click the + icon at the end of this row.

**Step 2 — Confirm a Blank Request Has Opened:** A new tab appears labelled Untitled Request, with the method dropdown showing GET and an empty URL field below it. This is the starting point for every request below.

**Before You Begin** * Have the Tenant ID, Client ID, and Client Secret Value from Part A ready * Have a test recruiter's email address from the customer's tenant (an account known to exist, such as an IT support mailbox) ### **Request 1: Generate an Access Token** **Step 1 — Change the Method to POST:** Click the method dropdown on the left of the URL field — it shows GET by default. A list appears; click POST.

**Step 2 — Enter the Token URL:** Click inside the URL field and type or paste the following, replacing \ with the actual Tenant ID: [https://login.microsoftonline.com/\/oauth2/v2.0/token](https://login.microsoftonline.com//oauth2/v2.0/token)

**Step 3 — Open the Body Tab:** In the row of tabs below the URL field, click the word Body. **Step 4 — Select x-www-form-urlencoded:** A row of small round selection buttons appears: none, form-data, x-www-form-urlencoded, raw, binary, GraphQL. Click the circle next to x-www-form-urlencoded.

**Step 5 — Fill In the Four Fields:** A table with Key and Value columns appears, with a checkbox at the start of each row. Click inside the first Key cell and type client\_id, then click inside the Value cell on the same row and enter the Client ID. A new blank row appears automatically below it — repeat this for the remaining rows: | **Key** | **Value** | | -------------- | -------------------------------------- | | client\_id | The Client ID from Part A | | client\_secret | The Client Secret Value from Part A | | scope | | | grant\_type | client\_credentials |

Leave the checkbox on each row ticked — it is ticked by default once a row has content. **Step 6 — Click Send:** Click the blue Send button, to the right of the URL field.

**Step 7 — Read the Response:** After a moment, the result appears in the Response area at the bottom of the screen. * A green 200 OK badge, together with an access\_token field in the text below it, means the request succeeded

* Click inside the response text and copy the long string between the quotes after "access\_token": — this is needed for the next two requests (the one masked in the above image) **Important:** This token expires after about one hour. If a later request fails with “the token is expired,” repeat this request to get a fresh one. ### **Request 2: Check That the Recruiter Exists in the Tenant** **Step 1 — Open Another New Request Tab:** Click the + icon again, the same way as before. Keep the Request 1 tab open in case the token needs copying again.

**Step 2 — Leave the Method as GET:** No change is needed here — GET is already selected by default. **Step 3 — Enter the URL:** Click inside the URL field and type or paste the following, replacing with the email address being tested: **Step 4 — Open the Authorization Tab:** In the row of tabs below the URL field, click the word Authorization. **Step 5 — Change Auth Type to Bearer Token:** A dropdown labelled Auth type appears, showing No Auth by default. Click it, and select Bearer Token from the list.

**Step 6 — Paste the Access Token:** A box labelled Token appears below the dropdown. Click inside it and paste the access\_token value copied from Request 1. **Step 7 — Click Send:** Click the blue Send button.

**Step 8 — Read the Response:** * A green 200 OK badge with the recruiter's id, displayName, userPrincipalName and mail confirms the recruiter exists in this tenant and auto-generation will work for them

* A red 404 usually means a typo in the email, or that the recruiter is not part of this tenant

* A red 403 with "Insufficient privileges" usually means the recruiter's account belongs to a different Microsoft 365 tenant than the one this app is registered against or your request was authenticated successfully, but you don't have enough permission to access or perform that operation.

**Important:** Optional: repeat this request with an email address from outside the customer's tenant. It should fail with a 403 or 404 — never a 200. This confirms auto-generation is correctly restricted to recruiters within the customer's own tenant. ### **Request 3: Check That the Recruiter's Calendar Supports Teams Meetings** **Step 1 — Open a Third New Request Tab:** Click the + icon once more. **Step 2 — Leave the Method as GET** **Step 3 — Enter the URL:** Click inside the URL field and type or paste the following, replacing with the same email address used in Request 2: **Step 4 — Repeat the Authorization Setup:** Click Authorization, set Auth type to Bearer Token as before, and paste the same access token into the Token box. **Step 5 — Click Send**

**Step 6 — Read the Response:** * A green 200 OK confirms the calendar is reachable

* Look through the response text for "defaultOnlineMeetingProvider": "teamsForBusiness" (or "teamsForBusiness" listed inside "allowedOnlineMeetingProviders"). This is what actually confirms Teams meetings can be created for this recruiter — a 200 OK alone is not enough * A 404 or 403 points to the same causes as Request 2 Once all three requests succeed with the expected results, schedule a test interview in Pocket HRMS with the Online mode and Microsoft Teams platform, and confirm the link auto-generates. ### **Before Anything Else: Confirm the Recruiter Is in the Tenant** If a specific recruiter's Teams link isn't generating, check this first — it takes a minute and rules out the most common cause before reaching for Postman or PowerShell. **Step 1 — Open Microsoft 365 Admin Center:** Sign in at admin.microsoft.com with an administrator account for the customer's organization. **Step 2 — Go to Active Users:** In the left-side menu, go to Users → Active users. (If Users isn't visible, click Show all first to expand the menu.) **Step 3 — Search for the Recruiter:** Look for the recruiter's name or email in the list. * If they appear, they belong to this tenant — move to the next check below * If they do not appear, they are not part of this Microsoft 365 tenant, and auto-generation will never work for them, regardless of any permission or policy fix **Step 4 — Confirm the Account Is Active:** Click the recruiter's name to open their details, and check that Account status shows Active — not blocked, disabled, or deleted. **Step 5 — Confirm Teams and Exchange Are Enabled:** In the same details panel, open Licenses and apps, and confirm both Microsoft Teams and Exchange Online are switched on for this user. If all of this checks out and the link still doesn't generate, move on to the Postman checks above or the table below. ### **Troubleshooting** | **Issue** | **Cause** | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 403 — "No application access policy found for this app on the user" | The Application Access Policy was not created or granted in Microsoft Teams PowerShell | | 403 — "Insufficient privileges to complete the operation" (calendar access) | The Calendars.ReadWrite permission is missing, set as Delegated instead of Application, or admin consent was not granted | | 404 — Mailbox or calendar not found | The user exists in the tenant but does not have an Exchange Online mailbox | | Link still fails after adding a permission | A new access token must be generated — existing tokens do not inherit newly added permissions | | 401 — "Lifetime validation failed, the token is expired" | Access tokens are valid for roughly one hour. Generate a new token and retry | | 403 — "Insufficient privileges" on a specific recruiter's account | The recruiter's Microsoft 365 account is in a different tenant than the one Pocket HRMS is registered against. Auto-generation only works within the same tenant | | 404 — "The requested user is invalid" | Same cause as above — the email domain does not belong to the tenant the app is registered in | ### FAQs Answers to the questions customers and their IT/security teams most often ask after reading this guide. ### **Setup & Permissions** ### **Q1: Which Microsoft 365 admin roles are needed to complete the setup?** A Global Administrator can complete every step. If your organization prefers least-privilege roles, the work can be split: ● App registration and client secret — Application Administrator or Cloud Application Administrator ● Granting admin consent for the Microsoft Graph application permissions — Privileged Role Administrator or Global Administrator ● Creating and granting the Application Access Policy — Teams Administrator ### **Q2: Why is the Mail.Send permission required?** Mail.Send is used so that Pocket HRMS can send interview invitations using your organization's configured email template and the recruiter's Microsoft 365 identity, rather than relying solely on the default meeting invite format generated by Microsoft. This ensures that candidates and interviewers receive a professionally branded communication aligned with your recruitment process, while still containing the Microsoft Teams meeting details. Note that Mail.Send is an application permission, which Microsoft grants tenant-wide by default. Pocket HRMS only sends mail as the recruiter who scheduled the interview. If your security team wants this enforced at the Microsoft level as well, see the next question. ### **Q3: Can access be restricted only to authorised HR/recruiter accounts instead of all company users?** Yes. There are two separate layers: #### **1. Within Pocket HRMS** The Schedule Interview functionality is available only to users assigned the appropriate Pocket HRMS roles, such as Admin, HR, or Recruiter. Users outside these roles cannot schedule interviews or generate Teams meeting links through the application. #### **2. Within Microsoft 365** The Microsoft permissions are configured at the tenant level by default. They can be narrowed in two places: ● Teams meeting creation: instead of granting the Application Access Policy with -Global (Part A, Step 4), grant it only to specific recruiter accounts: Grant-CsApplicationAccessPolicy -PolicyName "PocketHRMSMeetingPolicy" -Identity "\" ● Calendar and mail access: Exchange Online can limit the app's calendar and mail access to members of a specific mail-enabled security group (using RBAC for Applications, or the older Application Access Policies in Exchange Online). Important: With per-user scoping, every new recruiter must be added to the policy or group before their Teams links will auto-generate. Recruiters who are not added will see the same errors as a recruiter outside the tenant. We are happy to work with your IT team to set this up. ### **Q4: How long does it take for the integration to start working after setup?** The Microsoft permissions apply once admin consent is granted, but the Application Access Policy can take up to 30 minutes to take effect. If links do not generate immediately after setup, wait and retry before troubleshooting. ### **Security & Data** ### **Q5: How does Pocket HRMS securely store and protect the Microsoft Client Secret?** You do not need to share the Tenant ID, Client ID, or Client Secret with Pocket HRMS personnel via email, support tickets, or any external communication channel. Your IT team enters these values directly within Pocket HRMS through: **Path: Cloud → Settings → Integrations → Microsoft Teams** Security controls include: ● The Client Secret field is masked during entry, similar to a password field ● Once saved, the value is stored in encrypted form within Pocket HRMS ● The Client Secret is not displayed back through the application interface after it has been saved, and reopening the integration screen does not reveal it ● The value is not visible to end users and is not available to support personnel through standard product operations The verification checks in this guide (Postman) can be run by your own IT team, so the Client Secret never needs to leave your organization. ### **Q6: What employee or candidate data will Pocket HRMS access, where will it be stored, and for how long?** For the Microsoft Teams integration, Pocket HRMS uses only the information needed to schedule interviews and create Teams meetings: ● Organizer availability information required for scheduling ● Meeting date and time ● Interview participant and attendee details ● Generated Microsoft Teams meeting links ● Calendar event details for the interview schedule Pocket HRMS does not read or use: ● Email content ● Microsoft Teams chat messages ● SharePoint or OneDrive content ● Files or documents stored within Microsoft 365 ● Meeting recordings, transcripts, or interview conversation content Meeting details linked to the interview are stored within Pocket HRMS as part of the recruitment record and follow the standard retention controls that apply to recruitment records in the platform. On request, we can share our Information Security and Compliance documentation, including: ● ISO/IEC 27001 Certification ● SOC 1 Type II Report ● SOC 2 Type II Report ● Applicable privacy and security documentation ### **Q7: Does Pocket HRMS record or transcribe interviews?** No. The integration does not request any recording or transcript permissions from Microsoft, so it cannot access meeting recordings or transcripts even if your organization records interviews in Teams. ### **Q8: How can we revoke Pocket HRMS's access if needed?** Access is fully under your control. Your IT team can do any of the following in Microsoft 365, and it takes effect without any action from Pocket HRMS: ● Delete the client secret in Microsoft Entra (Certificates & secrets) ● Remove admin consent for the app, or delete the app registration entirely ● Remove the Application Access Policy using Remove-CsApplicationAccessPolicy Once access is revoked, new interviews will no longer get auto-generated Teams links. ### **Licensing & Cost** ### **Q9: Is the Teams integration included in our current Pocket HRMS plan, or does it need an extra licence or charge?** There is no additional charge from Pocket HRMS for the Microsoft Teams integration. The only prerequisite is Microsoft 365 licensing with Microsoft Teams and Exchange Online enabled for each recruiter who schedules interviews. Most organizations already have this, but some newer Microsoft 365 plans are sold without Teams. In that case, a separate Teams licence is needed for recruiters. ### **Q10: Do candidates need a Microsoft Teams account or licence to join?** No. Candidates can join from the meeting link using a web browser or the Teams app, as guests. Depending on your organization's Teams meeting settings, they may wait in the lobby until someone from the panel admits them. ### **Using the Integration** ### **Q11: Who shows as the organizer of the Teams meeting?** The recruiter who scheduled the interview in Pocket HRMS. The meeting is created on their calendar, and the invite comes from their account. ### **Q12: Can interviewers from outside our organization be added to the panel?** Yes. Only the recruiter scheduling the interview needs to be in your Microsoft 365 tenant. Other panel members, including external interviewers, receive the invite by email and join as guests. ### **Q13: What happens if a recruiter is not part of our Microsoft 365 tenant?** The Teams link will not auto-generate for that recruiter. They can select Manual as the platform and paste a meeting link themselves. ### **Q14: If an interview is rescheduled in Pocket HRMS, is the Teams meeting updated too?** Yes. Rescheduling updates the existing meeting invite, so the panel and the candidate keep the same invite with the new date and time. No new meeting is created. ### **Q15: Can one Pocket HRMS account connect to more than one Microsoft 365 tenant (for example, for group companies)?** The integration is set up with one app registration per Microsoft 365 tenant. Each group entity on a separate Microsoft 365 tenant needs its own app registration and setup. Entities that use the same domain (and so the same Microsoft 365 tenant) can share one registration. ### **Maintenance** ### **Q16: What happens when the Client Secret expires?** Every client secret has an expiry date, chosen when it is created in Microsoft Entra (Microsoft allows up to 24 months). Once it expires, Teams links will stop auto-generating for all recruiters. To renew: ● Create a new client secret in Microsoft Entra (Part A, Step 2) ● Enter the new Secret Value in Pocket HRMS under Cloud → Settings → Integrations → Microsoft Teams ● Delete the old secret in Microsoft Entra Important: Set a calendar reminder a few weeks before the expiry date. Pocket HRMS does not show an alert before or after the secret expires, because the expiry date is set and managed within your Microsoft 365 tenant. **For any queries, contact** [**support@pockethrms.com**](mailto:support@pockethrms.com)