Automate Viva Connections, Topics, Learning, and News

Viva on Autopilot: Ship Topics, Learning, and Connections News with Real API Automation

Episode Overview

Most Viva deployments stall at “turn it on and hope.” We go beyond the UI and into the APIs: how to authenticate reliably, publish Viva Topics programmatically, bulk-ingest learning content from any LMS, and schedule targeted Viva Connections announcements. Expect practical payload tips, permission checklists, and battle-tested throttling patterns.

Who This Is For

• M365 admins and platform owners automating Viva at scale

• Knowledge & Comms teams tired of manual entry and stale portals

• L&D leaders consolidating multiple LMS catalogs into Viva Learning

• Devs building secure, unattended jobs (Azure Functions, PowerShell, Logic Apps)

Big Wins You’ll Get

• Auth that sticks: App-only auth with least privilege + predictable tokens

• Topics at scale: Create/publish topics that actually surface (not “draft limbo”)

• Learning in one place: Bulk push third-party courses into Viva Learning

• News that lands: Programmatic Connections posts with targeting & retries

• Zero drama operations: Logging, backoff, and idempotency to keep jobs green

---

Segment 1 — Breaking the Authentication Barrier

Problem: “Unauthorized/Forbidden” despite “following the docs.”
Reality: Viva spans Graph + product-specific endpoints; scopes differ.

Minimal, Secure Setup (app-only):

• Register an Entra ID app (service principal).

• Prefer certificate creds (Key Vault) over client secrets.

• Grant only required Application permissions (examples):

  • Viva Topics: Topics.ReadWrite.All (name may appear as Viva/Knowledge-specific)

  • Viva Learning: LearningContent.ReadWrite.All / LearningProvider.ReadWrite.All

  • Connections/SharePoint News: Sites.ReadWrite.All (and target site permissions)

• Admin consent the scopes.

• Conditional Access: exclude the service principal or create a policy allowing non-interactive service principals from trusted networks.

• Token tip: request scope/.default for the resource you call; don’t reuse a Graph token against a product-native resource.

Auth Checklist (quick triage):

• Right resource in aud (Graph vs product endpoint)?

• App perms (not delegated) for unattended jobs?

• Consent actually granted (not just “requested”)?

• Cert valid, in KV, with rotation alert?

• CA policy exemptions for the app?

• Logging token claims (issuer, aud, scopes/roles) for each job?

---

Segment 2 — Custom Knowledge: Automating Viva Topics

Common Failure: 201 Created but no Topic visible.
Root Causes: Missing required fields, wrong publishing state, or too-sparse metadata.

Payload Must-Haves (conceptual):

• title, summary/description

• alternateNames (acronyms/aliases)

• references (files/pages/people)

• state: "published" (don’t leave as draft)

• Owners/experts for credibility

Scale Strategy:

• Source of truth: SharePoint, wiki, or project registry → transform to JSON

• Batch with throttle: small parallelism; honor 429 Retry-After

• Idempotency: upsert by external key (avoid dupes)

• Post-verify: query back by title/id; flag missing items for requeue

Ops Tips:

• Log request + response (correlation IDs).

• Treat 4xx as data/permission issue; 5xx/429 → backoff & retry.

---

Segment 3 — From LMS Silos to Viva Learning

Goal: Bulk-publish external courses so users search once—in Viva.

Data you must provide for learningContent:

• externalId (stable), title, description, webUrl

• thumbnailUrl, duration (ISO 8601), skills/tags, locale

• Completion criteria (view %, quiz, etc.)

• Map LMS CSV → strict JSON (validate types!)

Batching Playbook (PowerShell/Azure Functions):

1. Import CSV → validate required columns.

2. Build JSON per row; guardrails for null/empty fields.

3. POST with token; Start-Sleep / exponential backoff every N items.

4. Capture non-2xx with line number + reason; write retry list.

5. Reconcile: query catalog, compare counts/IDs, requeue failures.

Data Hygiene = Discoverability:

• Rich descriptions, consistent tags/skills, working URLs, unique IDs.

• Duplicate externalId or bad URLs = invisible content.

---

Segment 4 — Automating Viva Connections News

Pain: Manual posts miss timing/audience and silently fail on bad JSON.
Fix: Programmatic cards with strict payload + targeting + retries.

Reliable Post Anatomy:

• title, summary (length-bound), author

• Audience as array (AAD group IDs)

• Valid imageUrl (supported size/type)

• Deep links (Teams/open in app), priority, expiryDate

• CamelCase property names, validated before send

Delivery at Scale:

• Schedule per region (8:00 local), batch by audience.

• Parse error bodies on 400s: fix & resubmit.

• Telemetry: post ID, audience size, delivery status; optionally track reads.

• Security: least-privilege app; approval workflow for high-impact posts.

---

Production-Grade Patterns (applies to all three)

• Pipelines: Build/Test/Deploy via GitHub Actions or Azure DevOps

• Secrets: Azure Key Vault references; no inline secrets

• Observability: App Insights or Log Analytics (success/latency/429s)

• Backoff: Exponential with jitter; respect Retry-After

• Idempotency keys: Upserts prevent dupes on retries

• Runbooks: Deploy, rollback, throttle limits, contacts, SLIs/SLOs

---

Pitfalls & Fast Fixes

• 401/403 with “perfect” code: wrong resource aud — request token for the exact API.

• Topic exists but not shown: state not published or metadata too sparse.

• Learning content “uploads” but vanishes: type mismatch or missing required fields.

• Connections news never appears: audience not an array; invalid image or summary too long.

• Random failures at scale: you’re tripping rate limits—batch smaller + backoff.

---

KPIs to Prove It Worked

• Time-to-publish (CSV → live)

• Success rate per 100 API calls (by feature)

• 429/5xx rates (pre/post backoff)

• Topic coverage: % projects/acronyms with live Topics

• Learning catalog completeness vs LMS master

• Connections delivery: on-time % + audience reach

---

Quick Start (This Week)

1. Create a service principal + cert; grant minimal app perms; admin consent.

2. Stand up a small Azure Function or PowerShell script with Key Vault secrets.

3. Automate one flow end-to-end (e.g., 25 Topics publish with retries + verification).

4. Add logging + dashboard (App Insights).

5. Document the runbook; schedule it.