Automatic office check-in

Who gets an email

Anyone whose whereabouts for today put them in an office you have set up for check-in, whether for the whole day, the morning or the afternoon. Floors and areas count as part of their office. It goes by whereabouts rather than desk bookings, so people do not need to have booked a desk. If they have, the email shows which one.

Each person gets at most one email a day, and only ever for that day. Emails go out on any day someone is down as in the office, weekends included.

When it arrives

The email goes out once a day at the time set for each office. Tell us the time you want for each office when we switch it on. The time is fixed in UTC, so in the UK an email set for 8am in winter arrives at 9am once the clocks go forward.

What people see

1. An email with the subject "Confirm office visit", showing the date and their office, floor and desk.
2. They tap "Check-in".
3. A page opens saying "Thanks" and "That's been confirmed." They do not need to log in.

Full-day emails also explain why you are asking: so the right health and safety provisions are in place for the number of people in the office, and so you have an accurate record for planning facilities.

If someone does not check in

No reminder is sent. If you have chosen to release desks, their desk becomes free for others to book and their whereabouts for that day changes to Unknown. Otherwise nothing changes, and their whereabouts and any desk booking stay as they are. A check-in link always counts for the day the email was sent, even if it is tapped later.

Seeing who checked in

1. Go to Settings > Reports, data and audit logs and choose Office check-in.
2. Pick a month and an office.
3. The Office usage vs. confirmation chart shows, for each day, how many people were down as in the office and how many of them confirmed.

Company Admins, Department Admins and Office Admins can see this report. Office Admins can only report on their own office.

What you need

• Automatic check-in switched on for your account. Email support@team-today.com and we will do this for you.
• A fixed public IPv4 address for each office your check-in requests will come from.
• A Wi-Fi controller, network access system or script that can send a web request when a device connects, such as our example script for Windows computers. Your IT team or network provider will know what yours can do.

Step 1: Add your office IP addresses

Team Today only accepts check-ins sent from IP addresses on your company's list, so there are no keys or passwords to store or share. Add the public IP address of each office. This is your office's internet address, which an on-site Wi-Fi controller or a script on people's computers will send requests from.

1. Go to Settings > Offices and meeting rooms and choose an office.
2. Choose Automatic Check-in from the menu on the left.
3. Under Office internet addresses, type the address, for example 203.0.113.10, and tap "Add".

Add one address at a time, as ranges are not accepted. A new address shows as Pending approval until Team Today approves it, and check-ins from it are ignored until then. Company Admins and Office Admins can add and remove addresses.

Before we approve an address, we check who it is registered to. We only approve addresses that belong to your company or your internet provider, because an address shared with other organisations would let them send check-ins for your people. That rules out:

• Cloud-managed Wi-Fi systems that send requests from the provider's servers. Those addresses are shared by all of the provider's customers, so send check-ins from something inside your office instead, such as an on-site controller or the check-in script.
• Cloud security services such as Zscaler or Netskope, if your office's internet traffic goes out through one. Their addresses are shared with their other customers and with your own staff working from home. Ask your IT team to let requests to scim.team-today.com go straight out through your office's own internet connection.

These need to be fixed IPv4 addresses. We cannot use IPv6 addresses yet, because check-ins reach us over IPv4. If your office's internet address changes from time to time, ask your internet provider for a static IP. When an address does change, add the new one and remove the old one, because check-ins sent from an address that is not on your list are ignored.

Step 2: Map your Wi-Fi networks to offices

1. Go to Settings > Offices and meeting rooms and choose an office.
2. Choose Automatic Check-in from the menu on the left.
3. Type the Wi-Fi network name exactly as your network system will send it, for example Office-WiFi, and tap "Add".
4. Repeat for each network in that office, then for your other offices.

Each network name can only be mapped to one office. Company Admins and Office Admins can manage these.

Once your company has mapped at least one network, check-ins that name a network not on your list are ignored. This stops people who are working from home on a VPN being checked in, so add every network people use in your offices, including any guest network. Check-ins that do not include a network name are recorded without an office.

Step 3: Link devices to people

If your network system sends MAC addresses, tell Team Today who each device belongs to. If it sends email addresses instead, you can skip this step.

1. Go to Settings > Manage current users and tap the pencil icon next to a person.
2. Under MAC Addresses, enter the device's address in the format AA:BB:CC:DD:EE:FF and tap "Add".

A person can have several devices, but each MAC address can only belong to one person.

Private Wi-Fi addresses: most phones and many laptops now use a different MAC address for each Wi-Fi network instead of their built-in one. Add the address the device uses on your office network, which is shown in the device's settings for that network, or switch off private addresses for your office network through your device management.

Step 4: Send check-ins

Set your network system to send this request when a device connects to the office Wi-Fi:

POST https://scim.team-today.com/ocip/v1
Content-Type: application/json

{
  "network": "Office-WiFi",
  "macAddress": "AA:BB:CC:DD:EE:FF",
  "dateTime": "2026-10-01T08:52:00",
  "timeZone": "Europe/London"
}

• dateTime (required): when the device connected, in the office's local time, with no time zone offset.
• timeZone: the time zone of dateTime, as a name such as Europe/London or an offset such as +01:00. The report shows it next to the time.
• network: the Wi-Fi network name, matched against the names you mapped in Step 2.
• macAddress: the device's MAC address, matched against the addresses you added in Step 3. Upper or lower case, separated by colons or dashes, for example AA:BB:CC:DD:EE:FF or aa-bb-cc-dd-ee-ff.
• email: the person's Team Today email address. Use this instead of macAddress if your system knows who is signed in to the device. If you send both, the MAC address is tried first.

Requests must come from an IP address on your list from Step 1. The endpoint always responds with 204 No Content, whether or not a check-in was recorded. A request is ignored, without an error, if it comes from an address that is not on your list, has no dateTime, names a network you have not mapped, or has a MAC address or email that does not match anyone in your company. Use the report in Step 5 to confirm check-ins are arriving.

Every request is recorded as a separate check-in, so send one when a device first joins the network rather than on a timer.

Example script for Windows computers

Unsupported example: these scripts are an example of an Intune script that uses the Team Today API to tell us when people are in an office. We manage the check-in API they connect to, but we do not support the scripts. Review them, change them to suit your computers and test them on a few computers before you roll them out.

If you manage Windows 10 and 11 computers with Microsoft Intune, the install script adds a scheduled task that sends the request from Step 4 a minute or two after someone signs in, unlocks their computer or it joins a network. It sends the signed-in person's email address, so you can skip Step 3. It sends at most one check-in per person, network and day, and nothing while the computer is locked.

• Install-TeamTodayOfficeCheckIn.ps1: installs or updates the check-in task. This is the only file you need for an Intune platform script.
• README.md: the full instructions, including every setting and how to troubleshoot.
• Uninstall-TeamTodayOfficeCheckIn.ps1: removes everything the install script added.
• Detect-TeamTodayOfficeCheckIn.ps1: an Intune detection rule, only needed if you deploy it as a Win32 app.

To roll it out as an Intune platform script:

1. Complete Step 1, and Step 2 if you have more than one office.
2. Open the install script in a text editor and change the settings at the top, for example your office network names.
3. In the Microsoft Intune admin center, go to Devices > Scripts and remediations > Platform scripts and add the install script for Windows 10 and later.
4. Set Run this script using the logged on credentials to No, Enforce script signature check to No unless you sign the script yourself, and Run script in 64 bit PowerShell Host to Yes.
5. Assign it to a small pilot group of computers at one office, then use Step 5 to check that check-ins arrive.

Step 5: Check it is working

1. Go to Settings > Reports, data and audit logs > Office usage.
2. Tap "Automatic office check-in". You need to be a Company Admin to see this button.
3. Pick a day to see each check-in received and the time it happened.

Below the check-ins, Ignored check-ins lists requests from your approved addresses that day that could not be recorded, with what to fix. For example, a MAC address that is not linked to anyone, an email address that does not match anyone in Team Today, or a network that is not mapped to an office.

If nothing shows up, check that your requests are reaching scim.team-today.com and getting a 204 response, that they come from an approved IP address from Step 1, and that the network names and MAC addresses match what you set up in Steps 2 and 3. A 204 only means the request arrived, not that a check-in was recorded. Contact support@team-today.com if you need a hand.