Configuring Office 365 for scheduling using app permissions

The equipment resource is added as a resource attendee to all VMR Scheduling for Exchange meetings. Users will see replies from this resource when it accepts or rejects a meeting request.

Each equipment resource can be used by only one VMR Scheduling for Exchange Integration. If you have separate test and development environments, you must use a different equipment resource for each.

Previously we recommended using a room resource, but this may cause issues when using the Room Finder tool. Thus, we now recommend using an equipment resource.

You can create an equipment resource using either the Office 365 admin portal or PowerShell, as follows:

New-Mailbox -Equipment -Name "<Equipment Name>" -Alias "<Equipment Alias>" -DisplayName "<Equipment Name>"

New-Mailbox -Equipment -Name "Pexip Scheduling Service" -Alias pexip.scheduling -DisplayName "Pexip Scheduling Service"

Calendar processing

This configuration is done using the following PowerShell command:

Set-CalendarProcessing -Identity "<email_of_equipment_resource>" -AutomateProcessing None -AllowConflicts $true -BookingWindowInDays 1080 -MaximumDurationInMinutes 0 -AllowRecurringMeetings $true -EnforceSchedulingHorizon $false -ScheduleOnlyDuringWorkHours $false -ConflictPercentageAllowed 100 -MaximumConflictInstances 2147483647

To verify that the above command has configured everything correctly, use the PowerShell command:

Get-CalendarProcessing -Identity "<email_of_equipment_resource>" | Format-List

The output should look something like this:

Hiding resource availability in scheduling assistant

When viewing meetings in Outlook's Scheduling Assistant, the equipment resource and its availability will appear in the list of attendees. Because the same equipment resource is used for all scheduled meetings, it may show as unavailable if there are other meetings scheduled at the same time, which may be confusing to users.

To avoid this, you can hide the availability of the equipment resource's mailbox, so that it is always shown as "unknown". This is done using the PowerShell command:

Set-MailboxFolderPermission -Identity "<email_of_equipment_resource>:\Calendar" -User Default -AccessRights None

More information

For more information on these commands, see Microsoft help:

• Set-CalendarProcessing command: https://learn.microsoft.com/en-us/powershell/module/exchange/set-calendarprocessing
• Get-CalendarProcessing command: https://learn.microsoft.com/en-us/powershell/module/exchange/get-calendarprocessing

• Set-MailboxFolderPermission command: https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxfolderpermission

You must use the settings from this app registration when configuring the integration with the Exchange server OAuth options.

Creating a new app registration

1. Log in to either:

   • the Azure portal at https://portal.azure.com, and under Azure services select Microsoft Entra ID. From the side panel select App registrations.
   • the Microsoft Entra admin centre at https://entra.microsoft.com/, and from the side panel select Applications > App registrations.
2. Select New registration.

3. In the Register an application panel, enter the following options:

   1. Name: this can be anything you wish. In our example we have used Pexip Scheduling app permissions.
   2. Supported account types: for most customers, Accounts in this organizational directory only (... only - Single tenant) will be appropriate.
   3. Redirect URI: leave blank.

   

4. Select Register.

   A new panel opens where you can configure your application.

5. From the Overview page, note the following:

   • Display name. You will need this later to search for the app.
   • Application (client) ID: used when configuring the management scope and when configuring Pexip Infinity.

   

6. Select the Endpoints tab and copy the OAuth 2.0 token endpoint (v2) value. You will need to enter this as the OAuth token endpoint when configuring Pexip Infinity:

   

   Ensure that you use the URL for ... endpoint (v2), not ... endpoint (v1).

7. From the panel on the left, select API permissions.

8. Select Add a permission:

   

9. From the Request API permissions panel, select APIs my organization uses, search for Office 365 Exchange Online and select it:

   

10. Select Application permissions, and from the Select permissions list, expand Other permissions and select full_access_as_app:

    

11. Select Add permissions.

The full_access_as_app permission now shows in the list of API permissions. Admin consent required is Yes, and Status is Not granted for <tenant name>:

We recommend that you do not grant admin consent. Doing so gives the app permission to access every mailbox in your organization. Instead, we recommend you create a Management Scope to restrict the app's access to the equipment resource and scheduling users' mailboxes only.

Creating a client secret

1. From the side panel, select Certificates & secrets and select the Client secrets tab. Select New client secret:

   

2. Enter a Description and select an Expires option, and select Add.

   The maximum duration before expiry is 24 months. When this secret expires you will need to add a new one, and update the Pexip Infinity config accordingly.

3. The new client secret appears in the list. Copy and save the Value. You will need to enter this as the OAuth client secret when configuring Pexip Infinity:

   

These steps are required if you have not granted admin consent when adding permissions for the app. If you have granted admin consent, which we do not recommend, the app will already have access to every mailbox in your organization.

As a minimum, the app requires permission to access the equipment resource mailbox. We also recommend that the app is given permission to access all users who will be using VMR Scheduling for Exchange as this will allow meeting instructions to be added to meetings which were created while the Management Node was offline. For more information about how VMR Scheduling for Exchange uses EWS Impersonation, see Using application impersonation.

Copy the app's Enterprise Object ID

First you must obtain the Enterprise Object ID of your app. To do this:

1. Log in to either:

   • the Azure portal at https://portal.azure.com, and under Azure services select Microsoft Entra ID. From the side panel select Enterprise applications.
   • the Microsoft Entra admin centre at https://entra.microsoft.com/, and from the side panel select Identity > Applications > Enterprise applications.
2. Search for and select the app.

3. Copy and save the Object ID. When creating the management scope, use this as the app's Enterprise Object ID:

   

Creating a distribution list

The easiest way to apply the management scope to all VMR Scheduling for Exchange users is to use a group in the form of a distribution list. This group should include the equipment resource mailbox as well as all users whose mailboxes should be accessed by the scheduling app.

To create a distribution list:

1. Log in to the Microsoft 365 admin center at https://admin.microsoft.com/.
2. From the side panel, select Teams & Groups > Active teams & groups and select the Distribution list tab.

3. Select Add a distribution list:

   

4. Follow the steps to give the list a name and assign owners and members. Ensure that you add all users, as well as the equipment resource mailbox, to the list.

5. Assign an email address to the new group. You'll use this in the next step, creating a management scope.

   We recommend that you do not allow people outside your organization to send email to the Distribution group:

   

Creating and applying the management scope

We recommend that you use combined PowerShell commands to create and configure the management scope. This allows you to use variables, thus reducing possible copy and paste errors.

For information on connecting to Exchange Online using PowerShell, see https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell.

For the following PowerShell command, you must assign values specific to your deployment to the following variables:

• $app_id: the app's Application (client) ID noted down when creating the app registration.
• $enterprise_object_id: the app's Enterprise Object ID.
• $scheduling_dist_list_email: the email of the distribution list created earlier, whose members you want the scheduling service to be able to impersonate.

You also assign names for the following:

• $service_principal_to_create
• $management_scope_to_create
• $management_role_assignment_to_create

Run the following PowerShell, replacing our examples with your own:

$app_id = "<Application (client) ID>"
$enterprise_object_id = "<Enterprise Object ID>"
$scheduling_dist_list_email = "<distribution list email address>"

$service_principal_to_create = "Pexip VMR Scheduling SP"
$management_scope_to_create = "Pexip VMR Scheduling MS"
$management_role_assignment_to_create = "Pexip VMR Scheduling MRA"

New-ServicePrincipal -AppId $app_id -ObjectId $enterprise_object_id -DisplayName $service_principal_to_create

$pexip_scheduling_group = Get-DistributionGroup -Identity $scheduling_dist_list_email
$pexip_scheduling_group_dn = $pexip_scheduling_group.DistinguishedName
$restriction_filter = "MemberOfGroup -eq ""$pexip_scheduling_group_dn"""

New-ManagementScope -Name $management_scope_to_create -RecipientRestrictionFilter $restriction_filter

New-ManagementRoleAssignment -Name $management_role_assignment_to_create -App $service_principal_to_create -Role "Application EWS.AccessAsApp" -CustomResourceScope $management_scope_to_create

When you configure the associated VMR Scheduling for Exchange Integration, you'll need to provide the following information from Azure:

• Application (client) ID: this was generated for you by Azure when you created the app registration:

  

  You can find this again by going to Applications > App registrations and selecting the app registration. It is shown on the overview page under Application (client) ID.

  You must enter this as the OAuth client ID when configuring the integration.

• OAuth client secret: this was generated for you by Azure when you created the app registration.

  You can only view the value immediately after creation.

  You must enter this value as the OAuth client secret when configuring the integration.

• OAuth 2.0 token endpoint (v2): this was generated for you by Azure when you created the app registration:

  

  You can find this again by going to to Applications > App registrations and selecting the app registration. Select the Endpoints tab and copy the value under OAuth 2.0 token endpoint (v2).

  You must enter this value as the OAuth token endpoint when configuring the integration.