This guide outlines the Entra ID setup requirements for CXA/CXI Teams, including admin consent, authorisation, required API permissions, and recommended administrator roles to ensure a smooth deployment process. It also provides guidance on best practices and the level of access needed to complete the configuration successfully.
Akixi Service Account
We recommend creating a dedicated service account for the Akixi CXA service. This provides easy identification of the Akixi service identity in Microsoft logging and separates from any impact of changes to individual person accounts.
The full detail of minimum M365 permissions required and how they used is in this document below.
M365 Permissions required in summary;
· Global admin to grant permissions and register the Akixi Enterprise App (this is a one time operation)
· Akixi service account e.g. “akixiservice@customerdomain.com“
o Assigned admin roles for initial sync and setup of first Akixi monitored user: Teams Communications Administrator + User Administrator + Exchange recipient administrator
o After initial sync and setup of first Akixi monitored user completed: User Administrator + Exchange recipient administrator roles can be removed from the Akixi service account in EntraID, leaving only Teams Communications Administrator permanently assigned for the duration of using the Akixi CXA service
Frequently Asked Questions
Why does Akixi need User Admin and Exchange Recipient Admin?
These roles are required to:
- Manage Teams Resource Accounts
- Support Call Queue monitoring
- Create and manage shared voicemail mailboxes
Without them, some monitoring and voicemail features will not function. [Akixi CXA…0-0-251131 | PDF]
Does Akixi have access to passwords?
No. Akixi never sees, stores, or manages Microsoft 365 passwords. Authentication is performed entirely by Microsoft. [Akixi CXA…0-0-251131 | PDF]
Can permissions be reduced?
Akixi uses the minimum permissions currently available through Microsoft Graph APIs. Future reductions will depend on Microsoft introducing more granular permission models. [Akixi CXA…0-0-251131 | PDF]
Is MFA supported?
Yes, MFA is supported during the initial authorisation process. CAP-enforced MFA during background token refresh is not supported and may cause service disruption. [Akixi CXA…0-0-251131 | PDF]
Information Required During Setup
You will need:
- Microsoft Entra Tenant ID
- Microsoft 365 tenant administrator involvement
- Completion of the consent and authorisation process
The Tenant ID can be found within the Microsoft Entra Admin Centre under Identity → Overview.
Summary
Akixi follows Microsoft’s recommended security architecture for enterprise Teams applications, using OAuth 2.0, Entra ID, Microsoft Graph APIs, and least-privilege administration where possible. Customer administrators remain in control of permissions, MFA, Conditional Access policies, and feature enablement throughout the deployment lifecycle
Full Guide below.