Connect your Microsoft Entra ID tenant so imper.ai can secure interviews on your organization's calendars and confirm that the candidate attended the Teams meeting.

This article covers the full tenant-wide setup, from top to bottom: approving imper.ai's permissions, granting access to Teams meetings, and verifying the connection. When you finish, imper.ai's access covers every user in your tenant.

---

What imper.ai Gets Access To

You approve the following Microsoft Graph permissions during setup. All of them are Application permissions: imper.ai authenticates as an application, does not need a signed-in user, and does not act as any individual employee.

Permission	What imper.ai uses it for
Calendars.ReadWrite	Detects scheduled interviews on participants' calendars and adds the candidate's verification link to the interview event. Not applicable to Greenhouse, which uses the secured interview address (proxy) method instead of the calendar.
User.ReadBasic.All	Reads basic directory profile information (user ID, display name, and email) to identify the interviewers on an invite.
OnlineMeetings.Read.All	Reads the Teams meeting the interview is held in, so imper.ai can match the meeting to the scheduled interview.
OnlineMeetingArtifact.Read.All	Reads the meeting's attendance report to confirm who attended. The report is available within minutes of the interview ending.
CallRecords.Read.All (retiring)	Reads the Teams call record as a fallback source of attendance, where an attendance report is unavailable.

NOTE

imper.ai will retire CallRecords.Read.All in the near future. Microsoft can take up to 5 days to publish a call record, so the attendance report is now the primary source of attendance. Approve CallRecords.Read.All for now. You will not need it once the retirement is complete.

---

Prerequisites

Before you begin, make sure of the following:

• Microsoft Entra ID administrator privileges (Global Administrator or Application Administrator), for approving the permissions.
• Teams Administrator privileges, for granting access to Teams meetings.
• Admin access to the imper.ai Admin Console.
• Your organization has approved third-party integrations with Microsoft Entra.
• PowerShell 7 or later with the MicrosoftTeams module installed.
• Your imper.ai Application ID, supplied by your imper.ai contact.
• Your Tenant ID:
  • Log in to the Azure Portal using your administrator credentials.
  • Navigate to Microsoft Entra ID > Tenant Properties.
  • Copy the Tenant ID.

---

Step 1 - Approve imper.ai's Permissions

1. Log in to imper.ai using your admin credentials or Single Sign-On (SSO).
2. Go to Settings > Integrations.
3. Navigate to Microsoft Entra , and click Connect. The Microsoft login pop-up opens.
4. Enter your Tenant ID and click Enter.
5. Click Open Link to be redirected to the Microsoft Authorization page.
6. Review the permissions listed in What imper.ai Gets Access To and approve them.
7. Once complete, the Installation Completed Successfully screen opens.

At this point, Calendars.ReadWrite, User.ReadBasic.All, and CallRecords.Read.All are active. The two Teams meeting permissions need one more step.

---

Step 2 - Grant Access to Teams Meetings

Approving OnlineMeetings.Read.All and OnlineMeetingArtifact.Read.All does not give imper.ai access to any meeting on its own. Before either permission can read a meeting, a Teams application access policy must name imper.ai's application. Run the commands below once, as a Teams Administrator, to create that policy and apply it across your tenant.

First, connect to Teams:

Connect-MicrosoftTeams

Then create the policy and apply it to every user:

$app_id = "<imper.ai Application ID>"
$policy_name = 'Imper-OnlineMeetings'

New-CsApplicationAccessPolicy -Identity $policy_name `
  -AppIds $app_id `
  -Description 'Imper interview attendance'

Grant-CsApplicationAccessPolicy -PolicyName $policy_name -Global

What this does: Creates a policy that names imper.ai's application, then applies it to every user in your tenant. imper.ai can then read the Teams meeting for any interview, and that meeting's attendance report, whoever organized it.

IMPORTANT

Propagation takes up to 2 hours. Microsoft caches application permissions, so attendance lookups fail until that cache refreshes. Interviews held during this window are not confirmed as attended.

---

Step 3 - Verify the Connection

Teams meeting access

Confirm that the policy exists and names your application:

Get-CsApplicationAccessPolicy -Identity $policy_name

Expected result: The output shows the Imper-OnlineMeetings policy with your imper.ai Application ID under AppIds.

NOTE

Do not verify this with Get-CsOnlineUser -Property ApplicationAccessPolicy. That property reports only a direct per-user assignment, so it reads as blank under a global grant, which looks the same as having no access at all.

imper.ai connection

After you connect, imper.ai automatically:

• Validates the Entra tenant.
• Pulls basic identity metadata.
• Confirms the domain.
• Displays the integration connection status.
• Shows the last sync timestamp.

If any required permission is missing, imper.ai displays a notification in the Integrations panel.

---

Troubleshooting

Interviews are secured, but attendance is never confirmed

The calendar permissions are working, but imper.ai cannot read the Teams meeting. Check the following:

• Less than 2 hours have passed since Step 2. Wait for propagation to finish.
• Step 2 was not run, or it ran with the wrong Application ID. Run Get-CsApplicationAccessPolicy -Identity 'Imper-OnlineMeetings' and compare AppIds with the value from your imper.ai contact.
• The interview was not held in Microsoft Teams. imper.ai confirms attendance only for Teams meetings.

New-CsApplicationAccessPolicy fails because the policy already exists

The policy was created earlier. Run only the Grant-CsApplicationAccessPolicy line, then verify it as described in Step 3.