How to set up a Microsoft user for Q-Play integrations

How to set up a Microsoft user for Q-Play integrations

Introduction

To show Power BI reports and other data from Microsoft services on your screens, Q-Play needs a Microsoft user it can log in with. This guide shows you how to set up that user securely.

Q-Play logs in with a username and password only, so the user cannot have multi-factor authentication (MFA). If your organisation requires extra security, you can limit the user so it can only log in from Q-Play’s IP addresses.

1. Before you start

Supported services
The setup works for Microsoft services such as Power BI, SharePoint and Office 365, in both Microsoft 365 Business and Enterprise.

Access in Microsoft 365
You need someone who can create users and change security settings in your Microsoft 365, typically your IT department.

Licence
A dedicated user may need its own Microsoft licence, depending on your subscription.

2. How to set up the Microsoft user

  1. Create a dedicated user. Create a user that is only used for Q-Play, for example q-play@yourdomain.com.
  2. Turn off MFA for the user. The user must not use SMS codes, an authenticator app or any other MFA method, because Q-Play cannot respond to them.
  3. Send us the login details securely. If NordicScreen sets up the integration for you, send the username and password through our secure form. See How to send us a password securely.

3. Extra security with Conditional Access

Without MFA, the user is protected by its password only. With a Conditional Access policy in Microsoft Entra, you can make sure the user can only log in from Q-Play’s servers. A stolen password then cannot be used from anywhere else.

This requires technical knowledge, so ask your IT department to help.

  1. Complete section 2 first. The user must be set up without MFA before you add the policy.
  2. Find Q-Play’s IP addresses. Use the IP addresses for the Q-Play V2 integration servers in Network and security requirements for Q-Play and Q-Cal, section 3.
  3. Create a Conditional Access policy. In Microsoft Entra, create a policy for the Q-Play user that only allows login from these IP addresses. See Microsoft’s guide to Conditional Access policies.

4. Next steps

Read how Q-Play stores and protects your login details in How your Q-Play integrations are secured.

5. Frequently asked questions

Which Microsoft services can we integrate with Q-Play?

Q-Play supports several Microsoft services, including Power BI, SharePoint and Office 365. This guide covers the general setup of the user.

Do we have to turn off MFA?

Yes, for the Q-Play user. Q-Play logs in with a username and password only. To make the user more secure, limit login to Q-Play’s IP addresses as described in section 3.

Where do we find Q-Play’s IP addresses?

In Network and security requirements for Q-Play and Q-Cal, section 3, under Q-Play V2 integration servers.

Does the guide apply to all Microsoft 365 accounts?

Yes, both Business and Enterprise. What you can set up depends on your organisation’s security policies.

Does a dedicated user cost extra?

It may, depending on your Microsoft subscription and whether the user needs a licence.

What if the setup does not work?

Contact your IT department first. If the problem is with the integration in Q-Play, contact NordicScreen at support@nordicscreen.com.