Microsoft Entra ID Configuration Guide — Calendar Synchronization

This document guides the Microsoft Entra ID administrator through creating, configuring, and maintaining the application required to synchronize Office 365 calendars with the Agendize platform.

1. Registering the application

1. Sign in to the Microsoft Entra ID portal.
2. Go to Identity > Applications > App registrations.
3. Click New registration.
4. Enter the application name (e.g. « Agendize Appointment Booking Sync »).
5. Leave the account type on Accounts in this organizational directory only.
6. Under Redirect URI : Platform = Web ; URI = the URI provided beforehand by our team.
7. Click Register.

2. Configuring API permissions (Microsoft Graph)

1. In the application menu, go to API permissions.
2. Click Add a permission > Microsoft Graph > Delegated permissions.
3. Search for and select the following permissions :
   • Calendars.ReadWrite : read and write access to calendars.
   • User.Read : read access to the user's profile.
   • offline_access : maintains access to authorized data in the background.
4. Click Add permissions.
5. You must click Grant admin consent for [Tenant Name], then confirm.

3. Generating the client secret

1. In the left menu, select Certificates & secrets.
2. On the Client secrets tab, click New client secret.
3. Enter a description and set the validity period.
4. Click Add and immediately copy the secret Value. It will no longer be displayed afterwards.

4. Information to send us

Send us the following three identifiers through a secure communication channel :

• Directory (tenant) ID : available on the Overview page.
• Application (client) ID : available on the Overview page.
• Client secret : the Value from step 3.

Important — Secret management : the tenant administrator is responsible for managing and renewing the client secret. A new secret must be sent to us before the previous one expires. Otherwise, synchronization with Office 365 will be interrupted.

5. Main causes of synchronization loss

Several events related to account management or tenant policies can invalidate access tokens and break synchronization :

• User password change or reset : changing a user's password immediately invalidates all of their active refresh tokens, which interrupts synchronization until their next sign-in.
• Expiration due to inactivity (Refresh Token Lifetime) : a delegated refresh token has a sliding lifetime of up to 90 days without use. If synchronization is interrupted or an account is not synchronized for more than 90 consecutive days, the token becomes permanently invalid.
• Conditional Access policies — Sign-in frequency : if a conditional access rule requires periodic mandatory re-authentication on Microsoft Graph or on all applications, the token expires prematurely and requires an interactive re-sign-in by the user.

Note : Agendize may send a notification to the staff member if synchronization fails, inviting them to restore their connection.

Deliberate action by an Entra ID administrator :

• Explicit session revocation : when an administrator clicks « Revoke sessions » from a user's page (or via PowerShell / Graph API), all of that user's delegated tokens are invalidated.
• Account deactivation or UPN change : deactivating the account or changing the primary identifier suspends access to the Graph APIs.
• Tenant-level actions : if an administrator disables the application or removes the consent granted to the delegated permissions (Calendars.ReadWrite, User.Read), API calls fail instantly and existing synchronizations are broken.

Frequently asked questions (FAQ)

Must the users to be synchronized belong to the tenant ?

Yes, all users whose calendar is to be synchronized must be associated with the configured Entra ID tenant.

Is creating the app registration enough ?

Yes. Creating the app registration automatically instantiates an enterprise application (Enterprise Application / Service Principal) in your tenant. This is Microsoft's standard deployment mechanism.

Why is the offline_access scope essential ?

Synchronization relies on delegated permissions (Calendars.ReadWrite). The offline_access scope allows our system to obtain a refresh token to run calendar synchronization in the background, without requiring a permanent active session from the user.

Can the configured tenant be used to sign in to the platform via Microsoft SSO ?

Yes, this is entirely possible. Signing in via Microsoft SSO has the advantage of automatically establishing the user's calendar synchronization as soon as they sign in to the Agendize platform, or restoring it if it had been interrupted.

Its use is not mandatory for synchronization to work, however : users can still authenticate with their username and password. Multi-factor authentication (MFA) via a temporary code sent by email is also supported.