Setup Guide on TrueDEM Knowledge Base

Getting Started with TrueDEM

Mon, 01 Jan 0001 00:00:00 +0000

You are just a few clicks away from using TrueDEM. Please make sure to follow the instructions below.

Step 1: Microsoft Entra ID App Consents

Before using TrueDEM, you must add Microsoft Entra ID Enterprise applications and give admin consent.

App1: TrueDEM API

The first application is an App for API access between our Services. It contain only two default Delegated permissions.

To add it, please click the following Link and give admin consent:

TrueDEM Portal - Access

Mon, 01 Jan 0001 00:00:00 +0000

TrueDEM Portal - Dashboard Access

This EntraID Enterprise application is created in panagenda’s tenant and operates as a multi-tenant App Registration. The application requests only the permissions necessary to verify user identity to ensure that access to the panagenda TrueDEM Portal is limited to individuals from specific domains.

An administrator must first approve/accept the application in order to provide consent on behalf of the entire organization!

Once accepted by an administrator, the app is listed as Enterprise Application in your Microsoft EntraID Tenant.

Insider Channel Setup

Mon, 01 Jan 0001 00:00:00 +0000

On average, panagenda releases incremental updates to our agents 2-3 times per month. We understand that this is too frequent for the entire user population in most enterprises. As a result, we have implemented a branch concept in our auto-update model.

Each time a new install package is generated, this is added to our distribution points for the Preview Branch (Insider Channel). Any user that is set to preview will get this update installed within one day. Preview users can expect to silently receive 2-3 agent updates per month.

TrueDEM Manager

Mon, 01 Jan 0001 00:00:00 +0000

The TrueDEM Manager is a helper app created and signed by panagenda. The following content is an addition to the PDF Document “TrueDEM Manager Overview” which we share with customers.

TrueDEM Manager is installed as an Application and can be found on the Apps & Features Settings Page of your Operating System.

Note: The application itself can not be looked up via the Windows Icon (it is just hidden as a selectable application)

Endpoint Manager Deployment (Intune)

Mon, 01 Jan 0001 00:00:00 +0000

TrueDEM Manager deployment via Microsoft Endpoint Manager

Step 1: App Information

Sign in to the Microsoft Endpoint Manager admin center.
Select Apps> Windows > Add.
On the Select app type pane, select Windows app (Win32).
Click Select. The Add app steps appear.

On the Add app pane, click Select app package file.

On the App package file pane, select the browse button. Then, select the location where you have stored the panagenda-provided Intuneinstallation file with the extension .intunewin. The app details appear.
When you’re finished, select OK on the App package file

Customer location mapping via IP subnet (optional)

Mon, 01 Jan 0001 00:00:00 +0000

Improving Visibility and Network Context with Customer Subnet Data

In TrueDEM, without additional information, all networks will be identified by their Subnet information (IP address & range) for authenticated networks and by their ISP name for ‘home’ networks.

By uploading your organization’s subnet and building information to panagenda, you unlock significant enhancement in TrueDEM’s dashboards:

Accurately identify internal (managed) network connections by name: TrueDEM recognizes when endpoints are connected within your corporate infrastructure.
Provide valuable location context: The uploaded building and tenant subnet information allows you to more easily identify the physical network location of users during calls.
Enhance troubleshooting and analysis: Being able to easily identify differences between calls made on various identifiable networks allows for more effective issue and cause identifcation
Enrich dashboard insights: Dashboards like the “Teams Call List” and “Live Call Status” will display associated location/building and subnet details. This provides a richer and more actionable view, as illustrated in the example below (screenshot):

Customer location mapping via wireless access points (optional)

Mon, 01 Jan 0001 00:00:00 +0000

Modern network architectures make IP-based location identification unreliable. TrueDEM uniquely identifies Microsoft Teams call quality issues at the physical WiFi Access Point level , going beyond what Microsoft natively offers.

What TrueDEM basically needs this information:

….which gets extended by TrueDEM to

…so that the System knows in which range an certain WAP is operating.

What data does TrueDEM need ?

Column Name	Description	Example
WapDisplayName	Friendly display name for the WAP displayed in reporting.	3rd Floor, Executive Conference Room
LocationId	This should match as much of your Managed NetworkName as possible. For example, if the Teams Admin Portal and TrueDEM have the following networks: DE/Mannheim/MainCampus/10.10.10.0DE/Mannheim/MainCampus/10.10.20.0 DE/Mannheim/MainCampus would be the preferred LocationId	DE/Mannheim/MainCampus
WapMac	Management address for the WAP.	00:04:DD:11:22:40*****
WapMatchingBase	Often the management MAC address, but it is not required to be the same address. This the first in a pool of dynamic MACs to be used by the device	00:04:DD:11:22:40
WapMaxRangeSize	Number of MAC addresses that can be bound to different SSIDs. Legcacy enterprise devices supported 8 per radio channel, for a total of 16. Most currently supported enterprise class devices running only 2.4GHz and 5GHz radios support 16 per radio, for 32 total. Most enterprise WAP with 3 radios - 2.4 GHz, 5 GHz and 6GHz radios can use up to 64 virtual Mac Addresses. There is still a limit of 16 SSIDs/Mac per radio on most equipment. However, Cisco for example allows their 8x8 5Ghz radio to be split into (2) 4x4 Radios. Please provide the maximum number, even if you are currently not running a particular radio.	32
Wap Note	Optional. Available to provide additional detail on brand and model if you are uncertain how many virtualized SSIDs / Mac Addresses exist.	Optional

***** NOTE on MAC Address Formatting:

AppLocker - Allow Rule

Mon, 01 Jan 0001 00:00:00 +0000

If you use AppLocker, ensure your environment trusts TrueDEM.

If a rule exists where a PublisherCondition is set and configured for the end user allowing all signed applications, no further action is needed (see box).

<FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">

If you have individual policies in place, ensure that one is created for TrueDEM based on description below.

Configuration

As an AppLocker Administrator, make sure you have the TrueDEM Agent installed on the Device in which you configure the AppLocker Rule.

TrueDEM App Roles

Mon, 01 Jan 0001 00:00:00 +0000

The TrueDEM API EntraID Enterprise app provides several roles, which require TrueDEM Manager version 6.1 or later.

The available roles are listed below.

Role Name	Category	Description
Enterprise Channel	Channel	[default] Agent: Main Release Channel
Insider Channel	Channel	Agent: Preview Release Channel
Advanced License	Licensing	[default] User is enabled for M365 and Teams Call Monitoring
Core License	Licensing	User is enabled for M365 Apps Monitoring only
Standard User	UserType	[default] General users
Important User	UserType	Use this role to tag users requiring closer attention.
Robot User	User Type	Use this role to tag accounts where TrueDEM Agent operates on a standalone (non-user) device in different locations.

Remove TrueDEM components in an Organization

Mon, 01 Jan 0001 00:00:00 +0000

To discontinue our SaaS offering, please remove the following TrueDEM components from your environment:

TrueDEM Manager App
EntraID Enterprise Applications

TrueDEM Manager App

To remove TrueDEM from a Client PC, just uninstall the TrueDEM Manager. This will automatically remove the TrueDEM Agent from the System. Use the following msiexec command below and run it as an Administrator:

msiexec /x {1365178D-2BDC-4044-95D2-B96E5B9E95A7} /qn

The TrueDEM Manager and the TrueDEM Agent are gone immediately.

macOS Privacy Preference Policy

Mon, 01 Jan 0001 00:00:00 +0000

On macOS, TrueDEM (>= v1.3.*) collects Microsoft Teams call-quality telemetry through a small extension.

Because macOS treats another application’s data folder as private, the operating system asks the user for permission the first time TrueDEM accesses the Microsoft Teams folder. The enduser will see the following dialog:

Known limitation
When the permission is granted (by the enduser) from the dialog, macOS 15 and later store it for the current session only. As a result, the prompt can reappear (typically after a restart of the machine/after logging out and back in/if the TrueDEM background service is restarted). This is macOS behaviour and is not specific to TrueDEM.

On some macOS versions there is no dialog at all. Access is refused straight away and macOS instead shows a notification saying that TrueDEM tried to access data from another app. Clicking that notification opens System Settings → Privacy & Security → Files and Folders.