How to fetch meeting transcript using RSC based permission framework

Question

How to fetch meeting transcript using RSC based permission framework

Thomas Dehaene 30

The goal

I want to build a Teams app, with an Azure bot (built using the Bot Framework Python SDK), added to a meeting.

When the meeting is started, a notification subscription is registered with the Graph API to alert an endpoint that the transcript is available.

The goal is to then automatically process that transcript (using some custom AI steps) to get insights from the meeting.

The problem

Almost all steps have gone well to develop, apart from the step to fetch the actual transcript text. There the Graph API is giving me troubles.

Steps undertaken

Please find a quick summary of the steps I have undertaken so far, hopefully this will give further insights.

App registration

An App registration has been made in our Entra ID tenant, providing a client-id and client-secret to provide to the Bot, and to later fetch a Graph API token.

No additional permissions have been granted to this app registration, since we want to purely use RSC based permissions, to have the smallest possible access scope.

A client-id and client-secret are noted and stored safely somewhere.

Azure bot backend

An Azure bot has been set up with a custom python backend, with the appropriate API endpoint as well to receive notification subscriptions under the /notify endpoint

Teams app manifest

A teams app manifest is defined to configure the bot access and list the necessary RSC permissions. You can find a redacted version here below:

{
    "$schema": "https://developer.microsoft.com/json-schemas/teams/v1.19/MicrosoftTeams.schema.json",
    "manifestVersion": "1.19",
    "version": "1.0.9",
    "id": "<TEAMS-APP-EXTERNAL-ID>",
    "showLoadingIndicator": false,
    "developer": {
      "name": "<DEVNAME>",
      "websiteUrl": "https://www.microsoft.com",
      "privacyUrl": "https://www.microsoft.com/privacy.html",
      "termsOfUseUrl": "https://www.microsoft.com/termsofuse.html"
    },
    "name": {
      "short": "<SHORT-NAME>",
      "full": "<FULL-NAME>"
    },
    "description": {
      "short": "<SHORT-DESCRIPTION>",                                                             
      "full": "<FULL-DESCRIPTION>"
    },
    "icons": {
      "outline": "outline.png",
      "color": "color.png"
    },
    "accentColor": "#ffffff",
    "permissions": [
      "identity",
      "messageTeamMembers"
    ],
    "webApplicationInfo": {
      "id": "<AAD-CLIENT-ID>",
      "resource": "https://RscPermission"
    },
    "authorization": {
      "permissions": {
        "resourceSpecific": [
          {
            "name": "OnlineMeetingRecording.Read.Chat",
            "type": "Application"
          },
          {
            "name": "OnlineMeetingTranscript.Read.Chat",
            "type": "Application"
          },
          {
            "name": "OnlineMeeting.ReadBasic.Chat",
            "type": "Application"
          },
          {
            "name": "ChannelMeeting.ReadBasic.Group",
            "type": "Application"
          },
          {
            "name": "OnlineMeetingParticipant.Read.Chat",
            "type": "Application"
          },
          {
            "name": "ChannelMessage.Read.Group",
            "type": "Application"
          },
          {
            "name": "ChatMessage.Read.Chat",
            "type": "Application"
          }
        ]
      }
    },
    "validDomains": [
        "<BOT-BACKEND-URL>",
        "token.botframework.com"
      ],
    "bots": [
      {
        "botId": "<AAD-CLIENT-ID>",
        "scopes": [
          "personal",
          "team",
          "groupChat"
        ],
        "needsChannelSelector": false,
        "isNotificationOnly": false,
        "supportsFiles": false
      }
    ]
  }

Publish and approve app

The app as above has been submitted for approval, has been approved and is visible under the "Built for your org" section of custom apps in the Teams desktop client.

Register notification subscription on meeting start

The bot gets a notification under the on_teams_meeting_start_event that the meeting has started. A piece of code is then executed to register a notification subscription on the Graph API, so that the backend receives a REST call when the transcript is available. This is done as follows:

subscription_url = "https://graph.microsoft.com/beta/subscriptions"
app_id=<TEAMS-APP-INTERNAL-ID>
base64_certificate=<CERTIFICATE-PUBLIC-KEY>
certificate=<CERTIFICATE-ID>
headers = headers = {
    "Authorization": f"Bearer <TOKEN FETCHED VIA AAD APP REG CLIENT ID AND SECRET>",
}

subscription_data = {
    "changeType": "created",
    "notificationUrl": "<BACKEND-URL>/api/notify",
    "resource": f"appCatalogs/teamsApps/{app_id}/installedToOnlineMeetings/getAllTranscripts?useResourceSpecificConsentBasedAuthorization=true",
    "includeResourceData": True,
    "expirationDateTime": "<EXPIRATION-DATETIME>",
	"clientState": "<STATE-STRING>",
    "encryptionCertificate": base64_certificate,
    "encryptionCertificateId": cert_id,
}

response = requests.post(subscription_url, headers=headers, json=subscription_data)
print(response.status)
print(response.json())

This correctly results in a 201 status with following body:

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#subscriptions/$entity",
  "id": "<SUBSCRIPTION-ID>", 
  "resource": "appCatalogs/teamsApps/<TEAMS-APP-INTERNAL-ID>/installedToOnlineMeetings/getAllTranscripts?useResourceSpecificConsentBasedAuthorization=true", 
  "applicationId": "<AAD-CLIENT-ID>", 
  "changeType": "created",
  "clientState": "<STATE-STRING>",
  "notificationUrl": "<NOTIFICATION-URL-ENDPOINT>",
  "notificationQueryOptions": null,
  "notificationContentType": null,
  "lifecycleNotificationUrl": null,
  "expirationDateTime": "<EXPIRATION-DATETIME>",
  "creatorId": "CREATOR-ID",
  "includeResourceData": true,
  "latestSupportedTlsVersion": "v1_2", 
  "encryptionCertificate": "<CERTIFICATE-PUBLIC-KEY>", 
  "encryptionCertificateId": "<CERTIFICATE-ID>",
  "notificationUrlAppId": null
}

Capture transcript available event

When the meeting is done, I correctly get a notification event, as described int the online documentation.

For example:

{
  "tenantId": "<TENANT-ID>",
  "changeType": "created",
  "subscriptionId": "<SUBSCRIPTION-ID>",
  "clientState": "<STATE-STRING>",
  "subscriptionExpirationDateTime": "<EXPIRATION-DATETIME>",
  "resource": "communications/onlineMeetings('<MEETING-ID>')/transcripts('<TRANSCRIPT-ID>')",
  "resourceData": {
    "id": "<TRANSCRIPT-ID>",
    "@odata.type": "#Microsoft.Graph.callTranscript",
    "@odata.id": "communications/onlineMeetings('<MEETING-ID>')/transcripts('TRANSCRIPT-ID')",
  },
  "encryptedContent": {
    "data": "<ENCRYPTED-CONTENT>",
    "dataSignature": "<DATA-SIGNATURE>",
    "dataKey": "<DATA-KEY>",
    "encryptionCertificateId": "<CERTIFICATE-ID>",
    "encryptionCertificateThumbprint": "<CERTIFICATE-THUMBRPINT>",
  },
}

I was kind of hoping the encrypted content would already contain the transcript, but upon decryption it does not:

{'@odata.context': "https://graph.microsoft.com/$metadata#communications/onlineMeetings('<MEETING-ID>')/transcripts/$entity",
 'id': '<TRANSCRIPT-ID>',
 'meetingId': '<MEETING-ID>',
 'callId': '<CALL-ID>',
 'contentCorrelationId': '<CONTENT-CORR-ID>',
 'createdDateTime': '...',
 'endDateTime': '...',
 'transcriptContentUrl': 'communications/onlineMeetings/<MEETING-ID>/transcripts/<TRANSCRIPT-ID>/content',
 'meetingOrganizer': {'application': None,
  'device': None,
  'user': {'userIdentityType': 'aadUser',
   'tenantId': '<TENANT-ID>',
   'id': '...',
   'displayName': None}},
 'content': None}

Fetch the transcript content

This is the step where it goes wrong.

Using a GET request to this url

https://graph.microsoft.com/v1.0/<TRANSCRIPT-CONTENT-URL-FROM-ABOVE>

Using the same Bearer token as earlier (so obtained via the AAD app client-id and client-secret) results in a 404 response:

{
  "error": {
    "code":"UnknownError",
    "message":"404 page not found\\n",
    "innerError": {
      "date":"2025-01-20T09:20:12",
      "request-id":"c78ce659-fa44-4a98-bd48-a82ac0447c5f",
      "client-request-id": "c78ce659-fa44-4a98-bd48-a82ac0447c5f"
    }
  }
}

So I am lost as why the content url, that was provided by the notification subscription event, could result in a 404.

Which step am I missing?

I have searched all online docs and threads for answers, but unfortunately cannot find any at the moment.

All help is greatly appreciated.

Nivedipa-MSFT 3,421 Reputation points Microsoft External Staff

2025-01-20T10:04:25.2533333+00:00

@Thomas Dehaene - Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.
Benjamin Talmard 40 Reputation points

2025-03-04T23:58:51.2433333+00:00

Hello @Thomas Dehaene
That might not be related to your issue unfortunately but I'm wondering if you can explain why you are creating a new subscription to the change notifications for every meeting?
As far as I undertand, the subscription will be valid for every meeting for which the app is installed and you might generate duplicates by creating a subscription for each meeting.

1 answer

Your answer

Nivedipa-MSFT 3,421 Reputation points Microsoft External Staff

2025-01-20T10:04:25.2533333+00:00

@Thomas Dehaene - Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.
Benjamin Talmard 40 Reputation points

2025-03-04T23:58:51.2433333+00:00

Hello @Thomas Dehaene
That might not be related to your issue unfortunately but I'm wondering if you can explain why you are creating a new subscription to the change notifications for every meeting?
As far as I undertand, the subscription will be valid for every meeting for which the app is installed and you might generate duplicates by creating a subscription for each meeting.

Answer 1

Saranya Madhu-MSFT 1,975 Microsoft External Staff

Hi Thomas Dehaene,

Thanks for reaching out to Microsoft!

As per the Microsoft documentation, to get the content of a single transcript of an online meeting.

GET me/onlineMeetings/{meetingId}/transcripts/{transcriptId}/content
GET users/{userId}/onlineMeetings/{meetingId}/transcripts/{transcriptId}/content

Response contains bytes for the transcript in the body. content-type header specifies type of the transcript content.

Get a callTranscript content specifying $format query param:

GET https://graph.microsoft.com/v1.0/users/ba321e0d-79ee-478d-8e28-85a19507f456/onlineMeetings/{onlinemeetingID}/transcripts/{transcriptID}/content?$format=text/vtt

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.

Thomas Dehaene 30 Reputation points

2025-01-23T15:29:32.9433333+00:00
Hi @Saranya Madhu-MSFT ,

Thank you for your response. I'm afraid that doesn't solve the issue either.

the me/ endpoint gives me a 400 error saying:

/me request is only valid with delegated authentication flow

which makes sense, since I'm not in a delegated flow scenario, but in an application flow scenario

the users/<object-id of the-aad->/... endpoint gives me a 403 saying:

"code":"Forbidden","message":"3003: User does not have access to lookup meeting"

the users/<object-id-of-the-meeting-organizer>/... endpoint gives me a 403 saying:

"code":"AccessDenied","message":"Either scp or roles claim need to be present in the token."
Saranya Madhu-MSFT 1,975 Reputation points Microsoft External Staff

2025-01-24T09:58:11.22+00:00

Hi Thomas, are you able to get the content of meeting which is not a lookup?
Nivedipa-MSFT 3,421 Reputation points Microsoft External Staff

2025-01-31T09:48:40.79+00:00

Saranya Madhu-MSFT - Could you please confirm if your issue is resolved or are you still facing this issue?
Thomas Dehaene 30 Reputation points

2025-02-03T10:27:03.84+00:00

Hi @Nivedipa-MSFT : issue not resolved.

I'm afraid I don't fully understand your question:

Hi Thomas, are you able to get the content of meeting which is not a lookup?

Could you please clarify? Which graph api call should I check?
Thomas Dehaene 30 Reputation points

2025-02-18T08:25:37.5833333+00:00

Hi @Nivedipa-MSFT : any update on this issue?
Thomas Dehaene 30 Reputation points

2025-03-03T13:52:54.3433333+00:00

@Saranya Madhu-MSFT or @Nivedipa-MSFT : any further input? Or can you assign this question to someone who could help me out further?
Benjamin Talmard 40 Reputation points

2025-03-05T18:09:58.77+00:00

Hi all,

I'm having the same issue, with recordings URLs I got through a tenant level change notification subscription (without RSC involved).

Help will be appreciated
Benjamin Talmard 40 Reputation points

2025-03-06T11:33:12.2766667+00:00

Hello @Saranya Madhu-MSFT @Nivedipa-MSFT @Thomas Dehaene

I can now confirm that I have the exact same issue to access to recordings with Resource Specific Consent change notifications.

When using the recordingContentUrl from the rich notification payload, I'm getting a 404 error.

When reconstructing the path to access to the recording through the organiser id : users/${decryptedPayloadParsed.meetingOrganizer.user.id}/${decryptedPayloadParsed.recordingContentUrl.replace('communications/', '')}, I'm getting a 403 Forbidden AccessDenied Either scp or roles claim need to be present in the token.

It's true that the JWT access token used to get the recording doesn't contain any roles claim. It was acquired with the https://graph.microsoft.com/.default scope (with the Graph JavaScript SDK msalClient.acquireTokenByClientCredential() in my case) but the App Registration doesn't contain any application permission (it shouldn't be necessary as we're using RSC permissions).

I've tried to add the RSC scopes OnlineMeetingRecording.Read.Chat,OnlineMeetingTranscript.Read.Chat when requesting the access token but I'm getting the following error: The provided value for scope OnlineMeetingRecording.Read.Chat OnlineMeetingTranscript.Read.Chat is not valid. Client credential flows must have a scope value with /.default suffixed to the resource identifier (application ID URI).

I even tried to add the querystring useResourceSpecificConsentBasedAuthorization=true to the Graph URL, both in the v1.0 and the beta endpoint, with no luck.

If we add an Application permission to the App Registration (and grant admin consent to it), even if it has nothing to do with transcript or recording (such as User.Read.All), the Access Token contains a Roles claim (with User.Read.All) and we can get the recording. However, that is not acceptable as a non-related Application permission should'nt be required to enable this scenario using only RSC permissions.

Help will be appreciated

Share via

How to fetch meeting transcript using RSC based permission framework

The goal

The problem

Steps undertaken

App registration

Azure bot backend

Teams app manifest

Publish and approve app

Register notification subscription on meeting start

Capture transcript available event

Fetch the transcript content

1 answer

Your answer