Synergy JOIN Installation Manual

Synergy JOIN Installation and
Configuration Guide

Synergy JOIN 4.0

January 2020

© Synergy SKY 2019

Synergy JOIN Install ation and Configuration Guide

Contents

Introduc tion 4

About Synergy JOIN 4

How Synergy JOIN works 5

Feature overview 5

Overallprocess from installto end user 5

Limitations 6

How the Skype URIs are generated 6

How the call is routed 7

Requirements 9

DeviceSupport 11

Exchange Resource Account Requirements 12

Microsoft Graph API 14

Google Cloud Platform Configuration 17

Google Cloud Platform 17

Enabling API's and Services 19

Service Account 22

Enable Serviceaccounts to access Calendar Resources 25

Polycom EWS Emulator 29

Exchange In-Body Update Requirements 32

Installing & Upgradi ng to Synergy JOIN 4.0 35

Synergy JOIN 4.0 36

Synergy JO IN Qui ck Setup Guide 38

Matching Rules for Skype for Business& Teams Meetings 40

Matching Rules for Hangouts Meetings 41

Matching Rules for WebRTC Meetings 42

Synergy JOIN with Dynamic VMR's 43

Matching Rules for StaticVMR's 44

Configuring Synergy JOIN 46

Task 1: Launching the configuration tool and installing the service 46

Google Cloud Platform Configuration 47

Google Cloud Platform 47

Enabling API's and Services 49

Service Account 52

Enable Serviceaccounts to access Calendar Resources 55

Polycom EWS Emulator 59

Task 2: Launching the configuration tool and installing the service 62

Task 3: Configuring the General Settings 64

Task 4: Testing that emailis working 65

Task 5: VMR Pools 66

Task 6: Creating Matching Rules 71

Task 7: Adding Rooms 76

Page 2 of 121

Synergy JOIN Install ation and Configuration Guide

Task 8: Adding Video Systems 77

Task 9: Configuring Conference Settings 79

Task 10: Configuring Services(optional) 82

Task 11: Adding a License 87

Task 12: Configuring Emailtemplates 88

Task 13: Configuring a proxy server (optional) 90

Exampl e meeting scenari os 91

Scenario 1: Bookinga Skype meeting with one or more video-enabled meeting-rooms 91

Scenario 2: Bookinga Personal VMR (Virtual Meeting Room) meeting with one or more video-enabled meeting­rooms 91

Scenario 3: Bookinga One-time-VMR withone or more video-enabled meeting-rooms 91

Scenario 4: Forwarding an existing invitation to a video-enabled meeting-room 92

Manually upgrading JO IN 93

Synergy JO IN Troubles hooti ng 94

Common troubleshooting scenarios 95

Exchange permissions 97

Using the logs 98

Licenses 99

Database 100

Exampl e meeting scenari os 101

Scenario 1: Bookinga Skype meeting with one or more video-enabled meeting-rooms 101

Scenario 2: Bookinga Personal VMR (Virtual Meeting Room) meeting with one or more video-enabled meeting­rooms 101

Scenario 3: Bookinga One-time-VMR withone or more video-enabled meeting-rooms 101

Scenario 4: Forwarding an existing invitation to a video-enabled meeting-room 102

Example meeting scenarios 103

Task 14: Configuring Emailtemplates 105

Synergy JOIN emailTemplates 106

Manuallyupgrading JOIN 108

Appendix 1: Using Synergy JOIN for Skype IVR with Pexip 109

Example: 110

Appendix 2: Pexip PolicyScript for use with Synergy JOIN Skype IVR 114

Appendix 3: Pexip Virtual Reception for use with Synergy JOIN Skype IVR 115

Appendix 4: Using Synergy JOIN with AMX/Crestron for Cisco and Polycom endpoints 117

Appendix 5: How to create a StarLeaf Cloud authorization token 118

Appendix 6: Configuring Cisco Meeting Server profiles with Synergy JOIN 120

Appendix 7: Deleting unwanted future meetings 121

Page 3 of 121

Synergy JOIN Install ation and Configuration Guide

Introduction

About Synergy JOIN

New technologies have made it possible for enterprise collaboration solutions to work seamlessly together. Today Skype for
Business users and video conferencingusers participate in joint meetings as standard, with high-quality video, audio and
content sharing. There are still some challenges, however, when it comes to the user experience.

Joining a meeting usingSkype is easy,but the video conference user has to dial the meeting address from a video touch pad or a
remote control. It may not even be possible to dialthe address from an endpoint if the meeting ishosted in Office365 (Skype
Online). Automating the connection process is therefore of great value to organizations.

Synergy JOIN (JOIN) solvesthis by automatically connecting video-enabled meeting-rooms to Skype meetings using Cisco One
Button To Push (Cisco OBTP) or Polycom Click To Join (Polycom CTJ). The end-user simplyschedules a new Skype meeting in
Microsoft Outlook and adds the required video-enabled meeting-rooms. JOIN manages the connectionand bringsthe Cisco
OBTP or Polycom CTJ information to the video endpoint. You can alsoforward a Skype meeting invitation to a video-enabled
meeting-room and automatically enable Cisco OBTP or Polycom CTJ. JOIN removes the riskof typing errors, and ensures that
allmeetings start on time.

In addition, JOIN can be used to schedule meetings in personal VMRs, and for Cisco and Pexip environments, in one-time­VMRs, sending the Cisco OBTP or Polycom CTJ information to the scheduled video endpoints and dialing out to endpoints that
do not support Cisco OBTP or Polycom CTJ.

JOIN is shipped as a Windows installer with a simple setup wizard that enables quick deployment.

The solution supports Pexip, CiscoCMS and StarLeaf Cloud environments, and on-premisesinstallations of Skype and
Microsoft Exchange as wellas Office 365.

Page 4 of 121

Synergy JOIN Install ation and Configuration Guide

How Synergy JOIN works

Feature overview

JOIN supports the following feature set:

l BookingSkype or Teams meetings using Outlook: JOIN creates a Skype/Teams URI for the meeting that issent as Cisco

One Button To Push (Cisco OBTP) or Polycom Click To Join (Polycom CTJ) to allvideo endpointsscheduled in the same
meeting.

l BookingOne-time-VMRs (Cisco and Pexip only): the endpoints receivethe URI as Cisco OBTP or Polycom CTJ.
l JOIN can identifypatterns in meeting room invitationsso that the endpoint can be populated with Cisco OBTP or Polycom

CTJ information for personal VMRs (e.g. [e-mail]).

l JOIN dials out to booked endpoints that don't support Cisco OBTP or Polycom CTJ.
l Emailscontaining the dial-ininformation for the meeting can automaticallybe sent to the meeting participants.

Overall process from install to end user

1. After installation, video admins add the following information into the JOIN configuration tool:

o

Exchange or G oogl e serv er connection settings.

o

MCU details (Pexip MCU that acts as Skype Gateway, CiscoCMS MCU for Dual Home meetings, Videonor as
MCUand SkypeGateway or StarLeaf Cloud).

o

Exchange video-enabled meeting-room resources or Google Hangouts meeting resources.

2. Users book a Skype, personal VMR or One-time-VMR video meeting from Outlook, inviting one or more video-enabled
meeting-room resources.

o

Users book a Google meeting from their Google Calendar, inviting one or more video enabled meeting-room
resources.

3. JOIN monitors the meeting-rooms at the interval specified in Polling interval in minutes , to check if they receive a
meeting invite. This is how it works with a Pexip MCU:

o

Skype invitations sent to meeting-room resources include a URI in thisformat:

sip:[e-mail];gruu;opaque=app:conf:focus:id:TTC86056

endpoint can call eg:

[e-mail]

(this format is defined in Matching Rules in the

configurator).

o

For one-time-VMR meetings, the URI is generated based on the format defined in Matc hing Rules in the
configurator.

o

For personal VMR meetings, the URI in the invite body is identified as the URI.

4. The URI issent to the endpoint as Cisco OBTP or Polycom CTJ ready for attendees to start the meeting.

5. The callis routed either through Pexip or CMS to the Skype server, using a gateway rule on the MCU, or through Cisco
CMS to the Skype server, usingthe Dual Home technology, or through the StarLeaf Cloud to the Skype server.

which JOIN rewrites to a URI the meeting-room

Page 5 of 121

Synergy JOIN Install ation and Configuration Guide

Limitations

Cisco CMS

At thistime JOIN can only dial out from one-time-vmrs on CMS, not from personal VMRs and Skype for Business(S4B)
meetings. This means that for S4B calls and personal VMR callswhen using CMS, the meeting can onlybe joined via Cisco
OBTP/Polycom CTJ.

StarLeaf Cloud

At thistime JOIN can be used to enable Cisco OBTP/Polycom CTJ for the following scheduled meetings:

l Office 365 / Skype for Businesson-premises
l StarLeaf Cloud

How the Skype URIs are generated

Skype URIs for JOIN shouldbe based on your company dialplan.

Pexip /Videonor /Videxio

In thisexample, usinga Pexip MCU, our URI Prefix is S4B (for Skype for Business). We recommend usinga prefix that easily
identifies these URIs on your network as Synergy JOIN Skype for BusinessURIs.

NB. The prefix for Videxiois usually__sfb__ (two underscores + sfb + two underscores) but should be confirmed on installation.

The second part of the URI isthe Sky pe Meeting ID, and the last part is the Skype User ID.

A URIcreated from our matching rule pattern looks like this:

URI Prefix Skype Mee ting ID Skype Use r ID Full U RI

S4B TTC86056 [e-mail] [e-mail]

Cisco CMS

With CMS, the format of the replace value is
routing domain that ensures the callis routed to the CMS.

(SkypeURL)@CompanyCMSDomain.local

where “CompanySkype.com” is the

Page 6 of 121

Synergy JOIN Install ation and Configuration Guide

This domain must alsobe added as a “Targets Lync Simplejoin” domain on the CMS under Configuration > Incoming Calls.

StarLeaf Cloud

The Skype URI sent to the endpoint isthe URI of the gateway callprovisioned in the StarLeaf Cloud by JOIN.

This URIisin this format:

[e-mail]000000

How the call is routed

Pexip / Videonor /Videoxio

There must be a Destinati on alias match in a gateway rule on the Pexip that corresponds to the matching rule URI pattern so
that when the endpoint dialsthe skype URI, it is routed correctly.

The protocol for this rule must be MS-SIP.

Destin atio n a lia s ma tch Rep la ce strin g Protocol

S4B\.([a-zA-Z0-9]+)\.(.+@.+) \2;gruu;opaque=app:conf:focus:id:\1 Lync (MS-SIP)

See Pexip documentation for more information on creating gateway rules.

Note: If callsgo through a VCS, you need a search rule on the VCSto send calls corresponding with the prefix of your URI

pattern to Pexip (in our example, S4B).

Cisco CMS

The callis routed through the CMSto Skype using the Dual Home functionality:

Page 7 of 121

Synergy JOIN Install ation and Configuration Guide

1. When a Skypemeeting is forwarded to a video-enabled meeting-room that has been added to JOIN, JOIN tellsthe
endpoint to callURL@simplejoindomain.

2. The VCS routes the callto CMS.

3. On CMS, the callhits the incoming callssimplejoin rule and CMS sets up the call.

Note: The “Lync simplejoindomain” must be present on the VCS.

StarLeaf Cloud

1. The endpoint callsout to the StarLeaf Cloud using the URIitreceived from JOIN.

2. The StarLeaf Cloud calls the Skype meeting.

Page 8 of 121

Synergy JOIN Install ation and Configuration Guide

Requirements

Windows Server software

Oper atin g syste m Addition al fe atures req uired

Windows Server 2008 r2 64 bit ( or newer) Microsoft .NET 4.5.1 Fr amework

Windows Server hardware

Num be r o f video-en ab le d me eting
roo ms

0 - 100 4 Cores 8 GB 20 GB

100 - 300 4 Cores 16 GB 50 GB

300 - 900 4 Cores 32 GB 100 GB

900 - 2000 6 Cores 40 GB 150 GB

2500 + 8 Cores 64GB 250 GB

CPU RAM HDD

Network requirements

Sour ce Destin atio n Protocol Port (TCP

Synergy JOIN Microsoft Exchange HTTPS 443 Scheduling.

Synergy JOIN Cisco TMS HTTP

HTTPS

Synergy JOIN PexipManagement Node HTTPS 443 Initiatingdial-out calls.

Synergy JOIN PexipConferenceN ode HTTPS 443 Optional: JOIN requires access to onePexipconference nodefor

Synergy JOIN StarLeafCloud:

https://api.starleaf.com

Synergy JOIN Cisco CMS HTTP

Synergy JOIN Cisco codecs HTTP

Synergy JOIN Polycom codecs N/A N/A N/A - JOIN does not talk to the codec - the Polycom endpoints get

Synergy JOIN Synergy SKY Upgrade service HTTP 80 Automatic upgrade of JOIN via this URL:

Synergy JOIN Internet HTTP

Synergy JOIN Cisco IX, TX and CTS Codecs HTTP 8081/9501 Updating the IX,TX andC TS Codecs with Cisco OBTP information

HTTPS 443 Provisioning gateway call in StarLeaf Cloud.

HTTPS

HTTPS

HTTPS

un less
othe rw ise
stated )

80

443

80

443

80

443

80

443

Descr iptio n

Tracking codecs on DHCP.

Provisioning one-time VMRs.

displaying “End of Conference W arnings”

Initiating dial-outcalls.

Provisioning one-time VMRs.

Updating codecs with Cisco OBTP information.

them eetings from Exchange.

http://synergysky.com/upgradeService/

JOIN r equires internet access to findthe address to the Skype
meeting for CMS Office 365 meetings, and for all external Skype
invitations that are forwarded.

Port forwarding to Cisco endpoints

Ciscovideo systems that are on external networks can be reached directly over the internet by setting up a port forwarding rule
in the firewall to allow direct access to the video system.

Note the following if using port forwarding to Cisco endpoints:

• Ensure the Port Forwarding rule only accepts requests from the specific IP address that JOIN will connect from.

• Ensure the Port Forwarding rule forwards requests to the HTTPS service of the Video System.

Page 9 of 121

Synergy JOIN Install ation and Configuration Guide

• Ensure the Video System's HTTPS service isenabled.

• Ensure the Video System has a strictpassword set.

• Include the port number after the IP address when configuring the Video System in JOIN (e.g. 213.112.33.179:8081).

Service accounts

Accoun t type Permission s re qu ired

Microsoft Exchange User (with a mailbox) Readand W rite access to Meetingr oom resource m ailboxes ( Editor access to user

PexipMCU Admin API account or LDAP API account.

Cisco CMS Admin API account.

StarLeafCloud Youneedto have Allow sch edu lin g e xtern al conferen ces enabled on your

Cisco codecs Admin user account.

Polycom codecs N/A - JOIN does not talk to the codec - the Polycom endpoints get themeetings from

Cisco TMS (optional - usedto track codecs on DHCP) Site administrator user account.

Google API Access API Scopes to allow for calendar access

Google Service Account Google Super Admin account in GSuite(admin.google.com). Additionally, Enable

mailboxes required if using in-body update)

organization’s account.

See"How to createa StarLeaf Cl oudauthorizationtoken" on page118

Exchange.

Domain Wide Delegation on the service account(console.cloud.google.com)

Page 10 of 121

Synergy JOIN Install ation and Configuration Guide

Device Support

Devices that are supported with Synergy Join

Device Versio n Com me nts

Microsoft Exchange On Prem and 0ffice 365( Exchange

Cisco TMS 12.0 - 15.5

PexipMCU 13- 20

Cisco CMS 1.8- 2.4 Must be configuredwith Dual Home:

StarLeafCloud N/A Youneedto have Allow sch edu lin g e xtern al conferen ces

Cisco codecs:

l C -series
l M X-series
l SX-series
l EX-series
l D X-series
l IX -series
l TX-series
l C isco Spark Room Kit
l C isco Webex Room 55 Single & Dual
l C isco Webex Room 70 G2
l C isco Webex Room Kit Mini, Room Kit, Room

Kit Plus & Room Kit Pro

Polycom codecs:

l H DX
l Groupseries
l Trio

Online)

l 2010 SP2andlater
l 2013 all SPs
l 2016

The “Lync simplejoin domain” must be present on the VCS if the
endpoints route calls through one. Also, theCMS must have a
working Lync outbound rule set up ( Trunk type: Lync).

enabled on your organization’s account.

See"How to createa StarLeaf Cl oudauthorizationtoken" on

page118

l TC5.x and newer
l C E8.x andnewer

All versions supportingPolycom CTJ The endpoints m ust be configured to poll calendar data from

Exchange using the Polycom Calendaring service:

l The Polycom endpoints must be configured to get the m eetings

from their own room account in Exchange.

l JOIN will rewrite thebody of these meetings in the Exchange

room accounts to embedthe URI of the meeting in a Polycom­friendly way.

NOTE:

The Polycom Tr io i s supported with Polycom C lick To Join for one­Time-VMRs and regex/static VMRs in Synergy JOIN version 2.6.
Microsoft Skype and Teams support is available in JOIN version

3.0. The reasonis that the Tr io w ill incorrectly try to call thehidden
SkypeGRUU if it finds it in the meeting invitation header whenthere
is a different U RI in the Polycom VMR token Synergy JOIN
generates, even if theTrio is notregistered towards a Skypeserver.

Page 11 of 121

Synergy JOIN Install ation and Configuration Guide

Exchange Resource Account Requirements

When deploying Synergy JOIN, we recommend running the following scriptson all of the rooms in Microsoft Exchange in order
to unlockthe full potential of the product:

Add-MailboxPermission -Identity <roomAlias> -User <ServiceAccount> -AccessRights FullAccess

Set-CalendarProcessing<roomalias> -DeleteComments $false-DeleteSubject$false -RemovePrivateProperty $false -
AddOrganizerToSubject $false -ProcessExternalMeetingMessages $true

The embedded test tool in the JOIN Configurator can be used to verify most of these properties, and suggestsPowerShell
commands to configure the rooms according to the JOIN recommendations.

The function of the various Exchange resource properties are explained in the table below.

Exchange Resource properties

Prop er ty nam e Fun ction in Microso ft Exchan ge Fun ction in Syner gy JOIN Reco mm en de d

DeleteC om ments The Dele teComm en ts parameter

DeleteSu bje ct Specifies whether to removeor keep the

Rem ove Priva tePrope rty The Re mo vePri vateProp er ty parameter

AddOrga nize rTo Sub je ct The AddOrganizerToSubject parametors

specifies whether to remove or keep any
text in the m essage body of incoming
meeting r equests.

Valid input for this parameter is

$false

.

This parameter is used only on resource
mailboxes where the
AutomatePro cessing parameter is set to

AutoAccept

.

subject of incomingmeeting requests.

Valid input for this parameter is

$false

.

The default value is

This parameter is used only on resource
mailboxes where the
AutomatePro cessing parameter is set to

AutoAccept

.

specifies whether to clear the private flag for
incomingmeeting requests.

Valid input for this parameter is

$false

.

The default value is

By default, the private flag for incoming
meeting r equests is cleared. To ensure the
privateflag that was sent by theorganizer in
theoriginal request remains as specified,
set this parameter to

specifies whether to add the organizers
name toethe subject line.

Valid input for this parameter is

$false

.

The default value is

$true

$true

$false

$true

$true

$true

.

$true

.

.

$true

.

When set to
body of themeeting invitationwhen
booking rooms.

As the matching rules rely onr eading

or

contentin the body of the email, this stops
Regex and the Skype URI i n Bod y rule
from working in JOIN.

When set to
subject of them eeting which means JOIN
does not display a meetingtitle on the

or

touch panel of the video system.

If you wantthesubject of the m eeting to
be hidden, you can select the Private flag
whenbookingthe m eeting in Outlook,
even i f this property is set to

Seealso Rem ove PrivatePrope rty.

When set to
Private flag when a Room is booked as a
resource in a meeting flagged as Private
in Outlook.This means that the meeting

or

title is visible to everyonefor all
meetings.

By setting this property to
hidethe title on meetings that are booked
as Private in Outlook, while showing the
title of all other meetings.

When set to
organizers fir st name and last name to
thesubject line of the meeting.

or

If you do not w antto display the meeting
name, at minimum we recommendto set
this field to

$true

, Exchange deletes the

$true

, Exchange deletes the

$true

, Exchange removes the

$true

, Exchange adds the

$tru e

$false

$false

you can

Setting

$false

$false

.

$false

$false

Req uire d

Yes,so that your
matching r ules
work correctly.

Yes,if youwant the
meeting title to be
displayed on the
touch panel.

No.

Yes,if youwant to
hidethe m eeting
title on the touch
panel.

Page 12 of 121

Synergy JOIN Install ation and Configuration Guide

Prop er ty nam e Fun ction in Microso ft Exchan ge Fun ction in Syner gy JOIN Reco mm en de d

Proce ssExtern alM ee ting Me ssage s The Proce ssExtern alMe etin gM essa ge s

AutomatePro cessing The Auto mateProcessin g parameter

AllReq uestInPolicy

AllReq uestOutOfPolicy

Req uestInPol icy

Req uestOutOfPolicy

parameter specifies whether to process
meeting r equests thatoriginate outside the
Exchange organization.

Valid input for this parameter is

$false

.

The default value is

By default, meeting requests that originate
outside of the organization are r ejected.

enables or disables calendar processing on
them ailbox.

This parameter takes the followingvalues:

l

None

Both the r esource booking
attendantand the Calendar Attendant
are disabled on the m ailbox.

l

AutoUpdate

Attendant processes m eeting requests
and r esponses.

l

AutoAccept

Attendant andr esource booking
attendantare enabled on the mailbox.
This means that the Calendar Attendant
updates the calendar, and then the
resource bookingassistant accepts the
meeting basedupon the policies.

The default value on a resource mailbox is

AutoAccept

The default value on a user mailbox is

AutoUpdate

on a user mailbox.

Theseparameters specify whether to allow
users to submit policy requests.

Valid input for theseparameters are

$false

The default value is

Only the Calendar

Both the Calendar

.

, but you can't changethevalue

.

$false

$false

$true

.

.

When set to
allow external users to book Rooms
resources.

However, a r oom is booked on behalf of

or

theorganizer if a user forwards an invite
into a r oom. This setting must therefore
be set to
forward invitations to external Skype
meetings into their meeting r ooms, so
that they can benefit from easy callinginto
external Skype meetings.

external users booking their rooms
directly by usingan internal domain in the
room’s alias (e.g.

$false

$true

to allow internal users to

Note : Administrators can still avoid

[e-mail]

Meetings that are booked in Room
resources are stored as
this settingis set to

Tentative meetings are not processed by
JOIN, as you can book multiple tentative
meetings within the same time interval in
one r esource.

Meetings booked in Room resources that
are configured with either of these
properties that require meetings to be

$true

or

approvedby a delegate,will not be
processed by JOIN until they are
approved.

This will lead to a significant delay for the
meeting organizers, andis therefore not
recommended.

, Exchange wil l not

)

Tentative

AutoAccept

.

Setting

$true

AutoAccept

unless

$false

Req uire d

Yes,so that
forwarding invites
from external
users works
correctly.

Yes.

Recommended:
configure so that
approval is not
required.

Enabling forwarding of external meeting invitations

Microsoft willonlyprocess meeting requests for meetings booked by external users if the settings
ProcessExternalMeetingMessages isset to “$true”. Enabling this setting potentiallyexposes your meeting rooms from being
booked directlyby external users, but can be mitigated in one of two ways:

l Either stop direct emailsfrom external users from ever reaching the room mailboxes; which can be done by a transport

rule in the Hub Transport server in Microsoft Exchange. The rule can be set to stop emailsfrom external users from
reaching the mailboxes in a specific distribution list like the list of meeting rooms

l Alternatively you can change the aliasof the rooms to a domain that isonly available internally in the Exchange

environment; i.e. changing [e-mail] to [e-mail]. The acme.localdomain shouldnot be
reachable from the outside, but willbe available for internal users.

Either of these changes will enable users to forward invitations they receive from the outside to their meetingsrooms, while
hindering any external users from booking their meeting rooms directly.

NOTE. Enabling ProcessExternalMeetingMessages does not in any way expose the information of existing meetings to external
users.

Page 13 of 121

Synergy JOIN Install ation and Configuration Guide

Microsoft Graph API

Microsoft willbe deprecating Basic Auth access for EWS in October 13th, 2020. In line with thischange, Microsoft have created
anew authentication method known as Microsoft Graph. Microsoft Graph allows for increased performance towards the
Microsoft Cloud. Over time, Microsoft have introduced OAuth 2.0 for authentication and authorization, which is a more secure
and reliable way than Basic Authentication to access data.

You can find additional information relating to Microsft Graph here

We have provided instructions on how to set up Microsoft Graph with Synergy JOIN below.

Configuring Microsoft Graph API

1. Log In to https://portal.azure.com

2. Click on Azure Active Directory

3. SelectApp Registrations

4. Click on New Registration

5. Enter a name and click on Register

6. Copy the fieldsApplication (client) ID and Directory (tenant) ID

a. These are to be used when configuring Synergy JOIN

Page 14 of 121

Synergy JOIN Install ation and Configuration Guide

7. Click on Certificates& Secrets

8. Click on New client secret, then give it a name and set it to never expire. Clickon add

9. Copy the client secret

Note: Thissecret isto be used when configuring Synergy JOIN

10. Clickon API Permissions

11. Clickon Add a permission, Microsoft Graph, Application permissions. Check Calendar.ReadWrite, User.Read.Alland
Mail.Send, then clickthe Add permissions button

Grant Consent

12. An admin account would need to login and clickthe “Grant admin consent” button

Page 15 of 121

Synergy JOIN Install ation and Configuration Guide

Configuring Microsoft Graph API in Synergy JOIN

Once you have completed the above setup in the Azure Active Directory, you willhave to go to your Synergy JOIN installation
and paste the Client ID, Tenant ID and Client Secret from your above configuration.

Once you have alsoselected the Graph ActOnBehalfOfEmail,you have completed the setup.

Click on Test Connections to make sure your configuration is correct.

Configurable Options for Graph API

Graph API provides the abilityto customize how Synergy JOIN is collecting information from your Exchange environment. These
valuesare to be changed manually in the config.json file.
If installed int he default directory, the Config.json file can be found in the following location:
C:\SynergySKY\SynergySKYEnterpriseScheduling\config\config.json

"CalendarSyncWindowSizeDays": 180, - Specifieshow many days in the future Synergy JOIN can collect meeting information

"CalendarSyncWindowRefreshIntervalDays": 30, - Specifies how often Synergy JOIN should re-syncits database with the
room calendar

i.e The 'CalendarSyncWindowSizeDays' does not applyto Recurring Meetings. When a recurring meeting isdetected by
Syneegy JOIN, the entire series is synced and provided with OBTP information

Page 16 of 121

Synergy JOIN Install ation and Configuration Guide

Google Cloud Platform Configuration

Introduction

In order toinstallSynergy SkyJOIN with Google Calendar integration, the G Suite environment must be prepared. This isdone
through the following 4 steps

1. Create a GoogleCloud Platform Project or use an existing project

2. Enable three distinct APIs and Services

3. Create a service account or use an existing service account. This account must be given correct permissions. A private key
must be generated and copied to the JOIN server.

4. Appropriate Calendar Accessmust be given to the Service Account viathe G Suite Domain

Google Cloud Platform

A GoogleCloud Console Project is required in order for JOIN to be able to read calendar resource accounts, user accounts and
also have accessto APIs that enable the JOIN integration.

Create a Google Cloud Platform Project or use an existing Project. The Project willbe used for the API integration as wellas for
the Service Account.

Logging into the Google Cloud Platform console:

l Browse to the following URL: https://console.cloud.google.com/iam-admin/serviceaccounts
l Log in with your admin user account to manage your Google cloud console.

Creating a Project

(Skip this section if you already have a project you want to add this account to)

N.B on some occasions, Google failsto create the project and as such, sometimes you may need to create the project twice

To create new Google Cloud Console project,

l Select IAM & Admin
l Click the 'Create' button.

Page 17 of 121

Synergy JOIN Install ation and Configuration Guide

l F illin your projectname, i.e. 'SynergyJOIN'.
l Select Create

Choosing an Existing Project

Follow these steps if you already have existing projects you would like to use for this project,

Page 18 of 121

Synergy JOIN Install ation and Configuration Guide

l Click on the Project Drop down arrow at the top left corner and you willbe presented with the 'Select a Project Window'.
l Select your desired project and click'Open'

Enabling API's and Services

You willhave to enable API's to work with the project you have created. The API's you willhave to enable are Google Calendar
API, GMailAPI & Admin SDK.

n Google Calendar API - To allow reading and updating resource calendars

n GMailAPI - To allow sending email

n Admin SDK - To allow listing out current available resourcesfrom the configuration tool

You need to enable one API at a time

Go to the Menu, Select APIs & Services > Dashboard

Select'Enable APIs and Services'

Page 19 of 121

Synergy JOIN Install ation and Configuration Guide

You should now be presented with the API Library.

You willhave to search for the APIs from this screen.

First, Search for 'Google Calendar API'

Selectthe 'Google Calendar API.

Page 20 of 121

Synergy JOIN Install ation and Configuration Guide

Click Enable

Once you have found this API, you willthen have to perform a new search for GMail API

SelectEnable for the GMail API

Once you have found this API, you willthen have to perform a new search for Admin SDK API

SelectEnable for the Admin SDK API

Page 21 of 121

Synergy JOIN Install ation and Configuration Guide

Service Account

Create Service Account

SelectIAM & Admin and Choose 'ServiceAccounts

Page 22 of 121

Synergy JOIN Install ation and Configuration Guide

Enter a Service Account Name and select Create

Selectthe role for this service account. Resource Manager > Organization Administrator.

This willallow the service account to manage the meeting room resources.

Once you have selected the role, Clickthe 'Create Key' Button.

Page 23 of 121

Synergy JOIN Install ation and Configuration Guide

Create a Private Key for JOIN

On the next screen, choose the JSON radio button and click 'Create'

A file willbe downloaded to your disk, this is your authentication information to be used by the JOIN application.

l Copy thisfile to the same directory as the JOIN application. (i.e. c:\SynergySKY\SynergySKYEnterpriseScheduling).
l Keep a secure copy of this file, since a new serviceaccount isrequired to be created if its lost.

Once you are have moved the file to the same directory as the JOIN application and you click 'Done' you will be presented with a
screen similar to the below with your newly created service account visible in the list.

Page 24 of 121

Synergy JOIN Install ation and Configuration Guide

Enable Service accounts to access Calendar Resources

In order toenable Service accounts, first we need to find the Serviceaccount ID for the service account on
https://console.cloud.google.com

SelectIAM & Admin and Choose 'ServiceAccounts

Page 25 of 121

Synergy JOIN Install ation and Configuration Guide

Copy the service account ID

An Administrator of the G Suite domain must complete the next steps

Google Admin Console

Browse to the Google Admin Console https://admin.google.com

SelectSecurity from the listof controls.

If you don't see Securitylisted, select More controls from the gray bar at the bottom of the page, then selectSecurity from the list
of controls.

N.B If you can't see the controls, make sure you're signed in as an administrator for the domain.

Page 26 of 121

Synergy JOIN Install ation and Configuration Guide

SelectAdvanced settingsfrom the list of options

Select'Manage API clientaccess'in the Authentication section

1. In the Client Name field enter the service account's Client ID or Service account ID (which we copied in the previous step).

In the One or More API Scopes field enter this list of scopes:

https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly

- To populate AvailableRooms in the JOIN configtool

https://www.googleapis.com/auth/calendar.readonly

- To allow JOIN to access room calendars enabled in JOIN

Page 27 of 121

Synergy JOIN Install ation and Configuration Guide

https://www.googleapis.com/auth/gmail.send

- To allow JOIN to send notifications to its administrators as wellas dial-in instructionsfor certain workflows (e.g. one-time

VMRs).

https://www.googleapis.com/auth/calendar

- For workflows requiring calendar invitation updates, suchas the green button for Polycom endpoints(if the EWS emulator is

not used) or meeting invitation body updates, JOIN also has to have a write calendar accessfor those rooms.

https://www.googleapis.com/auth/calendar.events

- For workflows requiring calendar invitation updates, such as the green button for Polycom endpoints(if the EWS emulator is
not used) or meeting invitation body updates, JOIN also has to have a write calendar access for those rooms. If read-only is
sufficient, it should be at leastthis one set there: https://www.googleapis.com/auth/calendar.events.readonly

Note: All of the scopes are required for the integration of Synergy JOIN with Google G Suite. It isnot possible to exclude
some of the scopes as this willcause parts of the integration not to work

You can copy and paste the below api scopes as they are into the 'One or More API Scops' field box

https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly,
https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/calendar.readonly,
https://www.googleapis.com/auth/gmail.send,https://www.googleapis.com/auth/calendar.events

Click Authorize.

The outcome should looklike the below example:

Service-act-on-behalf-of Email

Browse to the dashboard and select 'Users'

Page 28 of 121

Synergy JOIN Install ation and Configuration Guide

In the users section, select the user that you would like to use as the 'service-act-on-behalf-of Email'in Synergy JOIN.

Scrolldown to the 'Admin roles and privileges' section and verifythat the user you would like to use has the role of 'Super Admin'
enabled.

Once you have verified this, copythe email address from this user and paste thisinto the 'service-act-on-behalf-of email' text
button in the 'General Settings' tab in the Synergy JOIN configuration tool.

More information on the general settingstab can be found here

Polycom EWS Emulator

There are instanceswhen the Polycom Endpoint is unable to communicatewith the Exchange Server and as such, the endpoint
isunable to use the builtin Polycom Click To Join technology. The EWS emulator within Synergy JOIN bringsback the ability to
utilize the Polycom Click To Join technology on your Polycom Endpoints.

The EWS Emulator is compatible with the HDX, Group Series and Trio endpoints.

Configuring Synergy JOIN

The Polycom Exchange Web Service(EWS) Emulator in Synergy JOIN acts as an Exchange Web Server. Thismeans Synergy
JOIN willretrieve the calendar information from exchange and populate thisto the endpoint.
WithinSynergy JOIN you have to Enable the EWS Emulator from the Servicestab.

You have to then configure your Video System as a Polycom endpoint. Once you do this,Synergy JOIN willknow to send the
Polycom ClickTo Join Token to that endpoint.

Page 29 of 121

Synergy JOIN Install ation and Configuration Guide

Configuring the HDX and Group Series Polycom Endpoint

The Polycom endpointsmust be configured to pollcalendar information from the JOIN server which willbe acting as an
Exchange Web Server.

Instructions on how to configure this on a Polycom Group Series endpoint are below:

Page 30 of 121