Genesys Cloud - Developer Community!

 View Only

Sign Up

  • 1.  Issues with Update the presence of a Microsoft Teams in Genesys

    Posted 7 days ago

    Hi,

    I'm trying to implement the blueprint Update the presence of a Microsoft Teams user based upon an inbound interaction, but I've hit a permissions constraint that changes the architecture significantly.

    The constraint: Our Azure AD app can only be granted Presence.ReadWrite.All as a Delegated permission - not Application. This means we cannot update a user's presence using an app-only (client credentials) flow. Instead, every presence update must be performed on behalf of the signed-in agent, using the OAuth 2.0 Authorization Code flow.

    What this means for the implementation:

    1. The agent must authenticate via browser (Authorization Code flow), consent, and get redirected back with an auth code.
    2. That code is exchanged for an access token + refresh token using our app's client_id/client_secret.
    3. The access token is then used to call: POST https://graph.microsoft.com/v1.0/me/presence/setUserPreferredPresence
    4. Since access tokens are short-lived, we'd need to persist the refresh token (securely) per agent so we can silently mint new access tokens when the inbound interaction trigger fires later - without asking the agent to log in every time.

    My questions to the community:

    • Has anyone implemented delegated-permission OAuth flows in combination with Genesys Cloud Data Actions or Integrations, where the token exchange happens once (e.g., at agent login/shift start) and the token/refresh token is then stored against the agent for later use by an automated trigger?

    thanks in advance!

    Amira


    #Integrations

    ------------------------------
    Amira Abdellatif
    DevOps Engineer
    ------------------------------


  • 2.  RE: Issues with Update the presence of a Microsoft Teams in Genesys

    Posted 2 days ago

    hi @Amira Abdellatif, 

    We've run into a similar challenge when integrating Genesys Cloud with Microsoft Graph APIs that only support delegated permissions.

    The main limitation is that Genesys Cloud Data Actions and most native integration patterns are designed around either:

    • Static credentials/API keys
    • OAuth client credentials (application permissions)
    • Secure calls to an intermediary service

    They are not ideal for managing and refreshing per-agent delegated OAuth tokens.

    In your scenario, I would avoid storing refresh tokens directly within Genesys Cloud. Instead, I would consider introducing a lightweight middleware layer that:

    1. Performs the Authorization Code flow when the agent first signs in.
    2. Securely stores the access/refresh tokens in an external vault or database.
    3. Maps the Teams user to the corresponding Genesys Cloud user.
    4. Handles token refresh automatically when triggered by Genesys Cloud.
    5. Exposes a simple API endpoint that Genesys Cloud Data Actions can invoke.

    This approach keeps OAuth lifecycle management outside of Genesys Cloud and avoids the complexity of maintaining delegated tokens within Architect flows or Data Actions.

    Another consideration is Microsoft Teams presence ownership. Since delegated permissions operate in the user's security context, you'll need to ensure refresh tokens remain valid across sign-outs, password changes, MFA policies, and conditional access requirements. In practice, these operational aspects often become more challenging than the actual Graph API integration.

    From an architecture perspective, a serverless component (Azure Function, Logic App, or API App) acting as the token broker has worked well in environments where application permissions were not available.

    I'm curious whether you've evaluated the native Genesys Cloud for Microsoft Teams integration and if there's a specific business requirement that prevents using presence synchronization through the standard integration path. Understanding that constraint may help identify a simpler alternative.



    ------------------------------
    Cesar Padilla
    INDRA COLOMBIA
    ------------------------------



  • 3.  RE: Issues with Update the presence of a Microsoft Teams in Genesys

    Posted 2 days ago

    Hi Amira,

    Interesting use case. From a support perspective, I also think Cesar's point about keeping the token lifecycle outside Genesys Cloud is important, especially when troubleshooting an integration involving multiple platforms.

    Having a clear separation between Genesys Cloud, the middleware/token management layer, and Microsoft Teams would also make it easier to isolate where a failure is occurring.

    I'm also interested to know whether the native Genesys Cloud for Microsoft Teams integration was considered and what specific presence behavior requires the custom approach.

    Thanks for sharing this scenario.



    ------------------------------
    Mcel Turalba | Genesys
    Support Product Engineer
    ------------------------------



Related Content