Microsoft Teams webhook events and recording

Question

Microsoft Teams webhook events and recording

CG 45

I am developing a C# application with the purpose of recording Microsoft Teams calls (PSTN, internal calls etc).

I have set up an app registration and configured it as multi-tenant. I have also setup a multi tenant Azure Bot.

Right now, I am trying to get real time webhooks events from Microsoft Teams apps every time calls occur. The MS Teams users are in a different domain than my app registration/bot domain.

What do i need in order to get real time webhooks notifications from my MS Teams tenants ? I am looking for JSON payloads when an incoming, outgoing call starts or ends with information such as caller or callee,etc... ?

I have subscribed to the events but i did not receive any real time notifications. I've connected the Azure Bot to Microsoft Teams Channel, enabled calling and specified a webhook url for calling. Also i've set the API permissions to Calls.Initiate.All, Calls.InitiateGroupCall.All, Calls.JoinGroupCall.All, CallRecordings.Read.All, CallRecords.Read.All, Calls.AccessMedia.All

Heimlich 0 Reputation points

2026-07-09T15:14:59.2+00:00

Did you figure this out?
CG 45 Reputation points

2026-07-10T15:10:00.4166667+00:00

Yes i did
Heimlich 0 Reputation points

2026-07-10T15:16:56.9+00:00

Would you mind sharing how you did it? I want to do this exact thing with PSTN calls.

Answer accepted by question author

Kudos-Ng 15,050 Microsoft External Staff Moderator

Hi CG,

Thank you for posting your question in the Microsoft Q&A forum.

From your description, I’m unsure which of the two scenarios you need, so I’ll outline both and the correct approach for each:

1) Log call metadata for reporting/analytics (no media recording)

If your goal is to log call metadata (participants, modalities, quality/diagnostics, etc.) for calls that occurred in your tenant, you do not need a bot. Use Microsoft Graph Change Notifications for Call Records to receive webhooks when a call record is created:

Docs: https://learn.microsoft.com/en-us/graph/changenotifications-for-callrecords
Important behavior: a call record is created only after the call/meeting ends, and it remains available for 30 days. This means the subscription cannot notify you “at ring” or “at call start” in real time; it’s inherently post-call.

At this time, there isn’t a Graph subscription that will fire tenant‑wide, real‑time notifications for every incoming/outgoing PSTN or 1:1 Teams call unless a bot is a participant in those calls.

2) Record call media (audio/video) in real time

If your intent is to have a bot join a call and record media, use Microsoft’s Policy‑based Compliance Recording model:

Docs: https://learn.microsoft.com/en-us/microsoftteams/teams-recording-compliance
Sample: PolicyRecordingBot that demonstrates a recording bot that receives media streams; persisting media is left to you.

With this approach, your organization must:

Create/configure a ComplianceRecordingPolicy,
Associate your bot’s application instance with that policy, and
Assign the policy to the target users.
When users who are in-scope for the policy join calls/meetings, Teams invites your bot; your bot then receives real‑time media for compliant recording.

Additionally, you mentioned setting up a multi‑tenant bot. However, be aware that Microsoft’s recent guidance indicates deprecation of creating new multi‑tenant bots and a move toward single‑tenant apps with per‑tenant onboarding (admin consent + application instance + policy assignment). If you’ve recently created a multi‑tenant bot, this could affect authentication with the Teams channel and future supportability.

User's image

Since you also mentioned that you “subscribed to an event but aren’t receiving notifications,” please share exactly what you subscribed to so we can assist you to troubleshoot the issue:

Resource URI (e.g., communications/callRecords, communications/onlineMeetings(...)/meetingCallEvents, etc.)
Subscription payload you posted (redact secrets): changeType, resource, notificationUrl, expirationDateTime, and whether includeResourceData/certs were used
The HTTP response your endpoint returns for validation and for notifications (remember Graph expects a quick 2xx)

I hope the information above helpful.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Sayali-MSFT 6,396 Reputation points Microsoft External Staff Moderator

2026-01-20T11:08:09.2733333+00:00

Hi CG,Could you please confirm if your issue has resolved with provided suggestions or still looking for any help?
CG 45 Reputation points

2026-01-21T05:15:47.4866667+00:00
Thank you for your response.

I might need a few clarifications. First, I'm looking to achieve scenario 2, record call media (audio) in real time. I have created an app registration and a BOT sharing the same Application ID. Is the App Registration necessary in this case or can i just create a Bot only and create/configure a compliancerecordingpolicy ?

If i set up a single tenant bot, let's say all my teams users are at microsoft.com and my Azure portal Bot configuration is at gmail.com, would the bot be able to join those calls ? If not, what would i need to configure ?

Here are my subscriptions

Call Events

var endpoint = "https://graph.microsoft.com/v1.0/subscriptions";

var payload = new Dictionary<string, object>

{

{ "changeType", "updated" }, { "notificationUrl", WEBHOOK_URL + "/api/presence" }, { "resource", "/communications/presences/{userId}" }, // Replace {userId} with actual user ID { "expirationDateTime", DateTime.UtcNow.AddMinutes(60).ToString("o") }, { "clientState", "SecretClientState" }

};

Call Records

var endpoint = "https://graph.microsoft.com/beta/subscriptions";

var payload = new Dictionary<string, object>

{
{ "changeType", "created" }, { "notificationUrl", WEBHOOK_URL + "/api/callrecords" }, { "resource", "/communications/callRecords" }, { "expirationDateTime", DateTime.UtcNow.AddHours(1).ToString("o") }, { "clientState", "SecretClientState" }
};

Thank you.
Sayali-MSFT 6,396 Reputation points Microsoft External Staff Moderator

2026-01-21T09:40:20.2766667+00:00

Hello CG,
In Microsoft Teams compliance recording architecture, an Azure AD App Registration is mandatory, even if a bot has already been created. The bot itself is only a resource container, while the App Registration represents the actual security principal that owns permissions, certificates, and secrets and is authorized by Microsoft Graph. By design, the bot and the App Registration must share the same Application (Client) ID, and this requirement cannot be bypassed. A complete setup requires an App Registration, an Azure Bot resource, a compliance recording policy, and a media service to process real-time audio.

Compliance recording bots are also tenant-bound. A single-tenant bot registered in one tenant cannot join or record calls in another tenant. Compliance recording enforces strict tenant-level policies, directory trust, and legal controls, so Microsoft explicitly blocks cross-tenant recording. All related components—Teams users, App Registration, bot resource, recording policy, and authentication certificates—must exist in the same Azure AD tenant.

To address cross-tenant scenarios, there are only two supported approaches. The recommended option is to create all required components within the target tenant. An advanced alternative is to use a multi-tenant bot, but even then, the bot must be installed, admin-consented, and policy-assigned in the target tenant, and such setups are rarely approved due to legal and compliance constraints.

Graph subscriptions such as call events, presence, or call records do not support real-time audio recording. These APIs provide post-call metadata only and cannot deliver live media. For real-time call recording, you must use the Cloud Communications APIs together with the Microsoft Real-time Media Platform (Media SDK). This requires application permissions, admin consent, certificate-based authentication, and explicit invitation of the bot into calls via a compliance recording policy.

The correct architecture routes Teams calls through a compliance recording policy to a trusted recording bot, which receives the live audio stream via the media platform and forwards it to your service for real-time processing or storage.

Reference Document-
1.https://learn.microsoft.com/en-us/microsoftteams/teams-recording-compliance
2.https://learn.microsoft.com/en-us/graph/cloud-communications-concept-overview
3.https://learn.microsoft.com/en-us/microsoftteams/platform/bots/calls-and-meetings/real-time-media-concepts
4.https://learn.microsoft.com/en-us/graph/api/resources/call?view=graph-rest-1.0
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-21T15:10:13.5533333+00:00
Hi CG,

Thanks for the follow‑up.

I'm not sure if you’ve already seen Sayali’s response to your question. To further clarify your specific point about using a single‑tenant bot across other tenants: the hosting tenant of your bot (and where your Azure resources live) can be different; the key is to provision the bot per target tenant.

Per‑tenant provisioning:

Admin consent in the microsoft.com tenant to your App Registration (by Application ID).

Create an Application Instance in the microsoft.com tenant that points to your bot’s App ID (this is the recorder “identity” in that tenant).

Create/Update a CsTeamsComplianceRecordingPolicy in microsoft.com that references the Application Instance.

Assign that policy to the users whose calls must be recorded.

Ensure your bot (Teams channel) is enabled for Calling and reachable (public HTTPS; responds to validation within ~10 seconds).

Hope this helps.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-22T13:19:06.1+00:00

Hi CG,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.
CG 45 Reputation points

2026-01-23T04:44:45.28+00:00

Thank you, reviewing and going through the steps. Will keep you posted. Appreciate the response.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

2 additional answers

Your answer

Heimlich 0 Reputation points

2026-07-09T15:14:59.2+00:00

Did you figure this out?
CG 45 Reputation points

2026-07-10T15:10:00.4166667+00:00

Yes i did
Heimlich 0 Reputation points

2026-07-10T15:16:56.9+00:00

Would you mind sharing how you did it? I want to do this exact thing with PSTN calls.
Sayali-MSFT 6,396 Reputation points Microsoft External Staff Moderator

2026-01-20T11:08:09.2733333+00:00

Hi CG,Could you please confirm if your issue has resolved with provided suggestions or still looking for any help?
CG 45 Reputation points

2026-01-21T05:15:47.4866667+00:00

Thank you for your response.

I might need a few clarifications. First, I'm looking to achieve scenario 2, record call media (audio) in real time. I have created an app registration and a BOT sharing the same Application ID. Is the App Registration necessary in this case or can i just create a Bot only and create/configure a compliancerecordingpolicy ?

If i set up a single tenant bot, let's say all my teams users are at microsoft.com and my Azure portal Bot configuration is at gmail.com, would the bot be able to join those calls ? If not, what would i need to configure ?

Here are my subscriptions

Call Events

var endpoint = "https://graph.microsoft.com/v1.0/subscriptions";

var payload = new Dictionary<string, object>

{

{ "changeType", "updated" }, { "notificationUrl", WEBHOOK_URL + "/api/presence" }, { "resource", "/communications/presences/{userId}" }, // Replace {userId} with actual user ID { "expirationDateTime", DateTime.UtcNow.AddMinutes(60).ToString("o") }, { "clientState", "SecretClientState" }

};

Call Records

var endpoint = "https://graph.microsoft.com/beta/subscriptions";

var payload = new Dictionary<string, object>

{
{ "changeType", "created" }, { "notificationUrl", WEBHOOK_URL + "/api/callrecords" }, { "resource", "/communications/callRecords" }, { "expirationDateTime", DateTime.UtcNow.AddHours(1).ToString("o") }, { "clientState", "SecretClientState" }
};

Thank you.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-21T15:10:13.5533333+00:00

Hi CG,

Thanks for the follow‑up.

I'm not sure if you’ve already seen Sayali’s response to your question. To further clarify your specific point about using a single‑tenant bot across other tenants: the hosting tenant of your bot (and where your Azure resources live) can be different; the key is to provision the bot per target tenant.

Per‑tenant provisioning:

Admin consent in the microsoft.com tenant to your App Registration (by Application ID).

Create an Application Instance in the microsoft.com tenant that points to your bot’s App ID (this is the recorder “identity” in that tenant).

Create/Update a CsTeamsComplianceRecordingPolicy in microsoft.com that references the Application Instance.

Assign that policy to the users whose calls must be recorded.

Ensure your bot (Teams channel) is enabled for Calling and reachable (public HTTPS; responds to validation within ~10 seconds).

Hope this helps.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-22T13:19:06.1+00:00

Hi CG,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.
CG 45 Reputation points

2026-01-23T04:44:45.28+00:00

Thank you, reviewing and going through the steps. Will keep you posted. Appreciate the response.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

CG 45

Hello,

Thank you for the detailed explanation. I have two follow-up questions:

1. Real-Time Media SDK - Platform Requirements

To receive the decoded 20ms PCM audio frames via the Media Platform SDK, does my application need to run on Windows Server (2016/2019/2022) or Azure VM? Or can I develop and run this on Windows 10/11?

2. Post-Call Audio Download Options

I want to confirm my understanding of what's available after a call ends:

User-initiated recording (user clicks "Record" in Teams) → Audio saved to OneDrive → Can be downloaded via Graph API
Compliance recording bot → No post-call download; the bot must capture audio in real-time
Call Records API → Metadata only, no audio file

Is there any way to enable automatic recording of all calls (including PSTN and 1:1 calls) that saves to OneDrive or SharePoint without requiring a real-time compliance bot? Or is the real-time Media Platform SDK the only option for automatic call recording?

Thank you.

Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-02-04T14:01:22.26+00:00

Hi CG,

Thanks for the thoughtful follow‑ups. Here is what I know based on Microsoft documentation:

1) Real‑Time Media SDK – platform requirements.

For application‑hosted media bots that receive 20‑ms decoded PCM frames, Microsoft’s guidance is to run on Windows Server in Azure for production (Cloud Service, VM/VMSS/Service Fabric, or AKS). For non‑production work, you may deploy on an on‑premises Windows Server. The docs state these bots must run in a Windows environment and explicitly note that they can’t be hosted on Azure App Service. Client OSes like Windows 10/11 aren’t listed as supported runtimes for the media plane; for parity and supportability you should plan on Windows Server for both validation and production.

2) Post‑call audio options and “automatic” recording.

Your understanding is correct:

(a) User‑initiated “cloud recording” stores the file in OneDrive/SharePoint and can later be accessed (including via the standard ODB/SPO file APIs); this is a convenience workflow, not compliance.

(b) Policy‑based compliance recording does not publish a file after the call; the recorder bot must capture media in real time and you store it in your own repository.

(c) Call Records API is metadata‑only, created after the call ends with 30‑day retention.

Regarding a tenant‑wide switch to automatically record all calls (PSTN + 1:1) directly to OneDrive/SharePoint without a compliance bot: that isn’t supported. Automatic, policy‑enforced recording is delivered only through the compliance recording architecture that auto‑invites a recorder bot; the “cloud recording” controls are user‑driven, meeting‑focused features and don’t provide a universal, compliance‑grade auto‑capture to ODB/SPO for PSTN/1:1 calls.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-02-05T13:04:36.0966667+00:00

Hi CG,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.
CG 45 Reputation points

2026-02-11T03:57:42.2066667+00:00

Hi Kudos-Ng,

Thank you for your response. We currently deploy a multi-protocol recording solution that supports SIP, H.323, analog, Cisco, Avaya, and other protocols on physical on-premises appliances. We are adding Teams compliance recording as another protocol to this existing platform.

Given our architecture requires all protocols to be recorded on the same physical appliance, what would be the specific limitations, risks, or supportability concerns if we deployed the Real-Time Media bot on an on-premises Windows Server in production rather than Azure?

Additionally, are there any alternative approaches or partner program considerations for compliance recording vendors that would allow us to maintain our unified on-premises architecture?
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-02-11T07:37:17.32+00:00

Hi CG,

Thank you for your follow-up question.

After reviewing your new environment-related requirements, I can see that your concern is quite complex and depends on multiple conditions, but most importantly, the need for accurate confirmation. For this matter, I regret to inform you that this platform is a user‑to‑user support forum. Moderators, contributors, and external Microsoft employees participating here do not have access to internal documents or your specific environment for dedicated assistance. Our role is limited to offering technical guidance and sharing best practices based on reported issues, requests, or ideas.

At this point, despite extensive research, I find that the available public documentation is insufficient for me to provide a precise answer regarding your latest concern. Therefore, I kindly recommend submitting a support ticket directly to Microsoft via the Azure portal. Microsoft’s support agents have the required tools and authorization to review your system and provide accurate, up‑to‑date information regarding your recording setup.

I sincerely regret that I am unable to support you further on this matter. The information I have shared so far represents my best effort based on what is publicly available. If you receive clarification from Microsoft Support, I would greatly appreciate it if you could return and share your insights here so that other users who plan to build a similar system in the future can benefit from your findings.

Additionally, if you found the discussion in this thread helpful, I would be grateful if you could consider accepting my answer so that the information can be highlighted and made easier for others to discover.

Thank you again for your engagement.
CG 45 Reputation points

2026-02-15T21:43:10.1666667+00:00

Thank you for your help thus far ! Very much appreciated. I would certainly share my insights once I get clarification from Microsoft.

Answer 2

CG 45

Hi,

Here's a summary of my setup:

Phase 1: Azure Portal Setup (domainA.com)

App Registration

Create a new App Registration in the Azure Portal.

Supported Account Types: Choose "Accounts in any organizational directory" (Multitenant).

API Permissions: Add the following Application Permissions (Microsoft Graph):
- Calls.AccessMedia.All Calls.JoinGroupCall.All
```
`Calls.Initiate.All`
```
Grant Admin Consent: Click "Grant admin consent for xxxxxx" so the permissions are active for your testing.

Authentication (Certificate)

Upload an existing certificate bound to port 8443 .cer file to your App Registration under "Certificates & secrets."

Create the Azure Bot Resource

Create an Azure Bot resource.
Link the App ID: Use the Client ID from Step 1.
Messaging Endpoint: https://bot.testing.com:8443/api/messages/).
Teams Channel: Enable the "Microsoft Teams" channel and check the "Enable Calling" box. Provide your webhook for calling (e.g., https://bot.testing.com:8443/api/calling/).

Phase 2: Customer Provisioning (domainB.com)

Admin Consent

Provide this link to the domainB.com admin: https://login.microsoftonline.com/common/adminconsent?client_id=YOUR_APP_ID Once they sign in and accept, your bot is officially authorized to "exist" in their tenant.

PowerShell Infrastructure

The admin needs to run these commands using the Microsoft Teams PowerShell Module.

Step A: Create the Application Instance This creates a "ghost user" in their tenant that represents your bot.

New-CsOnlineApplicationInstance

Take note of the ObjectId returned by this command.

Step B: Sync the Instance

PowerShell

Sync-CsOnlineApplicationInstance

Step C: Create & Assign the Policy This tells Teams: "Whenever these users call, invite the Bot."

PowerShell

# Create the policy

# Link your bot to the policy

When I tried a test call between ******@domainB.com and ******@domainB.com, I did not however received any events at all.

I have a listener started on https://bot.testing.com:8443/api/calling/

Am I missing a step ? Is there a way to test whether the bot has joined once a call is established between userA and userB ?

Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-23T15:53:05.0633333+00:00

Hi CG,

Thank you for providing the detailed update.

I’ve reviewed the information and it seem that you have followed all the required steps according to Microsoft’s guidance. However, I understand that you are still not receiving any incoming call notifications to your webhook endpoint.

Since call-related workflows can be quite complex and may require deeper investigation, I will need additional time to research the issue thoroughly. I will get back to you as soon as I have any relevant findings.

In the meantime, to help narrow down whether the issue might be related to configuration, you can try testing the call flow in Home Tenant A, where the application is originally registered. Additionally, please check whether the application appears under Enterprise Applications in the Azure Portal of Tenant B, to ensure that it has been properly provisioned.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-26T16:26:19.1+00:00
Hi CG,

I hope you’re doing well. Just following up to share a few more insights that may help your investigation.

First, Microsoft outlines specific recorder‑bot considerations and requirements. Please check whether your current setup matches those requirements.

Also, the Microsoft sample guide includes firewall configuration. Please verify whether any firewall or proxy could be blocking your calling webhook endpoint (inbound HTTPS).

Looking forward to your input.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-28T08:54:29.65+00:00

Hi CG,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.
CG 45 Reputation points

2026-01-30T00:49:20.2133333+00:00

Hello,

Thank you for your response. I reapplied the policies and I was finally able to get the events coming through via webhooks. I was able to get the bot to join as well. As far as the audio, would the bot be able to forward the RTP packets and would they be encrypted ? IF we go the route of downloading after the call is complete, how long after is the call available ?
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-01-30T10:58:25.1633333+00:00

Hi CG,

Thank you for the follow‑up and for keeping me updated.

I’m glad you were able to get notifications flowing to your calling webhook. Regarding your additional questions, here’s a concise summary based on Microsoft documentation.

On “forwarding RTP” and media encryption: Teams encrypts media with SRTP, exchanging session keys over the TLS signaling channel; the Microsoft Real‑time Media Platform then handles encryption/decryption and transport and exposes decoded, frame‑by‑frame media (for example, 20‑ms PCM audio frames) to your bot via the media sockets, your code does not interact with the original SRTP packets. As a result, there is no API to tap and transparently relay Teams’ native SRTP stream. If you need to “forward” audio, implement an egress from the bot (for example, repacketize the decoded frames to your own RTP/SRTP or send over TLS/WebSocket/HTTPS) and secure that hop yourself.

On “downloading after the call”: what Microsoft makes available post‑call is metadata, not the audio. Microsoft Graph Call Records are created after the call/meeting ends and are retained for 30 days; they contain participants/sessions/quality data and you can subscribe to change notifications to get a webhook when a record is created or updated. For policy‑based compliance recording, Microsoft doesn’t publish a media file to download; your recorder bot is the system of record and must capture/store the audio in real time in your own storage per your compliance policy. This differs from user‑initiated “Cloud recording”, which stores files in OneDrive/SharePoint and is not the compliance workflow.

I hope the information above helpful.
Kudos-Ng 15,050 Reputation points Microsoft External Staff Moderator

2026-02-03T10:23:50.2533333+00:00

Hi CG,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.
Heimlich 0 Reputation points

2026-07-18T14:59:14.63+00:00

I've been looking for something like this to record all of my calls. I do have a solid understanding of C# so I don't need an Enterprise app. Just need something I can throw into Azure/etc that can capture all the calls.