Posted by Tom on Jan 25, 2021 in Development, Microsoft Teams

You can now create Live Events via Microsoft Graph API

Exciting news for developers of applications which make use of Microsoft Teams Live Events and want to automate the process of automating Live Events. You can now programmatically create Live Events via the Microsoft Graph API. From the Microsoft Graph Changelog:

This functionality is still in beta, with an important security known issue, but it means that developers everywhere can start playing with these API calls and integrating them into their solutions.

How does it work?

It’s done using exactly the same call you use to create a standard Microsoft Teams meeting: Create onlineMeeting. The difference is the inclusion of an additional property in the request body:Â “isBroadcast”: true, plus some optional broadcast settings.

What Permissions do I need?

You don’t need any more permissions than you would to create a normal Teams meeting: OnlineMeetings.ReadWrite.

This is either a Delegated user permission, or it can also be an Application permission, but only if an Application Access Policy is used.

If you don’t know what an Application Access Policy is, and why it’s different from a normal Application Permission (and gets around the problem of needing a user to be present in situations where they aren’t), check out my blog post: You can now create Microsoft Teams meetings as an application without users needing to be present: hereâs how to use Application Access Policy

What settings can I configure?

There are 5 broadcast settings options for live events:

Property	Type	Description
allowedAudience	broadcastMeetingAudience	Defines who can join the live event. Allowed values are: everyone, organization,Â roleIsAttendee. The first two are obvious, but the final one means only the people listed as participants in the create call.
isRecordingEnabled	Boolean	Indicates whether recording is enabled for this live event. Default value isÂ `false`.
isAttendeeReportEnabled	Boolean	Indicates whether attendee report is enabled for this live event. Default value isÂ `false`.
isQuestionAndAnswerEnabled	Boolean	Indicates whether Q&A is enabled for this live event. Default value isÂ `false`.
isVideoOnDemandEnabled	Boolean	Indicates whether video on demand is enabled for this live event. Default value isÂ `false`.

These are specified in a broadcastSettings array.

Here’s a complete example:

POST https://graph.microsoft.com/beta/me/onlineMeetings
Content-Type: application/json

{
"subject":"My New Live Event",
"startDateTime":"2020-12-02T14:30:34.2444915+00:00",
"endDateTime":"2020-12-02T15:00:34.2464912+00:00",
"isBroadcast": true,
"broadcastSettings": {
"allowedAudience": "everyone",
"isRecordingEnabled": true,
"isAttendeeReportEnabled": true,
"isQuestionAndAnswerEnabled": true,
"isVideoOnDemandEnabled": true
}
}

Here’s a security gotcha!

This API call does not respect any restrictions on live event creation set by policy. What does this mean? If you use Set-CsTeamsMeetingBroadcastPolicy to create a live event policy and then apply it to users using Grant-CsTeamsMeetingBroadcastPolicy, whatever you set for that policy is ignored by these API calls. If you specified that users couldn’t create live events that were available outside your organisation for instance, this API call ignores that and will let them create them anyway. I would expect this issue to be fixed pretty soon, certainly before the API goes GA.