The MyTimetable calendar push integration is able to connect to a user's calendar using service accounts. This page describes how to create a service account and how to grant calendar permissions to this service account. MyTimetable will then be able to access calendars without explicit consent of a user.
...
- Visit the Microsoft Azure Management Portal at https://portal.azure.com, using the credential of your Microsoft tenant that has the subscription to Office 365 you wish to use.
- Click "Browse all" to browse all resources.
- Click "Activity Directory". You will now be redirected to the classic Azure Management Portal.
- Click the Active Directory you would like to manage.
- Click "Add user" in the bottom bar.
- Select "New user in your organisation" as type of user, and enter a username (e.g. sa-mytt-exch-1).
- Enter a first name, last name and display name (e.g. "MyTimetable"). Select "User" as role. Do not select "Enable Multi-Factor Authentication".
- Click "Create" to assign a temporary password. Write down the password.
- Logout from the Azure Management Portal.
- Go to https://login.microsoftonline.com/
- Login in using the account you have just created, and set a password for the service account.
...
| Code Block | ||
|---|---|---|
| ||
PS C:\> $O365Licences = New-MsolLicenseOptions -AccountSkuId Eveoh:ENTERPRISEPACK -DisabledPlans INTUNE_O365, YAMMER_ENTERPRISE, RMS_S_ENTERPRISE, OFFICESUBSCRIPTION, MCOSTANDARD, SHAREPOINTWAC, SHAREPOINTENTERPRISE PS C:\> Set-MsolUserLicense -UserPrincipalName "sa-mytt-exch-1@eveoh.onmicrosoft.com" -AddLicenses "Eveoh:ENTERPRISEPACK" -LicenseOptions $O365Licences |
Creating a mail-enabled universal security group
It is recommended to create a mail-enabled universal security group containing the previously created service account. Microsoft throttles the number of requests allowed to Exchange Web Services on a per account basis. By using multiple service accounts, we are able to increase the number of requests to EWS. In the next step, we will delegate calendar permissions to the security group, instead of delegating permissions to the separate service accounts.
...
- Open the Exchange Management Shell.
- Create a new mail-enabled universal security group using the New-DistributionGroup cmdlet. Replace the parameters to match your situation and preferences:
...
- Optionally, open the newly created security group properties and check "Hide this group from address lists".
Using Powershell
- Connect Powershell to Office 365.
- Create a new mail-enabled universal security group using the New-DistributionGroup cmdlet. Replace the parameters to match your situation and preferences:
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
PS C:\> $secgroup = "sa-mytt-exch-secgroup@dev.eveoh.local"
foreach ($m in $mailboxes)
{
$path = ($m | Select-Object -ExpandProperty PrimarySmtpAddress).ToString() + ":\" + (Get-MailboxFolderStatistics $m.UserPrincipalName | Where-Object { $_.Foldertype -eq "Calendar" } | Select-Object -First 1).Name
$permissions = @(Get-MailboxFolderPermission -Identity $path -User $secgroup -ErrorAction SilentlyContinue).count
if ($permissions -eq 0) {
# not in ACL, add permission
Add-MailboxFolderPermission -Identity $path -User $secgroup -AccessRights Author
}
else {
# user is already in ACL, change permission
Set-MailboxFolderPermission -Identity $path -User $secgroup -AccessRights Author
}
} |
Office 365
- Connect Powershell to Office 365.
- Select all accounts to set the delegation permissions on. We assume that these accounts are grouped in a security group. In the following example, all users are in the security group "Staff".
...