Plan and prepare for MyDesk implementation
Organize your team.
The size and scope of your implementation will determine how many resources you need. However, all project teams should include the following participants:
A project owner
The project owner must be involved from inception, implementation, go-live and beyond. It is important that this person participates and supports the project all the way.
One or more system administrators (MyDesk System Owners)
This person should be actively involved throughout the implementation and beyond. It is important that the administrator understands the processes in MyDesk so that we can continue to meet all requirements from managers and users.
Microsoft Exchange/Office 365 Administrator/Global Admin
This person(s) is responsible for your Microsoft Exchange Server or Office 365 platform and has the rights and permissions to connect MyDesk with Exchange. This person should be involved throughout the implementation and beyond. It is important that the administrator understands the requirements and dependencies for the connection between MyDesk and Exchange.
A project manager
This person leads the implementation and ensures that the project tasks and overall schedule are on track.
One or more super users
These users help ensure that your project meets the needs of end users and business needs, including management.
We also recommend using super users as first-line support alongside your service desk, as these super users are often experts.
To be a successful superuser, it is important to train these users. This means that extra energy is put into ensuring that these people know the MyDesk program from end to end.
These can be office managers, facility managers, service managers, canteen/kitchen managers, finance or others with key roles in your organization who will use the system as super users.
One or more people responsible for creating training material
Trainers should identify relevant materials from mydesk.io/knowledge or develop custom training materials (such as quick reference guides).
You’ll need materials both for the initial deployment to introduce new users and once Mydesk is live, for patching or new functionality.
Service desk / internal support
This team is your internal support team, service desk or help desk that handles all internal support tickets and first-line IT issues before escalating them to MyDesk Support. This team needs to be trained to handle all MyDesk-related issues.
Consent to MyDesk
Why consent?
MyDesk is a modern application hosted in the Azure Cloud using the latest security technology. It’s very easy to access and requires almost no time for IT administrators.
To start the onboarding process, you need to give MyDesk consent with an administrator user. This admin user gives consent on behalf of the organization’s users. So anyone who needs access can access the application.
MyDesk does not store any passwords or sensitive information other than the person’s email linked to a booking.
MyDesk does not store or have access to your user accounts and passwords, this is stored at Microsoft, and we store as little information as possible:
For deskbooking:
- Name of user
- Seat ID
For meeting room booking:
- No information is saved in MyDesk, it is saved and stored in your Exchange Online
Note: If you have enabled shared meeting rooms, all meeting information for the shared meeting room is saved in MyDesk so that we can share the information with users who are not part of your Tenant but who you want to share with.
Meeting catering
- Email on meeting booker
- Time of meeting
- Meeting room
- Information about meeting catering
Guest registration
- Host
- Guest name
- Guest email
- Guest phone number.
Please note that all data stored in MyDesk is anonymized after 14 days or by agreement. This means that if you, for example, have booked a specific seat, it will be anonymized after 14 days and you won’t be able to see who has booked, just that there has been a booking.
Essentially, your consent only gives MyDesk access to your employees’ Office 365 email so we can log you into your system.
Once you accept the consent, you are ready to start adding locations, areas and make your first reservation. There is no user onboarding. All users have access from the start with their own Office 365 login.
To give consent, follow this link:
Consent explained (Technical)
In general, we use Office Graph APIs to access data. However, access to data is always done with Delegated Access, i.e. in the user’s own context and not the application.
MyDesk does not have access to data.
I MyDesk there are many different functions that require different rights to function, like the Graph API exhibits.
Read all company places:
The authorization gives MyDesk allowed to read on behalf of the logged in user. This permission is used to view meeting room resources and their associated calendars. This is necessary in order to set up and use MyDesk to book meeting rooms and show whether they are occupied or not.
Sign you in and read your profile:
Allows users to log in to the app and allows the app to read the profiles of logged in users. Further allows the app to read basic company information about the logged-in users.
Read all users’ full profiles:
The permission allows Mydesk to read on behalf of the logged in user. We are allowed to read profile settings, roles such as manager/leader over other users in your organization.
It reads all basic properties of other users in your organization including full name, email and photo. This is relevant data for the user to look up their colleagues in the system and see your own updated data.
It is used to set up manager booking. This means that when you are logged in with a user who in Azure AD / Microsoft Entra ID has the manager / leader role, the person can book space for the people he/she is managing.
Read all groups:
In the permission for the full profile, we get access to see the profile’s roles. This reading is used here to make manager bookings. In addition to seeing the profile roles, we also need to have access to read the groups that the leader is a part of.
Have full access to user calendars:
Allows mydesk access to the logged in user’s calendar. This is used to add desk bookings and meeting bookings from MyDesk. This means that when a desk booking is made or a meeting room is booked, the meeting is added directly to your Outlook 365 calendar.
In addition, it allows you to add a meeting room/meeting catering to an existing meeting inside MyDesk.
Read group memberships: This permission gives the right to see what type of member you are in the groups you are part of in Azure AD / Microsoft Entra ID.
Just as it is important to know what the person’s roles are in the company, it is also important to know what roles they have in each team.
Read presence information of all users in your organization:
This authorization allows MyDesk to read any person’s activity on behalf of the logged in user. This is to be able to show the user what status colleagues have.
Examples of using the Graph.API
- Find colleagues
AYou can search for colleagues to see where they are sitting on any given day and view their profile picture and master information. In addition, with the same feature, you can build your own teams so you have easy access to see where all your closest colleagues are. To be able to see colleagues’ picture, master information and presence is required: Precense.Read.All, User.Readbasic.All, User.Read, User.Readbasic.All.
Presence.Read.All contains 2 pieces of information from user profiles.
{ “id”: “66825e03-7ef5-42da-9069-724602c31f6b”, “availability“: “DoNotDisturb”, “activity“: “Presenting” }
- Book on behalf of others
In MyDesk you can enable features such as: book for colleagues and manager booking. Book for colleagues means that you can book on behalf of colleagues who are affiliated with the same department. This feature requires: User.Read.All, User.Read, User.Readbasic.All
Manager booking allows you to make bookings for all those who refer to you as a manager in AD. This feature requires: User.Read.All, User.Read, User.Readbasic.All.
Book on behalf of others applies to desk booking only.
- MyDesk access groups
In MyDesk, you can configure which people can book in different areas based on AD security groups. These groups can be assigned to both areas and locations in MyDesk. In addition, security groups are also used to give access to different areas in MyDesk – for example, who are administrators, who has access to reporting, etc. To avoid tying it to people, we use AD groups. For this you need: Group.Read.All, GroupMember.Read.All.
What does MyDesk need from you to do the setup?
What do you need to deliver
In order for us to set up MyDesk for you, we need the following:
Technical approval (Consent to Mydesk, Certificate for certain modules)
MyDesk uses Microsoft Office 365 login to give your users access to MyDesk, which makes it easy for them on a daily basis as they do not have to remember a new username or password and also get single signin, i.e. when they are logged into their PC, they are also logged into MyDesk.
Read more about the technical approval under “Consent to MyDesk”
Please note, consent only needs to be given once and not per product.
Setting up Deskbooking
Consent must be given
In the context of starting up with MyDesk, consent must be given, this only needs to be done once by an administrator user. – You can read more about the Consent here.
Floor plans
We draw your floor plans in 3D and maintain them for you on an ongoing basis, but in order to do this we need your existing floor plans where we can see what desks and meeting rooms are.
As it’s important for us to give your users a true picture of your office, it would be a great help if you could include a few pictures where we can see your furniture, flooring and wall colors.
We accept all formats of floor plans, even if you only have a sketch you have drawn yourself. However, it will mean we’ll probably have to go through a trial or two to get it right, which is no problem!
Setting up areas
When implementing MyDesk desk booking, your floor plan is divided into areas for each larger or smaller group of desks. These areas should be named according to what you want. Our recommendation is to name them after the departments that sit in the areas, such as HR, Facility, Support etc.
If there are no fixed seats and everything needs to be free for booking, names such as “Flyverpladser” or “Flex” could be an option. The best way to illustrate to us how you want your areas to be divided is to either print a drawing and mark it by hand or use paint / photoshop to create some areas and write in text what they should be called. See examples below.
Seats are marked with a blue highlighter, yellow are things they want added and the tables marked with something red in the middle should be on the map but not bookable. That way, we get a clear picture of what you want and where you want it, which means we can get to the finish line faster and you can start desk booking.
Alternatively, you could also use different tools either a program made for creating floor plans or something as simple as paint and place spaces etc.
If you want specific seat names on each desk, this should also be noted on the drawing.
Setting up Meeting Room Booking
Consent must be given
In the context of starting up with MyDesk , consent must be given, this only needs to be done once by an administrator user. – You can read more about the Consent here.
Floor plan if desired
For meeting room booking, floor plans are not a requirement, but we strongly recommend it as all platforms provide a great overview and an easy way to choose your meeting room.
We draw your floor plans in 3D and maintain them for you on an ongoing basis, but in order to do this we need your existing floor plans where we can see what desks and meeting rooms are.
As it is important for us to give your users a true picture of your office, it would be a great help if you can attach a few pictures where we can see your furniture, floors and wall colors.
We accept all formats of floor plans, even if you only have a sketch you have drawn yourself. However, it will mean we’ll probably have to go through a trial or two to get it right, which is no problem!
A user in your domain
If you want MyDesk helps you set up and place meeting rooms on your floorplans. Or if you want us to set up meeting screens for you, we need to get a user in your tenant, it could be called “Mydesk@*JeresTenant*.dk
The reason we need an account is because MyDesk does not have access to your exchange, it requires a user with access to view your meeting rooms in MyDesk.
Placement on floor level
If MyDesk is to place your premises on the floor plan, we need a picture of your floor plan where they are marked by name.
If you want to apply them yourself, this step is not necessary.
Shared meeting room setup
Consent must be given
In the context of starting up with MyDesk , consent must be given, this only needs to be done once by an administrator user. – You can read more about the Consent here.
Certificate must be installed
In order to share meeting rooms across tenants in MyDesk it is necessary to additionally install a certificate in your AD. It’s a quick process that needs to be done by an administrator. Read more here.
A list of which tenants that should have shared meeting rooms
It is important for Mydesk to know which tenants to share meeting rooms with.
In order to share meeting rooms with other tenants it is necessary that they also give consent to MyDesk, this is so they can log in with their SSO.
Setting up Meeting Catering
Certificate must be installed
In order to use meeting catering in MyDesk it is necessary to install an additional certificate in your AD. It’s a quick process that needs to be done by an administrator. Read more here.
Menu card
If you have chosen to offer your employees meeting catering through MyDesk, we need your menu card with the following information
- Product name
- Price
- Period you can order the item (e.g. 08-16)
- Is there a restriction on when orders can be placed (e.g. Can be ordered the day before at the latest at)
- Some comments / notes on products
- If it varies which items are available at specific locations, this should also be stated
Setting up Guest Registration
Consent must be given
In the context of starting up with MyDesk , consent must be given, this only needs to be done once by an administrator user. – You can read more about the Consent here.
A talk about guest registration design
Setting up Planner
Consent must be given
In the context of starting up with MyDesk , consent must be given, this only needs to be done once by an administrator user. – You can read more about the Consent here.
Certificate must be installed
In order to use Planner in MyDesk it is necessary to install an additional certificate in your AD. It’s a quick process that needs to be done by an administrator. Read more here.
Security in MyDesk
MyDesk is dedicated to maintaining the highest standard of security to protect your data and ensure that your information is confidential and protected. Here are some key points that illustrate our commitment to safety:
Hosted in the Azure CloudMyDesk is a modern application hosted in the Azure Cloud. This gives us access to the latest technology and security measures.
Audits by PwC: We undergo ongoing audits by PricewaterhouseCoopers (PwC) as part of our 3402 Statement of Assurance. This ensures that our security practices and underlying processes are in line with industry best standards and security measures.
Anonymization of data: We anonymize all data stored in MyDesk after 14 days or by agreement. This means that personal information will be deleted or anonymized to protect your data. For example, if you have made a booking, the details will be anonymized after 14 days and only the existence of the booking will be preserved.
3402 Statement of Assurance: You can download and view our 3402 Statement of Assurance here.
Access to Exchange for shared meeting rooms / meeting catering / planner
When you need to use MyDesk to share meeting rooms, manage meeting catering or use planner it is necessary to implement an app registration in Azure with an associated certificate. This gives MyDesk access to communicate with your meeting rooms’ calendar without the need for an individual MyDesk user with login and password.
Implementation requirements:
App registration in Azure: Create an app registration in your Azure account. This involves defining application credentials, security configuration and permissions to access Exchange data.
Attach certificate: MyDesk generates and sends a certificate specifically for your tenant.
This way we can manage the following tasks in MyDesk on your behalf:
- Ensure that meeting catering always contains the correct information about the meeting time
- Cancel catering for meetings deleted through Outlook or other applications
- Planner can read all meetings in the meeting room calendar and update/move them.
- Show the people you share your meeting rooms with when there are free periods they can book.
- Book meetings in your exchange meeting rooms ffor the companies your meeting rooms are shared with.
Possibility to limit which meeting rooms can be booked through MyDesk.
Access to Exchange for the new app registration will by default include all calendars in Exchange Online. To limit this to meeting rooms only, an “Application Access Policy” must be created. To do this, follow the instructions below:
Create an email-enabledsecuritygroup with all meeting rooms in
Connect to Exchange Online through PowerShell
https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps&preserve-view=true
Run the following command in PowerShell:
New-ApplicationAccessPolicy -AppId [AppID] -PolicyScopeGroupId [SecurityGroupEmail] -AccessRight RestrictAccess -Description “Restrict this app to members of distribution group”
[AppId]: Application ID of the app registration that was made for the application earlier
[SecurityGroupEmail]:Email on the mail-enabled security groups containing all meeting rooms
Note that it can take over an hour before the new policy is replicated to work against Microsoft’s Graph API.
You can use the following command to verify if the application has access to a specific mailbox:
Test-ApplicationAccessPolicy -Identity [Mailbox] -AppId [AppId]
[Mailbox]: Email of the meeting room to test access against
[AppId]: Application ID of the app registration that was made for the application earlier
User management between MyDesk & Azure AD / Microsoft Entra ID
It is possible in Azure AD / Microsoft Entra ID to create security groups in which you can insert the users who should have the different rights in MyDesk.
Roles in Mydesk:
User: Default user role – For those who will use the system.
Administrator: The administrator has access to all administration in MyDesk, that is, it includes all other roles.
Manage locations: This role allows you to add, remove or edit desk booking areas that are set up in MyDesk.
Bookings: In bookings you can see all desk bookings created in MyDesk
Users and permissions: The users and permissions role provides access to create other users and/or set AD security groups on a role.
Lunch & Catering: Ability to view and manage lunch, also the ability to view/edit meeting catering and get an overview of the day’s orders.
Floor plan: In the floor plan you can add/edit the overview images for the areas, MyDesk support does this for you but it is possible to gain access.
Book for all: People with this right can desk book for everyone.
Put a security group on a role:
Inside Mydesk “administration -> Users and permissions” you have the option to create groups with your AD Security groups.
1. Press “Add new group”
2. Search for your AD group in the window that opens.
3. Once the AD group is selected, you then select the rights they should have in MyDesk.
When you press Save, all your AD groups will have received the rights you have given them.
When you update the group in Azure AD / Microsoft Entra ID it will be updated in MyDesk without you having to do anything else. That way, everything is kept in your own system and doesn’t need extra management from the MyDesk platform.
MyDesk deployment and training
We’re excited to have you on board and we want to ensure that your experience implementing MyDesk in your business is as smooth and seamless as possible. Here’s a guide on how you can roll out MyDesk and get the most out of our platform:
“Get started with MyDesk” In our Knowledgebase you will find a dedicated section called “Getting started with MyDesk”. Here you can find all the necessary guides, resources and step-by-step tutorials to get started with MyDesk. Whether it’s installation, configuration or using different features, you can find everything you need in this section.
Connecting to a contact personAt the start of MyDesk, you will be assigned a contact person who will be your primary contact during the rollout process. You can always contact this person for guidance, advice and ideas on how to optimize the use of MyDesk to best suit your needs and requirements.
Ongoing Support: Deployment is just the beginning. We are here to support you all the way through your journey with MyDesk. Whether it’s technical support or update requests, you can always count on our dedicated support team to do their best to help you.
Support after implementation
We’re here to make sure your experience with MyDesk is as seamless and pleasant as possible. Here’s an overview of how our support function works, so you always know how to get help when you need it:
- Contact via Email: You can contact our support team by sending an email to: support@mydesk.io. Whether you have questions, problems or suggestions for improvement, our team is ready to help you.
- Contact person at Onboarding: During your onboarding process, you will be assigned a contact person who you can turn to with any questions or concerns. Your contact person is there to ensure that your start with MyDesk goes smoothly and that you feel comfortable with our platform.
- Reply within 24 hours: We strive to respond to all inquiries within 24 hours. Whether it’s technical issues, needing changes to your MyDesk portal or just general questions, you can expect a fast and efficient response from our team.
- Administration is minimized: At MyDesk, minimizing the administrative burden for our customers is important to us. Therefore, we encourage you to contact our support team with any request or change you may need in your MyDesk portal. We’re here to help with everything from moving a desk on the floor plan to implementing improvements based on your ideas and feedback.
- Held in the Loop: When you contact our support, you can expect to be kept updated throughout the process. We make sure to keep you informed about the status of your inquiry and make sure you feel safe and well-informed along the way.
We hope this guide gives you a clear understanding of how our support function works and how you can best get help when you need it. At MyDesk , our goal is to deliver an excellent and attentive customer support experience so you can focus on what really matters to you and your business.
