Provisioning via Microsoft PowerShell

šŸ’”We automated the provisioning steps in a PowerShell script for you. It will connect to our environment and get the needed changes applied to your infrastructure.

PLEASE READ BEFORE YOU START

The PowerShell script needs to be run by aĀ tenant admin. Please note:

  • The script will automatically applyĀ Required App PermissionsĀ used by Nimbus.
  • The following modules are used / installed on your machine when running the script:
Module
1 MicrosoftTeams
2 MSAL.PS
3 Microsoft.Graph.Authentication
4 Microsoft.Graph.Applications
5 Microsoft.Graph.Identity.DirectoryManagement
6 Microsoft.Graph.Users
7 Microsoft.Graph.Users.Actions
  • The script is built and tested for PowerShell 5.1 (you can check the version via the "Get-Host" command). Other versions of PowerShell are not supported and may cause problems.
    šŸ” Also refer to the "Troubleshooting" section on the bottom of this page.
  • The script uses a checksum verification based on the MD5 algorithm - if you have policies like FIPS compliancy enabled on your computers which do not allow the usage of MD5, then you may encounter an error during the version check.

šŸ’” Tip: The script run is also needed when certainĀ Service SettingsĀ change (Service Display Name, Service UPN, and PSTN number).Ā Keep the script session window open if you want to test settings. By doing so you don't need to go through all steps again when you need to provision multiple teams.

Ā 

Microsoft Graph PowerShell Permissions

Microsoft Graph PowerShell Permissions

The Microsoft.Graph.* modules which are used by the Provisioning Script require the user to have the permissions that need to be granted for the Microsoft Graph PowerShell Enterprise application:

Permission

Permission

Type

Granted By Purpose
Application.ReadWrite.All Delegated Tenant Admin Read and write all applications
AppRoleAssignment.ReadWrite.All Delegated Tenant Admin Manage app permission grants and app role assignments
DelegatePermissionGrant.ReadWrite.All Delegated Tenant Admin Manage all delegated permission grants
Domain.Read.All Delegated Tenant Admin Read domains
Organization.Read.All Delegated Tenant Admin Read organization information
User.ReadWrite.All Delegated Tenant Admin Read and write all users' full profiles
openid Delegated Tenant Admin Sign users in
profile Delegated Tenant Admin View user's basic profile
offline_access Delegated Tenant Admin Maintain access to data you have given it accessĀ 

Ā 

Script Overview

Below is an overview of the steps performed by our provisioning script

Ā 

An overview of our provisioning script

Provisioning - Step by Step

Script download

Get the provisioning script via direct link below. Pick the link depending on the chosen location:

INC Nimbus Provisioning Script URLs

SCRIPT REGIONS

šŸ¤” Which region do I pick?Ā Pick the correct script according to the (future or already existing) region of your tenant data.Ā Refer toĀ Nimbus InstallationĀ > "Service ProvisioningĀ ".Ā 

šŸ¤” What will this script do?Ā Automate and guide you through the Azure-related setup on your Tenant. Refer to the detail steps below.

šŸ’” You may have a look inside the script and compare the different scripts we provide, but manual edits are not required.Ā Ā Ā Ā 
šŸ’” When executed the script will check for updates and may request you to download the newest version.Ā Ā Ā Ā 
šŸ’” Once a Nimbus team has already been provisioned yĀ ou can also find a script "Download" buttonĀ located within theĀ User Preferences (Portal).

Ā 

Script Details

āœ… TENANT ADMINĀ To execute the scriptĀ Tenant AdministratorĀ credentials must be provided (→ 'Global administrator' role).Ā 

šŸ” Refer to the diagram above for an overview. During execution and depending on pendingĀ Service SettingsĀ changes the script will perform theĀ steps below:

  • Connect to Microsoft Graph, Microsoft TeamsĀ and your Nimbus tenant.
  • Grant the needed consentĀ for the main Nimbus application, this will allow Nimbus to read user and team details in the tenant and record voice messages if the latter is configured for the team. → See:Ā Required App Permissions
  • Create, update or delete an Application InstanceĀ and grant the required consent to it to be able to set up conversations.
  • Associate or remove Phone System license šŸ” Refer toĀ Installation PrerequisitesĀ >Ā PSTN licensing for details.
  • Apply an Online Voice Routing PolicyĀ from the ones defined and selectable on your tenant. This is only required for Nimbus services which are using a Direct Routing phone number.
  • Add, update or delete PSTN phone number. ā˜ Note that a PSTN number causes additional license cost by Microsoft. Get in touch with your local O365 integrator.
  • Lastly the script willĀ applyĀ Service SettingsĀ - either new or future changes made by you or any service team owners (e.g. a name, UPN, or phone number change).
Pending changes on a Service will inform about a necessary Script-rerun

DONE?

→ After execution, the Script reports back to Nimbus. If everything was successful all changes are reflected in theĀ Service Settings.

šŸ’” Please allow for a few minutes before making calls to a newly (re)configured Application Instance or PSTN number as it might take a moment for Microsoft Azure services to synchronize all the changes.Ā Ā 
šŸ’” Note that a rerun of this script is necessary forĀ every additionalĀ Service and/or within your tenant.

Ā 

Script Execution

  1. Execute the scriptĀ and wait for the connection to Microsoft Graph, Teams, and Nimbus. šŸ’” If the script is not up-to-date you will be requested to download the latest version.
  2. When requested to login, provide your tenant admin credentials
Login Request
  1. You may be asked for your admin consent on the first run of the script. šŸ’”When using a Global Admin account you can grant theseĀ PermissionsĀ for your entire organization, so other administrators do not need to repeat this step.
Permission request dialog
  1. The script will now proceed to grantĀ Required App PermissionsĀ to the Nimbus App on your tenant:
  • If this has already been done by a tenant admin in theĀ Nimbus InstallationĀ chapter, this isĀ notĀ required again.
  • Potentially missing calling bot permissionsĀ (required e.g., for establishing sessions and postingĀ Adaptive CardsĀ to your Teams) will also be regrantedĀ automatically.
Permission grant process
  1. ⮑ The Script now checks whether any Nimbus services have been added, changed in the respectiveĀ Service SettingsĀ , or deleted since the last time the script was run.Ā 
    6. All services with pending changes will be shown as either Delete, Create or Update. You can then choose one of the two options.
    • I -Ā per Team individually - you can inspect and confirm each change.
    • A -Ā for all Teams - all changes are auto-confirmed. ā˜ Please note that PSTN licenses will be applied automatically as long as they are available - first come, first serve base.
  2. Carry on with the next stepĀ for further technical details.

PSTN Licenses and Voice Policies

The following steps apply only if your Nimbus service has a PSTN number assigned to it via its Service Settings.

Ā 

PSTN License

Voice Policy

The script allows you to choose how you would like to apply the required Phone System license to a service (Application Instance).

Ā 

Ā 

The script will ask before anyĀ Online Voice Routing PolicyĀ should be applied to a service (Application Instance).Ā Ā Ā Ā Ā 
šŸ” This is only required if your service is using a Direct Routing phone number. If you are using a phone number provided through Calling Plans or Operator Connect, you can skip the voice policy assignment.

Ā 

Ā 

You have the following options:

  • Automatic Assignment - Let the script assign a 'Microsoft Teams Phone Resource Account' license automatically.
    ā˜ Ensure that your account has the required permissions to perform this action.
  • Manual Assignment
    ⮑ The script will wait for you to manually assign the license (e.g., via the M365 portal), then performs a check after you have pressed Enter.
  • SkipĀ (no license and phone number will be assigned)

You have the following options:

  • WhenĀ NoĀ is selected, no changes will be applied.
  • WhenĀ YesĀ is selected, available Online Voice Routing Policies from your tenant are polled.Ā Ā Ā Ā Ā 
    → You will be requested to confirm the Online Voice Routing Policy name to assign it.Ā Ā Ā Ā Ā 
    šŸ” When choosing the policy, please use the full name including ā€œTag:ā€
šŸ’” Via the same script functionality you can also remove Phone System licenses from Nimbus services. šŸ’” The script will only ask for an Online Voice Routing Policy assignment when a phone number is added or changed. If you wish to manually change the policy later on, you can do this via theĀ Grant-CsOnlineVoiceRoutingPolicyĀ command.

Script Conclusion and Rerun

When everything runs as expected you will seeĀ green DONE indicators and the script finishes.

Script conclusion and rerun dialog

šŸ’” At the end you will be asked if youĀ want to rerun the script:

  1. You want to keep the script instance open until all Service changes are complete, so you don't need to authenticate again.
  2. For each further pending change in theĀ General Service Settings (e.g. in dialog with your Service Team Owners)Ā the PowerShell instance can be run again until you are satisfied with the results.

Verifying changes via Test Call

Please allow for at least 5 minutes after applying script changes before making the call.

Ā 

To test the call functionality:Ā 

  1. Ensure that team members (service users) are Available for the called team and be set to Active in theirĀ Nimbus Dashboard.
  2. Open General Service Settings on the service you want to test.
  3. Click on Test Call → The UPN of the service will now be called via Team Client.
Test call option in the service settings

šŸ’” You can test this with 2 different Microsoft Teams client accounts in separate browser windows to simulate this call on your own as both caller and recipient.

šŸ’” If you have assigned a PSTN license / phone number to the service it is also recommended to test calling it.

PSTN Limitations

INC Transfer to PSTN Limitation

ā˜Nimbus and related addons can only perform PSTN transfers according to Microsoft's licensing and constraints.
āœ… As Administrator you need to acquire Microsoft Teams phone licensesĀ 

šŸ¤”Which PSTN licenses do I need to acquire?

Service Licensing

Target Service
using any of the Microsoft | PSTN Connectivity options ā–¼
Ā Licence to apply for Nimbus Services
Direct Routing

ā€œTeams Phone Resource Accountā€


šŸ”ŽĀ  See:Ā 

Calling Plan

ā€œTeams Phone Resource Accountā€ license, plus

  • "Microsoft Teams Domestic Calling Plan" OR
  • "Microsoft Teams Domestic and International Calling Plan" OR
  • ā€œMicrosoft Teams Calling Plan pay-as-you-goā€1 PLUS
  • "Communication Credits" (if these aren't already included as part of your plan)

šŸ”ŽĀ See: Microsoft Learn | Ā Microsoft Teams Calling Plans

1 Only required for Outbound Call functionality, also see ā€œAhead notice Pay-as-you-go Calling Plan licensing changesā€ below.

Operator Connect
Ā 

ā€œTeams Phone Resource Accountā€


šŸ”ŽĀ See: Microsoft Learn | Operator Connect Plan

User Licensing

Target User License to apply to Nimbus Users & Call Targets
All Users, including …
+ Agents that handle Nimbus calls
+ Attendant Console transfer and consultation targets.

ā€œTeams Phone Standardā€, each account having: ā€œEnterpriseVoiceEnabledā€


šŸ”ŽĀ  See: Microsoft Learn | Teams Phone Standard

ā˜Please note that Luware staff cannot give recommendations on which license plan is best suited for your needs. Depending on your scenario, additional Teams App licenses may be required. Exact details are to be discussed with your Microsoft contacts.

Ā 
Ā 
Ā 

šŸ¤”How does PSTN licensing affect Service and call transfers?

Assuming that the initially called Service has (no) PSTN license assigned - the following scenarios may unfold:

Scenario A - Service A has a PSTN license. Transfers to other Services occur.

⮑ The PSTN license carries over throughout transfers to other Nimbus Services B and C.
⮑ As the license carries over, a PSTN transfer to an external target is possible from either Service.

Scenario B - Service B has no PSTN license. A Transfer to Service C occurs which has a PSTN license.

⮑ The customer skips over Service A and manages to reach Service B instead.
⮑ The PSTN license is missing on Service B, so nothing is carried over to Service C.
⮑ Even if Service C has its own PSTN license, a PSTN transfer to an external target is not possible.

🌟Learnings:

  • Nimbus will use the PSTN license – and create a (transfer) Session – fromĀ the FIRST Service responding to a call.Ā 
  • Regardless of how many internal Service transfers are performed thereafter, the FIRST Service PSTN license remains in effect.Ā 
  • If a PSTN license is missing, the transfer task will fail and be treated accordingly by the System.1
  • Even if a Service being transferred towards has a PSTN license, it cannot be added in post, as the Call Session is already ongoing from the first-responding Service.

āœ… For your licensing needs this means: If you require PSTN transfer functionality, you'll need to ensure that this Service is handling all your incoming calls.

  • For ONE first-level / Front Desk Service, you'll need a PSTN license for this particular Service.
  • For MULTIPLE first-level Services scenario, you'll need PSTN licenses for all first-level Services.

1šŸ”Ž Assumption: Workflow takes the normal ā€œExitā€ Announcement route and Service Session will conclude with a ā€œTransfer failedā€ outcome. For more details on analyzing your Reporting results, refer to Nimbus Reporting and Static Dimensions > "Service Session Outcomes"

Ā 
Ā 

ā˜Note that handling and tracking of running cost for PSTN licenses is outside of the Luware support scope. If you however require assistance in extending and/or configuring your Nimbus Services for PSTN, our support will gladly assist you:

Luware Support Address

Ā Luware Website https://luware.com/support/
Luware Helpdesk https://helpdesk.luware.cloudĀ 
Cloud Service Status https://status.luware.cloud/
Luware support contact details
Ā 

INC PSTN License Check Enforcement Notice

ā˜Ahead Notice: Microsoft licensing changesĀ 

Amendment 03.09.2025: Added Operator Connect as affected customer base. Added clarification that Direct Routing customers are not affected.

Microsoft Licensing Change: What Nimbus Customers Need to Know About Calling Plan and Operator Connect Changes.

šŸ” What’s changing?

EffectiveĀ November 1, 2025:Ā 

  • Microsoft will enforce a significant licensing change that directly impacts how outboundĀ PSTNĀ calls are handled in Microsoft Teams—especially for services like Call Queues (CQ) and Auto Attendants (AA).
  • This change affects all organizations using Microsoft Calling Plans for telephony and it might affect organizations using Operator Connect.
  • The change has direct implications for Luware Nimbus customers in the following scenarios:

šŸ” What’s not affected?

  • There is no change for Direct Routing phone numbers.

šŸ” You will find the full announcement on the MSFT Learn page, specifically ā€œChanges to licensing required for Auto attendant and Call queue outbound PSTN callingā€. Ā Excerpt quoted below - important parts highlighted:

Calling Plan

Starting November 1, 2025, a Pay-As-You-Go license will be required for Teams Voice Applications (Call Queues and Auto Attendants) Resource Accounts that use Calling Plan numbers for outboundĀ PSTNĀ calls.

The following scenarios will require a Pay-As-You-Go license:

  • OutboundĀ PSTNĀ calls made by Teams Call Queue agents on behalf of a Resource Account
  • OutboundĀ PSTNĀ calls made by Auto Attendants or Call Queues
  • CallbackĀ PSTNĀ calls initiated from Teams Call Queue or Teams Auto Attendant
  • On-behalf-of calls made via Graph API and Phone System Extensibility

If Pay-As-You-Go licenses aren't assigned to the relevant Call Queue or Auto Attendant Resource Accounts by November 1, 2025, outbound calls will fail.


Operator Connect

On November 1, 2025, the following outbound calling scenarios may no longer be available depending on your carrier/operator:

  • OutboundĀ PSTNĀ calls made by Teams Call Queue agents on behalf of a Resource Account
  • OutboundĀ PSTNĀ calls made by Auto Attendants or Call Queues
  • CallbackĀ PSTNĀ calls initiated from Teams Call Queue or Teams Auto Attendant
  • On-behalf-of calls made via Graph API and Phone System Extensibility

Coordinate with your carrier/operator to ensure you continue to have uninterrupted service for these on-behalf-of outbound PSTN call scenarios. If the appropriate arrangements aren't made with your carrier/operator, then outbound calls made by agents on behalf of resource accounts, by auto attendants or call queues or via the Graph API and Phone System Extensibility will fail.

Your carrier/operator provides the details on what adjustments may be required.

šŸ¤”How does this affect Nimbus?Ā 

Nimbus uses bots to initiate and monitor conferences well as monitor and report any Outbound Call calls and Call On Behalf of a Nimbus Service. Any transfer scenario also requires the Nimbus bot to take calls back safely.

This includes:

  • CQ agents making calls on behalf of a Resource Account (RA)
  • Callback scenarios configured in Call Queues
  • Auto Attendants transferring calls externally
  • Calls initiated via Graph API or Phone System extensibility

🧭 What is the Impact for Luware Nimbus Users?

For customers using Microsoft Telephony exclusively and leveraging Call On Behalf features via Luware Nimbus, this change means:

  • You must replace existing Calling Plan / Operator connect licenses on resource accounts with Pay-As-You-Go licenses.
  • Failure to do so will result in service interruptions for Outbound Calls initiated by Nimbus services, e.g. within either Attendant Console, Workflows in Contact Center routing.
  • As highlighted in internal discussions with Microsoft, this enforcement aims to curb misuse but inadvertently affects legitimate use cases like those supported by Luware Nimbus.
Ā 
Ā 

āœ… What you need to do

āœ…To ensure uninterrupted service: We urgently recommend for Customers begin transitioning to Pay-As-You-Go licenses well before November 1st to avoid last-minute disruptions.

  1. Review all resource accounts configured for outbound PSTN calls.
  2. Assign Pay-As-You-Go calling plan licenses to these accounts via the Microsoft 365 Admin Center.
  3. Validate license coverage for all users and services involved in call transfers.
  4. Consider setting up Communication Credits to fund Pay-As-You-Go usage if needed.

šŸ“ž Need Help?

If you’re unsure how this change affects your setup or need assistance updating your licensing, please reach out to your Luware Customer Success Manager or contact our Support Team.

INC Luware Support Address

Ā Luware Website https://luware.com/support/
Luware Helpdesk https://helpdesk.luware.cloudĀ 
Cloud Service Status https://status.luware.cloud/
Luware support contact details
Ā 
Ā 

Ā Troubleshooting & Known Issues

FIRST-TIME SCRIPT EXECUTION

When the script is run for the first time on a given machine it will try to install the required PowerShell modules if they aren't already available.Ā 
→ This may require you to run the script as a local administrator:Ā  Right click on the "Windows PowerShell" item in Windows search and select "Run as administrator".Ā 

Ā 
Issue / Error Analysis/Workaround

Error shown:

"Script cannot be loaded because running scripts is disabled on this system."

This error will occur if your local script execution policy does not allow running signed scripts.
→ Workaround: Changing execution policy to "RemoteSigned" will help to solve this, please check theĀ Microsoft DocumentationĀ for more details.

During Service Name Change:Ā The script may encounter an error when trying to update the display name of a service.

→ Workaround: Change the Display Name of the User Object via Microsoft 365 or Microsoft Entra ID. This information will be synchronized with Microsoft Teams. This process can take a few days until the changes are visible in the Microsoft Teams Client.Ā 

Powershell fails to open popup window when authenticating to Nimbus.Ā 

Ā 

Ā 

Reported issue on MSFT side Ā https://github.com/AzureAD/MSAL.PS/issues/58 affecting users that default into the new ā€œTerminal Previewā€.Ā 

→ Workaround: Run the script either via the classic Terminal or Powershell ISE.
Ā 

Ā 

Table of Contents