Microsoft Teams Web Credentials

In some organizations, Microsoft Teams meetings are configured to only allow signed-in participants. If this policy is active in your tenant, Sally cannot join as a guest user.

To fix this, you can authenticate Sally using a Microsoft Teams account. This allows Sally to join meetings using your organization’s credentials.

Important clarification

Using a Microsoft Teams user account for Sally is not a general requirement to use Sally.

This step is only necessary if your organization’s Microsoft Teams configuration requires that only signed-in users are allowed to join meetings.

If your tenant allows guest or anonymous participants, Sally can join meetings without a dedicated Microsoft account.

Quick Navigation

1. Create a dedicated Teams account for Sally
2. Set up the Teams credentials in Sally
3. Important notes
4. Technical background (for admins)

1. Create a dedicated Teams account for Sally

In order for Sally to join Microsoft Teams meetings that require signed-in participants, you must first create a dedicated Microsoft 365 user account for her.

This setup is done entirely in the Microsoft 365 Admin Center.

Step 1.1: Purchase or verify a Microsoft 365 license

If your organization already has active Microsoft 365 Business or Office 365 subscriptions that include Teams, you can skip this step.

Otherwise:

1. Go to the Microsoft 365 Business plans overview.
2. Purchase a Microsoft 365 Business Basic (or higher) license. This plan includes Microsoft Teams.
3. Follow the checkout process and sign in with your admin credentials.
   Microsoft may ask you to configure your organization name, domain, and payment details.
4. Once the purchase is complete, sign in to the Microsoft 365 Admin Center at admin.microsoft.com.

Alternative: If your company manages licenses via Azure, you can also start from the Azure account setup page and purchase Microsoft 365 licenses there.

---

Step 1.2: Create a new user for Sally

1. In the Admin Center, navigate to Users → Active users → Add a user.

Add a user

2. Enter the account details — you can freely choose the display name, as it will appear in Teams meetings exactly as entered:
   • Display name: e.g. Sally (Meeting Assistant)
   • Username (email): e.g. sally.bot@yourcompany.com
   • Password: set a strong, non-expiring password.
3. Do not assign any admin roles or special permissions - a standard user account is sufficient.
4. Click Next.

warning

Use a separate user account for Sally.

Do not use your own Teams account - Microsoft Teams does not allow the same user to join a meeting twice.
Sally would fail to connect if you are already in the call with that account.

---

Step 1.3: Assign a Teams-enabled license

1. In the user creation flow or afterwards, open Licenses and apps.
2. Assign a license that includes Microsoft Teams (e.g. Microsoft 365 Business Basic).
3. Save changes.

If all licenses are in use:

• Go to Billing → Licenses.
• Select an existing user (for example, your admin account).
• Click Unassign license and then Reassign it to the new Sally account.
• If prompted to purchase an additional license, wait a few minutes - Microsoft sometimes needs time to release the freed license before reassigning.

Assign a Teams-enabled license

---

Step 1.4: Adjust Microsoft Tenant Security Settings (Required)

info

This step is technically required to ensure that Sally can reliably and automatically sign in to Microsoft Teams.

Microsoft Teams is primarily designed for interactive user sign-ins.

An automated meeting assistant like Sally cannot respond to additional security prompts that are intended for human users (such as MFA challenges, session confirmation dialogs, or password reset requests).

To allow Sally to join authenticated meetings reliably and without manual intervention, certain tenant-wide security features must be disabled.

Important

Apply these settings only to a dedicated Sally account or a separate tenant.
Do not apply these configurations to productive user accounts.

1.4.1 Create an Azure Pay-As-You-Go Account

info

Some security-related settings are only available when an Azure account is linked to the tenant.

Sign in to the Azure portal using an administrator account:
https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account

---

1.4.2 Disable Security Defaults

Security Defaults automatically enforce additional security mechanisms such as:

• Multi-Factor Authentication (MFA)
• Risk-based sign-in checks
• Extended authentication prompts

These mechanisms cannot be handled by automated systems.

Steps:

1. Open Microsoft Entra ID
2. Navigate to Overview → Properties
3. Select Manage security defaults
4. Set Security Defaults to Disabled

Assign a Teams-enabled license

warning

If Security Defaults remain enabled, sign-in attempts may fail at any time, preventing Sally from joining meetings.

---

1.4.3 Disable “Stay signed in?”

Microsoft often displays a “Stay signed in?” dialog during web-based logins.

Since Sally cannot perform user interactions, this dialog must be disabled.

Steps:

1. Open Users in Microsoft Entra ID
2. Navigate to User settings
3. Disable “Show ‘Stay signed in’ option”

Assign a Teams-enabled license

---

1.4.4 Disable Self-Service Password Reset (SSPR)

Self-Service Password Reset can trigger unexpected verification steps (such as security questions or email confirmations).

These processes are not suitable for automated sign-ins.

Steps:

1. Open Password reset
2. Navigate to Properties
3. Set Self-service password reset enabled to None

Assign a Teams-enabled license

---

Why this step is required

Sally signs in via the Microsoft Teams web interface.

The authentication process must therefore be deterministic and uninterrupted.

Security prompts that are useful for human users can cause bots to encounter:

• Login timeouts
• Rejected sessions
• Non-deterministic authentication failures

The adjustments above ensure that Sally can authenticate reliably, securely, and without manual intervention.

2. Set up the Teams credentials in Sally

1. Go to Settings.

Figure 1: Go to settings

2. Open the Meeting Assistant.
3. Scroll down to "Microsoft Teams Web Credentials (Optional)".

Figure 2: Sally using a Teams account for authenticated meetings

4. Enable the toggle “Enable authentication of Sally”.

5. Click Edit and enter a valid Microsoft Teams username and password that exist within your organization.

   info

   Before entering credentials in Sally, make sure that a dedicated Microsoft Teams user account for Sally has been created within your organization.
   Do not use your personal Microsoft Teams account — this will not work, as the same user cannot be present in a meeting twice.
   The dedicated account will be used exclusively for authentication and must have valid login credentials (username and password).

   
   
   warning

   About “Force usage of the Microsoft Bot Account”

   When enabled, Sally will always join meetings using the Microsoft Bot Account — even if authentication is not required.

   We do not recommend enabling this option, as it may cause excessive traffic through a single account and could potentially hit undocumented Microsoft limits.

   By default, Sally automatically uses the Bot Account only when necessary (e.g. when the meeting policy requires authenticated participants).

6. Click Save.

   info

   Please note that only administrators have access to this feature, and it applies organization-wide.

---

3. Important notes

• The provided account must be a valid internal user account.
  Guest accounts are not permitted to join meetings under strict tenant policies.
• If no suitable account exists, your IT team can create a dedicated user account for Sally within your Microsoft 365 tenant.
• Once configured, Sally joins authenticated meetings using this Teams account, which means:
  • The account’s profile picture and display name appear in the meeting.
  • The Sally bot name and background image are replaced by the authenticated user’s appearance.

---

4. Technical background (for admins)

When a Microsoft Teams tenant enforces the policy “Only authenticated users can join meetings”, all external bots (including Sally) must authenticate with a valid Microsoft Teams user identity. Without such authentication, Teams will automatically reject the bot connection and prevent it from joining.

Sally connects through the Microsoft Teams web interface, using the credentials you’ve provided under Meeting Assistant → Microsoft Teams Web Credentials.

During meeting participation, these credentials are used to:

• Establish a secure session via Microsoft’s OAuth flow.
• Generate the necessary Teams cookies and tokens for joining the call.
• Ensure compliance with your tenant’s meeting and access policies.

Once configured, the session is stored securely and refreshed automatically before expiration — no manual re-login is needed under normal circumstances.

4.1. Common admin questions

1. How are the credentials stored?
Credentials are stored in encrypted form and never transmitted in plain text. Authentication tokens are cached and renewed securely when required.

2. Does this grant Sally access to other Microsoft 365 resources?
No. Sally only uses the credentials for joining Teams meetings via the web interface. It does not access Outlook, SharePoint, OneDrive, or any other Microsoft 365 service.

3. Can we restrict the permissions of the account?
Yes — the Teams user created for Sally should have no administrative rights. A standard user account is sufficient for authentication and meeting participation.

4. What happens if the password changes or expires?
If the password is reset, the connection will fail until you update the credentials in Sally’s Meeting Assistant settings.
We recommend disabling password expiration for this dedicated bot account or setting a reminder to renew it periodically.

5. Can I use my own Teams account instead of creating one for Sally?
No. A personal or existing Teams account cannot be used for Sally authentication.
Teams does not allow the same user to join a meeting twice, so Sally would be unable to participate if those credentials are already in the meeting.

6. Why does the bot sometimes have “(Guest)” or “(External)” after the display name?
This label is added automatically by Microsoft Teams when the account is recognized as external to the tenant where the meeting is hosted.
To avoid this, make sure the Sally bot account is created and licensed within the same Microsoft 365 tenant as the meeting organizer.

7. Why does the bot have “(Unverified)” after the display name?
The “(Unverified)” tag appears when the account’s domain is not yet verified within Microsoft 365.
You can remove this by verifying your company domain in the Microsoft 365 Admin Center → Settings → Domains.

8. Does Microsoft Teams Essentials work for this setup?
No. The Teams Essentials plan does not include all APIs and authentication capabilities required for signed-in bot participation.
Use Microsoft 365 Business Basic or higher to ensure full compatibility.

9. Can we detect in advance when a signed-in bot will be required?
Yes — this depends on your organization’s Teams meeting policy.
If the meeting policy “Only authenticated users can join meetings” or “People in my organization only” is active, then a signed-in bot (with valid Teams credentials) is required.

10. Can we use our own Teams organization, or do we need a new tenant for every customer?
You can use your existing Teams organization. A separate tenant is not required.
Each Sally instance can be authenticated with a user that belongs to your own Microsoft 365 tenant.

11. Does a signed-in Teams bot work for all meeting types?
Yes - once authentication is configured, Sally can join any meeting type that supports standard Teams web access, including scheduled meetings, ad-hoc calls, and recurring sessions.