Security and data handling
Teams Phone Configurator writes to Microsoft Teams, so the permission question matters more than for a read-only tool. This page lists exactly what it holds, and why that is still a smaller surface than handing PowerShell to everyone who assigns numbers.
At a glance
- Assigns and removes phone numbers and applies Teams policies through the Microsoft Graph API, app-only. No PowerShell, no interactive admin sessions.
- Users sign in with Microsoft Entra ID, with two app roles. No local accounts, no user passwords.
- Data stays in your own SQL Server database. Outbound connections go only to Microsoft Graph and Entra sign-in.
- Does not touch voice routing, session border controllers or policy definitions.
Permissions
The app’s service principal needs the following. They are all admin-consented and used app-only:
| Permission | Type | Used for |
|---|---|---|
TeamsTelephoneNumber.ReadWrite.All | Application | Reading number assignments, assigning and unassigning numbers |
TeamsPolicyUserAssign.ReadWrite.All | Application | Applying the location’s calling policies and dial plan to the user |
User.Read.All | Application | Finding the employee in your directory and checking their Teams Phone licence before anything changes |
| Teams Administrator (directory role) | Role on the service principal | Required by the Teams telephony operations the app performs |
This is a write-capable integration, and it should be reviewed as one. The point of the design is where that power sits: in one service principal with a documented scope, instead of in the PowerShell rights of every engineer and service desk agent who provisions numbers today.
Sign-in and roles
- Users sign in with Microsoft Entra ID (OpenID Connect).
- Two app roles:
TelephonyAdmincan assign and remove numbers and manage locations,Viewercan read. Role assignment is managed in Entra ID like any other enterprise app. - The REST API for automation uses a separate API key, compared in constant time. Treat it as a secret and rotate it with your usual process.
- Graph credentials are a client secret or a certificate, supplied through environment variables. The certificate option can be mounted read-only into the container.
What is stored, and where
The database holds your locations, number ranges, the user-to-number assignments, and an audit log of who assigned what to whom, when, and whether it succeeded. It runs on SQL Server (the free Express edition is sufficient) on infrastructure you control.
Audit retention is configurable from 1 day to 10 years. Set it to match your records policy; the default is 30 days.
Hosting and network
- One container (.NET 10, Blazor Server) plus SQL Server. Runs on any Docker host or on Azure Container Apps.
- Serves HTTP on port 8080 behind your reverse proxy or ingress, which terminates TLS. HSTS is enabled.
- Configuration is entirely environment variables, so one image serves every environment.
Who builds it
Teams Phone Configurator is built by IDE Solutions UG (haftungsbeschränkt), Krombach, Germany, registered at Amtsgericht Aschaffenburg under HRB 17253 (see the Impressum). If you run it yourself, we have no access to your tenant or your data. If we operate it for you, the contract includes a data processing agreement under Art. 28 GDPR.
See also deployment options and pricing.
Security review questions
Can the app change our voice routing or SBC configuration?
No. It assigns and removes numbers and applies policies your engineers already defined. Operators, session border controllers and policy definitions stay in the Teams admin center.
Do service desk agents need Teams admin rights?
No. They sign in to the app with the TelephonyAdmin app role. The privileged permissions sit with the app’s service principal, not with each person who provisions numbers.
Does it send data anywhere except Microsoft?
No. It connects to Microsoft Graph and Entra sign-in only. There is no telemetry and no connection to IDE Solutions.
Review the permissions with us
We go through the service principal, the roles and the audit trail with your team during the demo. Book a demo