Required Permissions

When using either Microsoft Runbook or Microsoft PowerShell the following permissions are granted automatically:

Component	Permissions granted	Purpose
Nimbus App	on each run of the script/runbook	Retrieves information about MS Teams users, their team memberships and roles, group memberships
Team Bot	on each run of the script or when the new team is created by runbook	Responsible for the team calls (regardless of team/workflow configuration)
Media Bot	on each run of the script/runbook	Allows to make Voice Message recordings

Team users or Tenant admins can manually grant further rights via the Service Settings. These permissions are mostly needed for additional features such as Attendant Console.

Permissions required for operation

Permission	Nimbus App	Team Bot	Media Bot	Nimbus UI	Permission Type	Needed for
Can be granted by	Tenant Admin			User
Calls.AccessMedia.All	-			-	Application	Team Bot - DTMF tones MediaBot - Record VM
Calls.Initiate.All	-		-	-	Application	Team Bot - Contact Users (Distribute Calls)
Calls.InitiateGroupCall.All	-		-	-	Application	Team Bot - Contact Users (Distribute Calls)
Calls.JoinGroupCall.All	-			-	Application	Join an escalated Call
Group.Read.All		-	-	-	Application	Get Team Members, Read Security Groups
User.Read.All		-	-		Application	Nimbus App - Get CallerInformation Nimbus UI - Full Search Users
Calendars.Read	-	-	-		Delegated	Attendant Console: Read Calendar of the logged-in user show Calendar with appointments
Calendars.Read.Shared	-	-	-		Delegated	Attendant Console: Read Shared Calendars to show Calendar with appointments
Contacts.Read	-	-	-		Delegated	Attendant Console: Search in the Exchange Contacts of the logged-in user
Contacts.Read.Shared	-	-	-		Delegated	Attendant Console: Search in the Shared Exchange Contacts
Presence.Read.All	-	-	-		Delegated	Show Presence in Contact Search on Attendant Console page
User.Read	-	-	-		Delegated	Get UserInformation (from logged in user)
User.ReadBasic.All	-	-	-		Delegated	Limited User Search

Runbook Permissions

The following permissions are required when you need to provision multiple teams via Runbook.

Microsoft.Web/connections/write
Microsoft.Logic/workflows/write

Microsoft.Automation/automationAccounts/write
Microsoft.Automation/automationAccounts/variables/write
Microsoft.Automation/automationAccounts/credentials/write
Microsoft.Automation/automationAccounts/runbooks/write
Microsoft.Automation/automationAccounts/modules/write

Microsoft.Resources/deployments/*
Microsoft.Resources/subscriptions/resourceGroups/*

CODE

Note: There are also Required User Permissions that need to be granted individually by each Nimbus service user.