Learn how Microsoft makes Teams call record data available and how to get that data into Splunk with Azure Functions

Transcript

Auto-generated captions, lightly cleaned. Speakers are not separately labeled.

do you want to monitor the Microsoft teams call Quality data with Splunk we’ll stick around and I’ll show you how to do that with Azure [Music] functions so Microsoft teams makes a lot of call Quality data available but getting that data can be somewhat of a challenge because there’s a lot of pieces involved don’t worry because I’m going to show you everything you need to know to get through it so at a high level there are three main pieces involved there is a change notification subscription A specialized web hook and a rest client now the change notification subscription it listens for changes to Microsoft teams calls in the Microsoft environment and it sends a notification to a specialized web Hook when these changes happen for example when a call ends the web Hook is notified about that event and I say this is a specialized web hook because it has to respond in a certain way with certain return codes and it has to implement specific validation logic it also has to be publicly available and https secured without any private certificates and it has to be addressable with a URL and finally the rest client will periodically read the IDS received by the web hook and make a call to the Microsoft graph API to retrieve the full call record it then sends this data to Splunk indexer and we’re going to use Azure functions to implement all of these pieces and Azure functions they’re just serverless code that runs in your Azure tenant now the functions are triggered by some event like a timer or an HTTP post or an item added to a queue things like that then the function code runs to do whatever you want it to do and finally the function can output results and the trigger and the output are typically called bindings in Microsoft terms now to get the Microsoft teams data we have four main functions the create subscription function sets up our change notification subscription and the subscription web hook function implements the specialized web hook now when the web hook receives a notification it drops the notification into a notification CU and the process notification CE CU function is triggered when a notification arrives on the cube now the function code implements the rest client to retrieve the full call record from the Microsoft graph API it then sends this data to Splunk via the HTTP event collector so this is a push from Azure to Splunk and finally the update subscriptions function keeps our change notification subscription up to date because change notification subcriptions can expire if not updated okay let’s set all of this up the first thing we need to do is to create an HTTP event collector listener on our Splunk instance to do that we’ll navigate to settings data inputs HTTP event collector and click new token we’ll give the token a name and click next you can leave the source type as automatic and select the default index for the data and click the review button click the submit button and then make a note of the token value as we’ll need that later the aure functions will need to retrieve the call records from the Microsoft graph API so we’re going to take a bit of a detour to talk about Microsoft API graph authentication so the graph API authentication is done with something called an app registration and an app registration is a lot like a user account but instead of a username and password the app registration has a client ID and a client secret and a tenant ID the add-on will use this information to connect to the Microsoft graph API to create an app registration we go into the AER portal and from there we navigate to Microsoft intra ID and then app registrations I’ll create a new registration and give it a name and we can leave everything else as default and click the register button from here we can see our applic a ID and our tenant ID but now we need to generate a secret to do that I’ll click on certificates and secrets and new client secret you give the secret a name and an expiration time and then click add this brings up the value of the secret now this is similar to a password and it’s the only time we’ll see it here in the portal so I’ll copy this now and save it to a document for later now while we’re here I’ll go ahead and assign the necessary permissions to the app registration so this app registration will handle our change notification subscription and I’ll also use this app registration to retrieve call records to assign the permissions I’ll go to API permissions add a permission and these are Microsoft graph permissions so I’ll choose Microsoft graph the first permission is a delegated permission named subscriptions. read. all so I’ll select that and click the add permissions button the other permission we need is an application Level permission named call records. read. all so I’ll add that in the same way at this point the permissions have been assigned but they have not yet been granted if you’re logged into the Azure portal as an admin you can click the grant admin consent button here to finish things up the next step is to deploy the Azure functions to your environment to do this navigate to the GitHub repository listed below and click the graph folder scroll down the page a bit and click the deploy to Azure button this will launch the deployment in your Azure environment from here select an existing Resource Group or create a new one give the app name and note that this has to be a globally unique name for the Splunk endpoint enter your Splunk HTTP event collector URL this is typically the address of your Splunk instance on Port 8088 followed by SLS Services SLC collector next enter the token we created earlier and finally enter the client ID and secret from the app registration we created and click the next button a validation will run on the Microsoft side to make sure everything is okay okay and if everything goes well there click the create button what is happening at this point is the Azure portal is reading the deployment template from the GitHub repository and deploying all the necessary components to run the Azure functions now that the functions are deployed we need to create the change notification subscription to do that click on the go to Resource Group button choose the function app click the create subscription function and select the git function URL button and then finally copy the URL next we’ll paste that URL into a browser and the subscription details should be displayed in your browser all right so we have everything set up so I’m going to start a teams call to test this from end to end I’m going to start the call on this workstation and join it from another browser okay so here is our team’s call record and there is a lot of data in here you have information about the organizer all the participants and most importantly the session which has things like Jitter and packet loss and frame rates and roundtrip time and all sorts of user experience data so to make this data more usable we’re going to install the Microsoft 365 app for Splunk as it has a lot of pre-built dashboards for this data now that the app is installed navigate to teams call record monitoring teams call overview and this will show you an overview of all the calls that are happening in your environment and the teams call qos dashboard will give you information about audio and video quality along with individual metrics and you can even search for specific calls that have happened and drilled down into detailed information and there you have it we can fig configur the Splunk HTTP event collector to receive data we set up authentication with an app registration and deployed the functions to our Azure environment now you can get started today by visiting the GitHub repository for the functions and Splunk base.com for the Microsoft 365 app happy splunking