You can now create Live Events via Microsoft Graph API

Exciting news for developers of applications which make use of Microsoft Teams Live Events and want to automate the process of automating Live Events. You can now programmatically create Live Events via the Microsoft Graph API. From the Microsoft Graph Changelog:

This functionality is still in beta, with an important security known issue, but it means that developers everywhere can start playing with these API calls and integrating them into their solutions.

How does it work?

It’s done using exactly the same call you use to create a standard Microsoft Teams meeting: Create onlineMeeting. The difference is the inclusion of an additional property in the request body:  “isBroadcast”: true, plus some optional broadcast settings.

What Permissions do I need?

You don’t need any more permissions than you would to create a normal Teams meeting: OnlineMeetings.ReadWrite.

This is either a Delegated user permission, or it can also be an Application permission, but only if an Application Access Policy is used.

What settings can I configure?

There are 5 broadcast settings options for live events:

Property	Type	Description
allowedAudience	broadcastMeetingAudience	Defines who can join the live event. Allowed values are: everyone, organization, roleIsAttendee. The first two are obvious, but the final one means only the people listed as participants in the create call.
isRecordingEnabled	Boolean	Indicates whether recording is enabled for this live event. Default value is false.
isAttendeeReportEnabled	Boolean	Indicates whether attendee report is enabled for this live event. Default value is false.
isQuestionAndAnswerEnabled	Boolean	Indicates whether Q&A is enabled for this live event. Default value is false.
isVideoOnDemandEnabled	Boolean	Indicates whether video on demand is enabled for this live event. Default value is false.

These are specified in a broadcastSettings array.

Here’s a complete example:

POST https://graph.microsoft.com/beta/me/onlineMeetings
Content-Type: application/json

{
"subject":"My New Live Event",
"startDateTime":"2020-12-02T14:30:34.2444915+00:00",
"endDateTime":"2020-12-02T15:00:34.2464912+00:00",
"isBroadcast": true,
"broadcastSettings": {
"allowedAudience": "everyone",
"isRecordingEnabled": true,
"isAttendeeReportEnabled": true,
"isQuestionAndAnswerEnabled": true,
"isVideoOnDemandEnabled": true
}
}

Here’s a security gotcha!

This API call does not respect any restrictions on live event creation set by policy. What does this mean? If you use Set-CsTeamsMeetingBroadcastPolicy to create a live event policy and then apply it to users using Grant-CsTeamsMeetingBroadcastPolicy, whatever you set for that policy is ignored by these API calls. If you specified that users couldn’t create live events that were available outside your organisation for instance, this API call ignores that and will let them create them anyway. I would expect this issue to be fixed pretty soon, certainly before the API goes GA.