Zime with Microsoft 365: a guide for IT
What your Microsoft 365 admins approve for Zime, how Entra, Conditional Access, Teams and Intune policies affect it, and what each Microsoft error means
Zime connects to Microsoft 365 in six places: sign-in, the Outlook calendar, the notetaker in Teams meetings, Teams native recording, the Zime app in Teams and Zime Mobile. This page shows your IT team what to approve for each one, how your Entra, Conditional Access, Teams and Intune policies affect it, and what each Microsoft error means.
What your IT team approves
Every company that signs in with Microsoft approves Zime AI. The other Zime apps depend on the features you use.
All four apps are registered in Zime's own Microsoft tenant, so in yours they appear under Enterprise applications, not App registrations. Search by application ID if a name looks different.
| Zime app in Microsoft Entra | What it is for | Who approves it | When you need it |
|---|---|---|---|
Zime AI (0c0473d2-2adc-4115-83c6-6f4cd84df7d9) | Signing in to Zime with Microsoft, and connecting Outlook calendars | A Global Administrator | Before anyone signs in |
Native recording app (8674ff13-6f04-4c3f-83d7-27a5318d6ea4) | Teams native recording | A Global Administrator, after a Zime admin clicks Connect Workspace in Zime | Only if you record Teams meetings natively |
Zime Notetaker (00c3a9ee-0b6f-4099-9eef-9011792c5c95) | Letting the Zime app in Teams read the thread it is asked in | A Global Administrator or Privileged Role Administrator | Optional |
Zime Mobile (e9b17ec8-756d-4c74-9ba9-2b761c3b42cb) | Microsoft sign-in inside the Zime Mobile app | A Global Administrator, Cloud Application Administrator or Application Administrator | Only if Conditional Access requires Intune app protection on phones |
Sign-in to the Zime web app
People sign in to Zime on Microsoft's own sign-in page, so your Entra and Conditional Access rules apply to Zime as they do to any other app.
Before the first sign-in, a Global Administrator approves Zime AI for the whole organization. The steps are in Sign in with Google or Microsoft. The same sign-in opens from the Zime app in Teams, from the browser sign-in in Zime Mobile and from AI assistants such as Claude, so the rules below apply there too.
| Your policy | What it means for Zime |
|---|---|
Multifactor authentication | Microsoft asks for it on its sign-in page. Zime needs nothing extra. |
Assignment required on Zime AI | Only the people and groups you add under Users and groups can sign in. Anyone else gets error AADSTS50105. |
Compliant device, managed browser or approved app | The check applies to the device and browser people sign in from. On a phone, Safari or Chrome can be blocked with "You can't get there from here". Open Zime in Microsoft Edge if Microsoft asks for it, and see Zime Mobile below for the app. |
Location, sign-in frequency and other session controls | These apply when people sign in. Zime also keeps Outlook calendars in sync from its own servers, with the access each person approved, so these policies can apply to that background access too. |
Outlook calendar
Each person connects their own Outlook calendar in Zime, and Zime only reads it.
Connecting uses the same Zime AI app as sign-in and adds calendar access, so Microsoft may ask for approval a second time. If your organization does not let people approve apps themselves, a Global Administrator connects their own calendar first and ticks Consent on behalf of your organization. Upcoming meetings, the notetaker, native recording and prep notes all need the calendar. The steps for each person are in Connect Outlook Calendar.
| Permission | Asked for when | What Zime uses it for |
|---|---|---|
openid, email, profile and User.Read | Signing in | The person's name and email address, to match them to their Zime account |
User.ReadBasic.All | Signing in | Microsoft shows it as reading all users' basic profiles. Zime reads only the profile of the person signing in. |
Calendars.Read | Connecting the calendar | Read-only access to the calendar of the person who connects it. Zime never creates, changes or deletes events. |
offline_access | Connecting the calendar | Keeps the calendar in sync without asking the person to approve again |
The notetaker in Teams meetings
The Zime notetaker joins Teams meetings without an account in your organization, so Teams treats it as an outside participant.
It needs no approval in Entra and no setup in the Teams admin center. It joins at the meeting's start time under your company's notetaker name, which is Zime Notetaker unless your Zime team set another, and any host can remove it. If nobody admits it from the lobby, it leaves after 10 minutes, or after the wait your Zime team set for your company. More in The Zime notetaker.
| Teams setting | Effect on the notetaker | What you can do |
|---|---|---|
Who can bypass the lobby | When outside participants wait in the lobby, someone in the meeting has to admit the notetaker. | Ask organizers to admit it. In meetings where everyone can bypass the lobby, it joins without waiting. |
Joining without signing in | If your policies stop people from joining meetings without signing in, the notetaker cannot join. | Use Teams native recording for meetings your colleagues organize. Nothing joins the call. |
Recording notices | People see the notetaker in the participant list. If Notify attendees about privacy policy when notetaker joins is on, it also posts a chat message saying who invited it. | Turn that switch on in Zime Settings, on the Recording platforms tab. Your company is responsible for any recording consent your local law requires. |
Teams native recording
Native recording uses Teams' own cloud recording, so nothing joins the call.
Setup has three parts. Your Teams admin sets the meeting policy and transcript access in the Teams admin center. A Zime admin clicks Connect Workspace in Zime, and a Global Administrator approves it on Microsoft's consent screen. Then each meeting organizer clicks Enable Native Recording. The steps and the full list of permissions are in Microsoft Teams native recording.
| What gets in the way | What happens | What to do |
|---|---|---|
The organizer's meeting policy does not allow cloud recording | Zime sends the notetaker instead, when bot fallback is on. It is on by default. | Allow cloud recording in the meeting policy assigned to your organizers. |
Transcription or Transcript API access is off | Recordings arrive without speaker names. | Allow transcription in the meeting policy. Under Meetings, Meeting settings, Transcript API access, turn on Microsoft Graph access and Include speaker attribution. |
The organizer has not enabled native recording, or works for another company | The notetaker joins instead, when bot fallback is on. | Ask each organizer to click Enable Native Recording. Meetings that other companies host are recorded by the notetaker when your settings allow it. |
Assignment required on the native recording app | Organizers who are not assigned cannot finish Enable Native Recording. | Add the organizers under Users and groups for that app. |
The Zime app in Teams
Your Teams administrator uploads the Zime app once as a custom app, and each person signs in to it once.
The app comes from Zime as a .zip file. It asks for no permissions and needs nothing in Entra, apart from one optional approval that lets it read the thread it is asked in. Custom apps must be allowed in the Teams admin center under Teams apps, Manage apps, Org-wide app settings. They are by default. The steps are in Zime in Microsoft Teams.
| Who | What they do |
|---|---|
Teams Administrator or Global Administrator | Uploads the app under Teams apps, Manage apps. Chooses who can use it under Users and groups, Availability, and can install it for teams and people under Installs. |
Global Administrator or Privileged Role Administrator | Optionally approves thread reading, which Microsoft lists as Read all channel messages for the Zime Notetaker app. |
Team owners | Add Zime to their team from Apps, or accept Teams' offer when someone @mentions Zime in a channel. |
Everyone who uses it | Has a Zime account under the same email as their Microsoft account, and signs in once from the link Zime sends. The sign-in lasts 90 days. |
Zime Mobile
By default, Zime Mobile signs people in through a browser sheet, which works with multifactor authentication but cannot meet a policy that requires Intune app protection.
For those policies, your Zime contact turns on Microsoft sign-in in the app for your company. People then see Sign in with Microsoft, and the app signs in through Microsoft Authenticator on iPhone or Company Portal on Android. The full steps are in Zime Mobile with Intune and Entra.
Tell your Zime contact
Ask your Zime contact to turn on Microsoft sign-in in the app. Send them your Microsoft Entra tenant ID, your email domains and one pilot user.
Approve Zime Mobile
In Microsoft Entra, open Enterprise applications, then Zime Mobile, and grant admin consent for your organization.
Add Zime to your app protection policies
In the Intune admin center, add Zime as a custom app: ai.zime.app in the iOS policy and com.zimemobile in the Android policy.
Assign users and licences
Assign the policy to the Zime users, and check that each of them has an Intune licence.
Sign in on the phone
Each person installs Microsoft Authenticator (iPhone) or Company Portal (Android), signs in to the Zime web app with Microsoft once, then taps Sign in with Microsoft in Zime Mobile.
Microsoft messages and what they mean
When Microsoft blocks someone, they see a message on Microsoft's sign-in page, and the attempt appears in your Entra sign-in logs with an error code.
In Microsoft Entra, go to Users, choose the person and open Sign-in logs. The Conditional Access tab of an attempt names the policy that applied. For messages from Zime itself, such as Domain Not Authorized, see What the sign-in messages mean.
| Message or code | What it means | Who fixes it |
|---|---|---|
Need admin approval, or Approval required and Request sent | Your organization does not let people approve apps themselves, and Zime has not been approved yet. | IT. Approve Zime as described in Sign in with Google or Microsoft, or approve the waiting request under Enterprise applications, Admin consent requests. |
AADSTS65001 | Zime has not been approved for one of the permissions it asks for. With Outlook, sign-in may be approved while calendar access is not. | IT. For Outlook, a Global Administrator connects their own calendar in Zime and ticks Consent on behalf of your organization. For Zime Mobile, grant admin consent on the Zime Mobile app again. |
AADSTS650052 | Microsoft could not finish the approval because Zime AI is not set up in your tenant yet. | IT. A Global Administrator signs in to Zime, ticks Consent on behalf of your organization, then tries again. |
AADSTS50105 | Assignment required is on for that Zime app, and this person is not assigned. | IT. Add the person or their group under Users and groups for that app in Enterprise applications. |
AADSTS50011 | The address Microsoft sends people back to after sign-in is not registered for your Zime workspace. | Zime. Email support@zime.ai. |
You can't get there from here | A Conditional Access policy blocked the sign-in, for example one that needs a compliant device, Microsoft Edge or app protection. | IT. Check which policy applied on the Conditional Access tab of the sign-in log. On phones, use Edge for the web app, and see Zime Mobile above for the app. |
AADSTS53009, for Zime Mobile | Your policy requires Intune app protection. Zime Mobile then sets it up and signs in again. | Nobody, if a successful sign-in follows. If it keeps failing, check that Zime is a targeted app in your policy and that the person is assigned and licensed. |
Couldn't apply the required app protection, in Zime Mobile | Zime is not a targeted app in your app protection policy, the person is not assigned, or they have no Intune licence. | IT. Follow Steps 2 and 3 in Zime Mobile with Intune and Entra. The person then deletes and reinstalls Zime. |
Questions
Sign-in and Conditional Access
6 answersWhich admin role approves Zime for sign-in?
A Global Administrator. They sign in to Zime and tick Consent on behalf of your organization on Microsoft's screen, then tick it again when they connect their own Outlook calendar. The steps are in Sign in with Google or Microsoft.
Can we limit Zime to some people?
Yes. In Enterprise applications, open Zime AI, set Assignment required to Yes under Properties, and add the people or groups who use Zime under Users and groups.
Zime also lets in only people on your company's approved email domains. See Who can sign in.
Does Zime work with multifactor authentication?
Yes. Microsoft asks for it on its own sign-in page, and Zime needs no extra setup.
How do we check that the approval worked?
In Enterprise applications, open Zime AI, then Security, then Permissions, to see what your organization approved. Then ask a colleague to sign in. They should reach Zime without being asked for administrator approval.
Why does Microsoft show Inner Fit Research Inc as the publisher?
Inner Fit Research Inc is the legal entity behind Zime, as named in the Zime Terms of Use.
Do Zime's connectors for Claude and other AI assistants need anything in Entra?
No. People sign in to them with their usual Zime sign-in, which uses the Zime AI app you already approved.
Outlook calendar
3 answersCan Zime change or delete calendar events?
No. Zime asks only for Calendars.Read, which is read-only.
People see Need admin approval when they connect Outlook. What do we do?
Calendar access has not been approved for your organization yet. A Global Administrator connects their own Outlook calendar in Zime and ticks Consent on behalf of your organization. After that, everyone else can connect without an approval step.
Calendars keep disconnecting. Could our policies cause it?
They can. Zime keeps calendars in sync from its own servers, and Conditional Access can apply to that access as well as to sign-in. In Microsoft Entra, look for failed Zime AI attempts in the non-interactive sign-in logs and open their Conditional Access tab.
Zime emails the person when their calendar disconnects, and they can reconnect it from Settings.
The notetaker in Teams meetings
4 answersDoes the notetaker need any approval in Microsoft 365?
No. It joins from the meeting link on the invite, like any outside participant, so there is nothing to approve in Entra or the Teams admin center.
How do we stop the notetaker waiting in the lobby?
Someone in the meeting admits it, or the meeting lets everyone bypass the lobby. To skip the lobby for meetings your colleagues organize, use Teams native recording, where nothing joins the call.
Can we keep the notetaker out of some meetings?
Yes. Admins can block domains, email addresses, meeting links or large meetings. See Domains, vendors and exclusions.
Do participants know the meeting is recorded?
They see the notetaker in the participant list, and it can post a chat message saying who invited it. With native recording, Teams shows its own recording notice to everyone. Your company is responsible for any recording consent your local law requires.
Teams native recording
3 answersWhich Microsoft 365 licences does native recording need?
Meeting organizers need a licence that includes Teams cloud meeting recording. Teams Premium is not needed.
Can we pilot native recording with a few organizers?
Yes. Admin consent covers the whole company, and only the organizers who click Enable Native Recording are recorded natively. The notetaker covers everyone else when bot fallback is on.
What does Zime change in Teams?
One meeting option. 10 minutes before each eligible meeting, Zime turns on Record and transcribe automatically through the organizer's connected account. It stays on afterwards, including for later meetings in a recurring series, until the organizer turns it off.
The Zime app in Teams
3 answersDo Conditional Access or Intune policies affect the Zime app in Teams?
The sign-in link opens your normal Zime sign-in in the browser, so the same rules apply as for the Zime web app. Thread reading uses Zime's own approved access, so no Microsoft token is requested on anyone's behalf.
Can people use the Zime app in Teams on their phones?
Yes. The sign-in link opens in the phone's browser. If your policies block sign-in from phone browsers, people can sign in once from a computer instead, because the sign-in belongs to their Teams account.
We control Teams apps with app permission or setup policies. What do we change?
Allow Zime for the people who will use it, as you would any custom app. To add it for people so they do not have to add it themselves, use Install app under the app's Users and groups, Installs.
Zime Mobile
4 answersWhy does sign-in work on a computer but not in Zime Mobile?
Check whether a Conditional Access policy applies only to phones, such as one that requires app protection or an approved app. The browser sheet in Zime Mobile cannot meet those policies. Set up Microsoft sign-in in the app, or exclude Zime Mobile from the policy, as described in Zime Mobile with Intune and Entra.
Do we have to manage Zime Mobile with Intune?
No. You can exclude Zime Mobile from the policy that requires app protection. Your Zime contact still turns on Microsoft sign-in in the app, and an admin still approves Zime Mobile. Zime data on the phone is then outside your app protection controls. If your policy targets all resources, the exclusion may not take effect for Zime's sign-in. Use the Intune steps in that case.
Why do people need to sign in on the web first?
Microsoft sign-in in Zime Mobile works for people who already have a Zime account linked to Microsoft. Signing in to the Zime web app with Microsoft once sets that up. Until then the app shows: Sign in to Zime on the web once to set up your account, then retry on mobile.
Why don't people see Sign in with Microsoft in the app?
Your Zime contact switches on Microsoft sign-in in the app for each company. Until it is on, or on an older version of the app, people see a single Sign in button that opens the browser sheet.
Still need help?
Email support@zime.ai and include the details below.
If you report an issue, include:
- The person's email address and the time of the attempt, with time zone
- The message on screen, or the AADSTS code
- The Entra sign-in log entry, including its Conditional Access tab