Automize Calendar: for IT administrators

Puts appointments booked in Automize straight into your sales staff's Outlook calendars, so nobody has to connect their own account.

1. Check it is really us

Before you approve, check that Microsoft's approval screen shows this application ID. An email can be faked; this page is on our own site.

2. What it asks for

This is an application permission: it works without anybody signed in. Until you limit it, it covers every mailbox in your organisation. Automize therefore asks you to limit it to one mail-enabled security group, and does not switch it on until a check has shown Microsoft refusing a mailbox outside that group.

3. Who can approve, and how

1. Somebody at your company sends you an approval link from Automize. It must be approved by a Global Administrator or Privileged Role Administrator: Microsoft lets no other role grant an application permission on Microsoft Graph. If your role is only eligible (Privileged Identity Management), activate it first.
2. After you approve, Microsoft asks you to sign in once more. That tells Automize which organisation approved, and that you hold one of those roles. It asks for nothing else.
3. Create a mail-enabled security group holding the mailboxes of the staff who take bookings, and limit the app to it in Exchange Online PowerShell. Microsoft can take up to an hour to apply it:

   Connect-ExchangeOnline
   New-ApplicationAccessPolicy -AppId ce768615-4436-4fcf-912a-f4c5f8f3c441 -PolicyScopeGroupId <group email address> -AccessRight RestrictAccess -Description "Automize: appointment calendars only"
   Test-ApplicationAccessPolicy -Identity <a mailbox outside the group> -AppId ce768615-4436-4fcf-912a-f4c5f8f3c441

   Copy commands
4. Your colleague enters the group's address and one mailbox that is NOT in it, such as a director's. Automize checks that Microsoft refuses that mailbox. The calendar cannot be switched on until it does.

4. What Automize keeps

• Your Microsoft 365 organisation (tenant) ID, once an administrator has approved.
• The group address you limited the app to, and the result of the last check.
• The Outlook ID of each appointment it creates, so it can move or cancel that appointment later.
• Meeting subjects and times shown on the calendar are read live each time and not stored. Meetings marked Private show as "Private".
• Microsoft's access tokens last about an hour and are kept only in server memory, encrypted.

Stored in Amazon Web Services, Ireland (eu-west-1). See our Privacy Policy and Trust Center for sub-processors and retention, or request our Security & Compliance Pack for the data processing agreement.

5. Switching it off or removing it

• In Automize: Settings › Connectors › Microsoft 365 › Calendars for the whole company › Switch off.
• In Exchange Online PowerShell: Remove-ApplicationAccessPolicy for the policy you created.
• In the Microsoft Entra admin center: Enterprise applications › search for the application ID › Properties › Delete. This withdraws the approval for the whole organisation at once.

Questions, or a request you think is not genuine

Write to security@automize.co.za. To report a vulnerability, see Security Disclosure.