Documentation
User & admin guide
Back to Calendar
Admin guide

Azure AD and Microsoft 365

Connect Azure AD for Outlook calendar sync, user listing, and outbound magic-link email.

The Azure AD connection serves three purposes: it reads Outlook/Exchange calendars for all tenant users, lists users for the person selector, and sends magic-link login emails via Microsoft Graph. One Azure AD app registration covers all three.

Configure at Admin → Config → Azure AD.

What you need from Azure

FieldWhere to find it
Tenant IDAzure Portal → Azure Active Directory → Overview → Tenant ID
Client IDAzure Portal → App registrations → your app → Application (client) ID
Client SecretAzure Portal → App registrations → your app → Certificates & secrets → a secret's Value
Sender emailA mailbox in your tenant that herbe.calendar will send from — must have a licensed Exchange mailbox

Enter these in Admin → Config → Azure AD, click Save, then Test connection. A passing test reports how many users and calendars were found.

Azure App registration

  1. Azure Portal → Azure Active Directory → App registrations → New registration.
  2. Name: "herbe.calendar" (or any name).
  3. Supported account types: Accounts in this organizational directory only.
  4. No redirect URI needed.
  5. After creation, note the Application (client) ID and Directory (tenant) ID.
  6. Go to Certificates & secrets → New client secret. Copy the Value (not the Secret ID). It's only shown once.
  7. Go to API permissions → Add a permission → Microsoft Graph → Application permissions. Add:
    • Calendars.Read
    • Calendars.ReadWrite
    • Mail.Send
    • User.Read.All
  8. Click Grant admin consent for your organization. All four permissions must show a green tick before proceeding.

Calendar sync scope

The Azure connection syncs Outlook/Exchange calendars for every enabled user in the tenant. Calendars appear in the calendar under the Outlook source color. The incremental sync runs every 15 minutes; a full reconciliation runs nightly.

If a user has multiple Outlook calendars, all of them sync. Users can hide individual calendars under Settings → Integrations → Outlook.

Outbound email

The Mail.Send permission allows herbe.calendar to send on behalf of the sender email address. This account must have an active Exchange mailbox — shared mailboxes and distribution lists don't work. A standard licensed user mailbox works fine.

If you'd rather send via SMTP instead of Graph, see SMTP. You can run SMTP alongside Azure AD — SMTP handles email while Azure handles calendars.