Register a Microsoft Graph App

Think of registering a Microsoft Graph app like getting a library card for your AI assistant—it’s a formal way to say, “This bot is allowed to read specific books (meeting transcripts) in the library (your Microsoft 365 tenant), but only with the librarian’s (admin’s) permission.”

If you want your Hermes Agent to automatically pull meeting notes, recordings, and transcripts from Teams, you need to set up this “library card” first. Here’s how to do it, step by step, without getting lost in Microsoft’s maze.

What You’ll Need Before Starting

• A Microsoft 365 tenant with Teams Premium (or licenses that produce transcripts/recordings)
• Admin access to the Azure portal (or an admin friend who can click “Approve” for you)
• A cup of coffee—this takes about 10 minutes

Step 1: Create the App Registration

1. Go to entra.microsoft.com and sign in as an admin.
2. Navigate to Identity → Applications → App registrations.
3. Click New registration.
4. Fill in:
   • Name: Hermes Teams Meeting Pipeline (or anything memorable)
   • Supported account types: Accounts in this organizational directory only (single tenant)
   • Redirect URI: Leave blank—we don’t need it for app-only auth.
5. Click Register.

You’ll land on the overview page. Copy two values now (you’ll need them later):

# Save these in a safe place
MSGRAPH_CLIENT_ID = "the Application (client) ID"
MSGRAPH_TENANT_ID = "the Directory (tenant) ID"

Step 2: Create a Client Secret

Think of a client secret as a password for your app. It proves your app is who it says it is.

1. In the left nav, click Certificates & secrets.
2. Click New client secret.
3. Description: hermes-graph-secret
4. Expires: Choose 6–24 months (match your company’s rotation policy).
5. Click Add.

Important: Copy the Value column immediately—it’s only shown once. Don’t grab the Secret ID by mistake.

MSGRAPH_CLIENT_SECRET = "the Value you just copied"

Step 3: Grant Graph API Permissions

This is where you tell Microsoft what your app is allowed to do. The Hermes pipeline needs a minimum set of permissions—don’t add more than you need.

1. In the left nav, click API permissions.
2. Click Add a permission → Microsoft Graph → Application permissions.
3. Add the permissions from the table below (you’ll see the exact list in the full documentation, but typical ones include reading meeting transcripts and recordings).

# Example permissions (check the docs for the full list)
- OnlineMeetings.Read.All
- CallRecords.Read.All

Step 4: Admin Consent

Application permissions don’t work until an admin says “OK.” If you’re the admin:

1. On the API permissions page, click Grant admin consent for [your tenant].
2. Confirm the dialog.

If you’re not an admin, send the app registration link to your admin and ask them to do this step.

Step 5: (Optional) Scope to Specific Users

By default, your app can read all meeting transcripts in the tenant. To limit it to specific users, you can set an Application Access Policy. This is like giving your library card a “only these shelves” restriction.

Wrapping Up

Once you have these three values:

MSGRAPH_CLIENT_ID
MSGRAPH_TENANT_ID
MSGRAPH_CLIENT_SECRET

…you’ll put them into ~/.hermes/.env and your Hermes Agent can start pulling meeting data automatically—no user logins, no per-meeting consent prompts.

Practical tip: Set a calendar reminder to rotate your client secret before it expires. Nothing breaks a pipeline faster than an expired secret at 9 AM on a Monday. And if you ever get stuck, the Hermes Discord community is friendly and fast to help.

Now go register that app—your future self (and your AI agent) will thank you.