Global Meeting Scheduler Logo

Global Meeting Scheduler Enterprise Setup

Authorize the Global Meeting Scheduler multi-tenant service architecture for your Microsoft 365 tenant to enable seamless Single Sign-On and cross-time-zone meeting optimization.

Verified Publisher: Michael Joseph Francis (MPN: 7131198 • mjfnet.com)
1
1. Authorize Application
2
2. Deploy & Complete
Step 1

Authorize Global Meeting Scheduler

Pending

Authorizes the Global Meeting Scheduler service principal and Microsoft Graph permissions in your tenant. This allows our backend services to safely resolve participant working hours and mailbox timezones on behalf of signed-in attendees.

Required Entra ID Role: Global Administrator or Privileged Role Administrator is required to grant tenant-wide consent for Microsoft Graph application permissions (MailboxSettings.Read) and delegated scopes (User.Read.All, GroupMember.Read.All, access_as_user).
  • Instantiates Application Service Principal (App ID: 08f23efc-e4a2-4f14-a2f8-0cd3f446ede3)
  • Grants directory and mailbox read access for organization working hours & group expansion (User.Read.All, MailboxSettings.Read, GroupMember.Read.All)
  • Grants tenant-wide Single Sign-On authorization for Outlook add-in (access_as_user) to eliminate individual user login prompts
  • Requires Global Administrator or Privileged Role Administrator consent
Enterprise IT / CISO: Permission Scope Audit & Admin Roles

Global Meeting Scheduler adheres to the principle of least privilege, requesting only standard read scopes necessary to compute equitable meeting suggestions:

Permission Type Purpose
User.Read Delegated Reads signed-in user's profile to identify local time zone and working hours.
User.Read.All Delegated Reads meeting attendee display names and profiles to look up time zones.
MailboxSettings.Read Application Reads mailbox settings (working hours, working days, and time zones) for all meeting attendees across the tenant.
GroupMember.Read.All Delegated Expands Distribution Lists and Microsoft 365 Groups invited to the meeting.
access_as_user Delegated (TzPlanner API) Allows Outlook client to invoke TzPlanner API suggestion calculations on behalf of user.

Administrator Roles & Consent Authority Matrix

Entra ID Administrator Role Consent Authority Level Target Scope & Operations
Global Administrator Full Tenant Authority (Application + Delegated) Interactive 1-Click Consent, PowerShell automated provisioning, and centralized app deployment in M365 Admin Center.
Privileged Role Administrator Privileged Permissions (Application + Delegated) Interactive 1-Click Consent for Graph Application permissions (MailboxSettings.Read).
Cloud Application Administrator / Application Administrator Enterprise App & Delegated Permission Management Instantiating service principals and granting delegated permissions (User.Read.All, GroupMember.Read.All, access_as_user).
Exchange Administrator Exchange & Add-in Deployment Deploying the add-in centrally to users via Microsoft 365 Admin Center (Settings → Integrated apps).
Automated Deployment: PowerShell (Microsoft Graph SDK)

For automated tenant provisioning pipelines or MSP environments, you can execute this snippet via Microsoft Graph PowerShell SDK (Requires Global Administrator, Privileged Role Administrator, or Cloud Application Administrator):

# Connect to customer tenant
Connect-MgGraph -Scopes "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All", "AppRoleAssignment.ReadWrite.All"

# 1. Instantiate Global Meeting Scheduler Service Principal
$clientSp = Get-MgServicePrincipal -Filter "appId eq '08f23efc-e4a2-4f14-a2f8-0cd3f446ede3'"
if (-not $clientSp) {
    Write-Host "Creating Global Meeting Scheduler Service Principal..."
    $clientSp = New-MgServicePrincipal -AppId "08f23efc-e4a2-4f14-a2f8-0cd3f446ede3"
}

# 2. Grant tenant-wide SSO consent for access_as_user
$ssoGrant = Get-MgOauth2PermissionGrant -Filter "clientId eq '$($clientSp.Id)' and resourceId eq '$($clientSp.Id)'"
if (-not $ssoGrant) {
    New-MgOauth2PermissionGrant -ClientId $clientSp.Id -ResourceId $clientSp.Id -ConsentType "AllPrincipals" -Scope "access_as_user" | Out-Null
}

Write-Host "Global Meeting Scheduler tenant authorization completed successfully."