Microsoft 365: setup for your IT administrator

In a hurry? Short pages cover the common case: Outlook, OneDrive and SharePoint, Teams and Meeting transcripts →. This page is the full reference.

This page is for the person who looks after your organisation's Microsoft 365: an in-house administrator or an IT company. You don't need a Louvain account to follow it. Step 1 is one link; for step 2, your client's Louvain administrator sends you the application ID of Louvain's sign-in app if you need it.

What you need: a Global Administrator, or a Cloud Application Administrator and a Teams Administrator; Teams PowerShell (MicrosoftTeams module) for Part A step 4. Allow 60 to 90 minutes, and up to 30 minutes (sometimes longer) for Teams policies to apply.

Louvain only reads. No permission on this page lets Louvain send mail, change a file or post a message. What Louvain reads is shown only to the people who can already see it in Microsoft 365.

Sending values back. If you have a Louvain admin seat, paste IDs and the secret into Louvain yourself. Otherwise send them to your client through their secure channel (a password manager share, for example), never by plain email.

Part A: what's needed first

Step 1. Approve Louvain's Microsoft 365 app for your organisation

Louvain's Microsoft 365 app (it appears in Microsoft as Louvain Connector) is what each person uses when they connect their own Outlook, calendar, OneDrive or SharePoint. Its publisher is not yet verified by Microsoft, so most organisations don't let people approve it themselves: an administrator approves it once, for everyone (admin consent).

Open this link, sign in as an administrator of your organisation, and choose Accept:

Approve Louvain for your organisation

Microsoft lists every permission below on its approval screen before you accept. After you accept, it sends you on to Louvain's sign-in service, which may say the sign-in could not be completed: that is expected, because nobody was signing in, and the approval is already done. Close the tab.

The link, if you need to paste it (application ID 1c70b603-bbe2-43dd-bdb6-e6ed7c6d8c28):

https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=1c70b603-bbe2-43dd-bdb6-e6ed7c6d8c28&scope=offline_access%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read%20https%3A%2F%2Fgraph.microsoft.com%2FMail.Read%20https%3A%2F%2Fgraph.microsoft.com%2FCalendars.Read%20https%3A%2F%2Fgraph.microsoft.com%2FFiles.Read%20https%3A%2F%2Fgraph.microsoft.com%2FFiles.Read.All%20https%3A%2F%2Fgraph.microsoft.com%2FSites.Read.All%20https%3A%2F%2Fgraph.microsoft.com%2FTeam.ReadBasic.All%20https%3A%2F%2Fgraph.microsoft.com%2FChannel.ReadBasic.All%20https%3A%2F%2Fgraph.microsoft.com%2FChannelMessage.Read.All%20https%3A%2F%2Fgraph.microsoft.com%2FTeamMember.Read.All%20https%3A%2F%2Fgraph.microsoft.com%2FChannelMember.Read.All%20https%3A%2F%2Fgraph.microsoft.com%2FChat.Read%20https%3A%2F%2Fgraph.microsoft.com%2FOnlineMeetings.Read%20https%3A%2F%2Fgraph.microsoft.com%2FOnlineMeetingTranscript.Read.All&redirect_uri=https%3A%2F%2Fnango.louvain.ai%2Foauth%2Fcallback

It grants these delegated permissions, so Louvain only ever reads as the person who connected, and only what they can read. Each one only reads; none lets Louvain send, change or delete anything:

Several of these always need an administrator (the meeting transcripts, the channel messages, the files and sites across the organisation, and who is in which team), and the others do because the app's publisher is not yet verified by Microsoft. If this step is skipped, someone who connects sees Need admin approval and, if your organisation has turned on admin consent requests, can send you a request: approve it under Entra admin center → Enterprise applications → Admin consent requests. That approves the same permissions, for everyone.

The same app also lets one person connect Microsoft Teams by signing in: it reads the channels that person is in (and, if they turn it on, their own chats), as that person, with no approval from Microsoft needed. That is the quickest way to start; see The first person to use Louvain. Reading Teams for the whole organisation, without each person signing in, is a separate app registration (step 6). Asking Louvain questions in Teams is a third, separate app, below.

Check: Entra admin center → Enterprise applications → Louvain → Permissions shows each permission above as granted for your organisation.

Step 2. Approve Louvain's sign-in app (only if your organisation blocks it)

If your organisation stops people approving apps themselves, also approve the sign-in app, so staff can use Continue with Microsoft on Louvain:

https://login.microsoftonline.com/<your domain>/adminconsent?client_id=<application ID of Louvain's sign-in app>

It asks only for openid, profile, email and User.Read.

Check: someone on your staff signs in to Louvain with Microsoft and is not asked to approve anything.

Step 3. Register an app for meeting transcripts (optional)

Skip steps 3 and 4 to start with. Once step 1 is done, each person's own Outlook Calendar connection already reads the transcripts of the meetings they organised or were invited to; only step 5's Transcript API access setting is needed for that. Steps 3 and 4 are for reading every listed person's meetings, whether or not they have connected.

For that, Microsoft gives the transcripts only to an app registered in your own organisation. This app is your organisation's, and reads only the people you list in step 4.

1. Entra admin center → App registrations → New registration. Name it Louvain. Choose Accounts in this organizational directory only (single tenant). Leave the redirect address empty.

2. API permissions → Add a permission → Microsoft Graph → Application permissions, and add:

   Permission	What it's for
   Calendars.Read	Find the meetings of the people listed in step 4
   User.Read.All	Find those people in your directory
   OnlineMeetings.Read.All	Find the Teams meeting behind a calendar event, and who was invited, so a transcript is shown only to them
   OnlineMeetingTranscript.Read.All	Read the transcript of a meeting a listed person organised

   Then select Grant admin consent for your organisation.

3. Certificates & secrets → New client secret, valid for 12 months. Copy its Value straight away: it is shown only once.

4. Send back (see above): the Directory (tenant) ID, the Application (client) ID, the secret's Value and its expiry date. In Louvain they go on the Outlook Calendar connection's App registration tab, with Teams meeting transcripts turned on.

Check: API permissions shows the four permissions with a green Granted status.

Step 4. Let the app read transcripts for the people you list

In Teams PowerShell, using the Application (client) ID from step 3:

Connect-MicrosoftTeams
New-CsApplicationAccessPolicy -Identity Louvain-Transcripts -AppIds "<Application (client) ID>" -Description "Louvain transcripts"
Grant-CsApplicationAccessPolicy -PolicyName Louvain-Transcripts -Identity "<user principal name>"

Run the Grant- line once for each person whose meetings Louvain should read. Use -Global instead of -Identity only if every meeting in your organisation should be read. If you don't have the module yet, run Install-Module MicrosoftTeams first. On a Mac, if Connect-MicrosoftTeams stops with "Unable to load shared library 'kernel32.dll'", run Connect-MicrosoftTeams -UseDeviceAuthentication and sign in with the code it shows.

Check: Get-CsOnlineUser "<user principal name>" | Select ApplicationAccessPolicy shows Louvain-Transcripts. It can take up to 30 minutes to apply.

Step 5. Turn on transcripts, with speaker names

In the Teams admin center:

• Meetings → Meeting settings → Transcript API access: turn on Microsoft Graph access and Include speaker attribution.
• Meetings → Meeting policies → the policy those people have → Recording & transcription: set Transcription to On. If your licence offers it, also turn on automatic transcription for meetings they organise.

Check: in a scheduled Teams meeting one of those people organises, Start transcription is available, and afterwards the transcript appears in the meeting's Recap.

Step 6 (optional). Read Teams channels and chats

Louvain can read the Teams channels and chats of the teams and people you choose, each shown only to that channel's or chat's own members. This needs its own app registration, with the steps on Microsoft 365 setup: Teams (about ten minutes), and Microsoft's approval: reading channel messages and chats as an app is what Microsoft calls a protected API. Apply at aka.ms/teamsgraph/requestaccess with the app's Application (client) ID and your Directory (tenant) ID. Approval takes from a few days to a few weeks; until then Louvain's Teams connection waits and says why, and everything else keeps working. Until it is approved, people can connect Teams by signing in (see The first person to use Louvain), which needs no approval from Microsoft.

Louvain in Microsoft Teams

People can message Louvain in Teams, or mention it in a channel or group chat, and it answers from what that person can read in Louvain, with its sources. Louvain shows an answer only to the person who asked. Asked in a channel or group chat, it answers in that conversation on a card everyone sees as "Louvain answered … privately"; only the person who asked sees the answer on it, for 30 minutes, with Share and Dismiss. It also sends them the answer in their own one-to-one chat with Louvain. In a conversation of more than 60 people, or a shared channel, it answers them in their own one-to-one chat with Louvain instead, and says so. From either they can Share it. Louvain turns its message in that conversation into the answer, naming its sources (not their links) and who shared it, only if everyone in that conversation has connected Microsoft 365 in the same Louvain workspace and can read every source the answer used, and never into a shared channel; otherwise it says why without naming anyone. Someone who joins later can read what was shared before, as they can the rest of the conversation. A shared answer's … menu has Delete: everyone sees it, but only the person who shared it can use it, and it replaces the answer with a note that they removed it. While it works, the one-to-one chat shows what it is doing (searching, reading, checking); the answer appears once every sentence in it has been checked. A follow-up ("and last quarter?") is read with the person's own earlier questions in that chat. Each answer is one card: the answer, its sources, then 👍 / 👎 to rate it and, in the card's … menu, Delete to remove it from the chat; Louvain's answers log keeps its record either way.

In their one-to-one chat with Louvain, people can also ask it to do things in their Library, as they can on the Ask page: save a note or a file, rename or move a file, make a folder or a new version. Louvain does these as that person, only where they can edit and only while your workspace's Agents can save files setting is on (with it off, Louvain can still find and read their collections). A step that would change who can read something, or that their own words did not ask for, waits for them as a card in that chat, with Confirm and Discard; only they can use it, and nothing changes until they do. Louvain never shows such a card in a channel or group chat.

Every answer Louvain gives someone in Teams is also kept in their own conversations list in Louvain, with the Teams logo, and only they can see it there. Answers less than a day apart are one conversation; after a quiet day, the next answer starts another. It opens as Teams showed it, with its sources, and is checked against what that person can read each time it is opened. It is read-only in Louvain, because a reply written there would never reach Teams: Continue in Teams opens their chat with Louvain. Deleting the answer in Teams removes it from Louvain too.

From version 1.3.0, Louvain can be added to a private channel: add it to the team, then to the private channel itself (a team member opens the channel's + or Apps, as Teams asks for each private channel). It answers there privately, as in a standard channel, and Share checks the private channel's own members. Microsoft is still rolling this out, so in some organisations a private channel's mention may not reach Louvain yet; ask it in a standard channel, a group chat or a one-to-one chat instead.

Louvain recognises the person asking by their Microsoft 365 account, never by their name: each person connects their own Microsoft 365 account in Louvain once (Connections → Add connection, then Connect: Outlook, Outlook Calendar, OneDrive or Microsoft Teams), with the same work account they use in Teams. Louvain answers from the workspace that person connected their account in. Only someone who connected the same account in more than one Louvain workspace needs more: Louvain answers them from the workspace whose administrator connected Microsoft 365 for the whole workspace, if that is one of theirs, and otherwise asks them to have it connected there.

1. Download the Louvain app for Teams. Version 1.4.0 is a new app, not an update: if an earlier version is installed, delete it from Manage apps first, then upload this one (step 2) and add Louvain to your chats and channels again. Chats with the earlier app stay in Teams but are no longer answered there. Version 1.3.0 let Louvain be added to private channels, and 1.2.0 replaced 1.1.0's Delete from this chat item with a Delete button on Louvain's own answers.
2. Teams admin center → Teams apps → Manage apps → Upload new app, and choose the file. Leave it as Allowed.
3. Teams apps → Permission policies (or Setup policies, to pin it for people): make sure the people who should use Louvain may use apps your organisation uploaded.
4. If your organisation reviews apps before they are installed, approve Louvain there.

It asks Teams for two things only: who is asking (their Microsoft 365 account), and a one-to-one chat with them. It reads no channel's messages; it hears only what is said to it.

Check: once the app is installed for someone, Louvain greets them in a one-to-one chat and says how to ask, or how to connect first. Someone who has connected Microsoft 365 in Louvain sends it a question there and gets an answer with its sources. Someone who hasn't is told how to connect, and gets no answer.

Not yet available in Microsoft's government clouds (GCC High and DoD).

Part B: later, when the whole organisation joins

Your client's Louvain administrator will confirm before you start these.

• Single sign-on. Entra admin center → Enterprise applications → New application → Create your own application → Louvain (non-gallery). Single sign-on → SAML, and paste the Reply URL and Identifier shown on Louvain's single sign-on settings page. Set Unique User Identifier to user.mail (Email address format), and add claims from user.mail, user.givenname and user.surname. Paste the App Federation Metadata Url into Louvain, then assign the people or a group. Check: a test user signs in from My Apps. Account and workspace settings covers the Louvain side.
• Reading company mail and files without each person connecting. Add application permissions to the app from step 3: Mail.Read (limited with an Exchange application access policy to a mail-enabled group of the people Louvain should read: New-ApplicationAccessPolicy -AppId <Application (client) ID> -PolicyScopeGroupId <group> -AccessRight RestrictAccess, checked with Test-ApplicationAccessPolicy), Files.Read.All, Sites.Read.All (or Sites.Selected with a grant per site), GroupMember.Read.All and User.ReadBasic.All, then grant admin consent again.
• Reading Teams channels and chats is step 6. (Asking Louvain in Teams is above, and needs none of it.)

The first person to use Louvain

Once step 1 is done, the person your client names as Louvain's first user:

1. Signs in to Louvain with the invitation they were sent (Continue with Microsoft works once step 2 is done, or if your organisation does not block it).
2. Opens Connections → Add connection and connects Outlook, Outlook Calendar and OneDrive with their work account. Microsoft asks them to confirm read-only access.
3. Connects Microsoft Teams with Sign in with Microsoft. It reads the channels they are in, shown in Louvain only to them, and, with Also read chats on, their own one-to-one and group chats, each shown only to its members.
4. If the Louvain app for Teams is installed, opens Louvain's one-to-one chat in Teams and asks it a question.

If Microsoft shows Need admin approval at step 2 or 3, step 1 has not been done for your organisation yet: open its link, or approve the person's request under Enterprise applications → Admin consent requests.

Louvain reads the last 14 days first, unless your client chose a longer history. What it finds appears on the person's Today page as it is read; a large mailbox keeps filling in after that.

Removing Louvain

Each step can be undone on its own, and none deletes anything in Microsoft 365:

• Stop everyone's sign-ins: Entra admin center → Enterprise applications → Louvain → Properties → Delete. Every person's Outlook, Calendar and OneDrive connection stops at once and shows Reconnect in Louvain. To withdraw only some permissions instead, use Permissions → Review permissions.
• Stop an app registration (steps 3 and 6): App registrations → the app → Certificates & secrets → delete its secret (reading stops at once), or delete the app.
• Stop reading transcripts: in Teams PowerShell, Grant-CsApplicationAccessPolicy -PolicyName $null -Identity "<user principal name>" for each person (or -Global), then Remove-CsApplicationAccessPolicy -Identity Louvain-Transcripts.
• Remove Louvain from Teams: Teams admin center → Teams apps → Manage apps → Louvain → Block, or Delete to remove it for everyone.
• What Louvain already read stays in Louvain until your client removes it: in Louvain, a connection's ⋯ menu → Disconnect with Also delete everything it imported.

If something doesn't work

• "Need admin approval" when someone connects: step 1 was not completed, or was completed for a different application ID.
• No transcripts arrive: check steps 4 and 5; a Teams policy can take more than 30 minutes to apply, and only meetings the listed people organised are read.
• A secret expires after the period you chose in step 3: create a new one and send it back the same way before the old one runs out.

For anything else, your client's Louvain administrator can see each connection's status, and Troubleshooting covers the common cases.