Visitor management integrations: Microsoft Entra ID, Microsoft 365, Teams, Slack and webhooks.

Microsoft Entra ID directory sync

You connect your own Entra app registration with the Microsoft Graph application permissions User.Read.All and GroupMember.Read.All. A hosts group fills your employee list, so visitors can pick their host. Separate Admins, Receptionists and Viewers groups decide who can use BeckonDesk and with what role; if someone is in more than one, the most senior role wins. Being a host gives no access on its own.

Sync runs on the interval you set (every 24 hours by default, as often as every hour). BeckonDesk checks for a due sync every 15 minutes, and "Sync now" runs one straight away. With "Remove people who leave the group" switched on, anyone taken out of every access group loses access at the next sync.

SCIM 2.0 provisioning

For identity providers that speak SCIM 2.0, BeckonDesk has a /scim/v2 endpoint authenticated with a per-workspace bearer token. It provisions users only; there is no Groups endpoint. New users arrive as Viewers (read-only) and an admin raises their role in BeckonDesk. Deleting a user in your identity provider deactivates them in BeckonDesk.

SCIM creates sign-in users, not hosts. To fill the host list from your directory, use Entra ID directory sync.

Microsoft 365 calendar pre-registration

Using the same app registration as directory sync, with the Calendars.Read application permission added, BeckonDesk reads the calendars of up to 500 synced hosts every hour, looking 14 days ahead. Outside guests on meetings a host organized become expected visitors at the meeting's start time. Guests count as outside when their email domain is not one of your company's domains.

If the meeting moves, the expected visit moves with it. If the meeting is cancelled, or a guest is taken off it, that guest's expected visit is cancelled, unless they have already arrived. Calendar bookings are not screened when they are created; sanctions and watchlist screening runs when the guest signs in.

Calendar ingest API (Google Calendar and others)

For other calendars, your own script posts meetings to POST /api/v1/calendar/events as JSON, authenticated with a BeckonDesk API key. Google Apps Script and Power Automate both work. This is the route for Google Workspace calendars: BeckonDesk has no native Google Calendar sync.

See visitor pre-registration for what happens once a visit is expected.

Microsoft Teams

BeckonDesk posts to one Teams channel per workspace through a Teams Workflows webhook ("Post to a channel when a webhook request is received"), as an Adaptive Card. Older Office 365 connector URLs still receive the older message card.

Slack

BeckonDesk posts to one Slack channel per workspace through a Slack incoming webhook, using Block Kit with the same buttons as Teams.

Outbound webhooks

Add an endpoint URL and choose its events. BeckonDesk sends two events: visitor.checked_in and visitor.re_entered, plus a ping when you press test. Each delivery is a JSON body with the event name, the data (visit ID, name, company, site ID and time), your workspace ID and a timestamp. When you set a secret, the body is signed with HMAC-SHA256 and the signature sent in the X-BeckonDesk-Signature header as sha256=<hex>.

Failed deliveries are counted on the webhook but not retried. A Slack webhook URL added here receives a plain text message instead of the signed JSON.

Door controller and access control

A vendor-neutral, signed webhook to your access-control middleware or a relay you run. BeckonDesk does not talk to door hardware; your controller or middleware decides what each event means for your doors.

With "Grant on check-in" on, a visitor or contractor signing in sends a grant, and signing out, auto sign-out or a revoked visit sends the matching revoke. Each event carries the person, their company, the visit ID, the badge number for visitors, the site, your access point ID, and a valid-from and valid-until time. Valid-until is your auto sign-out time (or a contractor's access end date, if sooner), so the controller can expire a grant if no revoke arrives. Engaging a site lockdown sends lockdown; releasing it sends unlock. Events are signed the same way as outbound webhooks. The address must be a public HTTPS URL, so a controller on your own network needs a relay or tunnel in front of it. Each event is sent once, with a 15-second timeout and no retry.

If your controller refuses an event, a warning appears on the Security page and sign-ins carry on as normal.

API keys

Create keys in the admin app and send them in the X-API-Key header. Each key can have an expiry date and an IP allow-list. Keys have no scopes: a key can read and write the general API (visitors, the calendar ingest endpoint, evacuation zone updates), but cannot reach admin-only endpoints or the contractor and permit endpoints.

Evacuation zone updates

The one inbound feed. Your own system can post a person's last-known zone to POST /api/v1/evacuation/zone with a visit ID, and the roll call shows it. Without it, the zone is the site the person signed in at. See evacuation roll call.

Email from your own Microsoft 365 mailbox

By default BeckonDesk sends email from its own Microsoft 365 mailbox. To send invites, arrival notices and other emails from your address instead, create an Entra app registration with Mail.Send (scoped to one mailbox with an Application Access Policy), paste its details under Settings, Email sender, and send a test. The client secret is stored encrypted. If sending through your mailbox fails, BeckonDesk sends that email from its own mailbox instead.

Stripe billing

The plan is billed monthly through Stripe at $79 per location. Change the number of locations in Billing; you see the prorated price before you confirm. Invoices are listed in Billing with links to the Stripe invoice and PDF.