Enterprise Beta Pilot Setup

Authorize the Global Meeting Scheduler multi-tenant service for your Microsoft Entra ID tenant to auto-enroll your organization into the Beta Pilot with up to 50 users and zero individual beta keys required.

Verified Publisher: Michael Joseph Francis (MPN: 7131198 • mjfnet.com)

1. Authorize & Auto-Enroll

2. Deploy to Pilot Users

Step 1

Authorize Application & Enroll Organization

Pending

Authorizes the Global Meeting Scheduler service principal and Microsoft Graph permissions in your tenant, and auto-registers your tenant ID for the 60-day Enterprise Beta Pilot.

Required Entra ID Role: Global Administrator or Privileged Role Administrator is required to grant tenant-wide consent for Microsoft Graph application permissions (MailboxSettings.Read) and delegated scopes (User.Read.All, GroupMember.Read.All, access_as_user).

Instantiates Application Service Principal (App ID: 08f23efc-e4a2-4f14-a2f8-0cd3f446ede3)
Grants directory and mailbox read access for participant working hours & group expansion (User.Read.All, MailboxSettings.Read, GroupMember.Read.All)
Grants tenant-wide Single Sign-On (SSO) so deployed pilot users never face individual login prompts
Auto-enrolls organization into Beta Pilot: Up to 50 users receive full access without entering individual beta keys

Ready

Pilot Enrolled & Ready for Deployment

All Steps Complete

📦 Deploy Add-in via Centralized Deployment (Sideloading)

To deploy the add-in to your pilot users or security group, use the Microsoft 365 Admin Center's Integrated Apps centralized deployment feature:

Navigate to the Microsoft 365 Admin Center → Integrated Apps.
Click Upload custom apps and choose Office Add-in.
Select Provide link to manifest file and enter:
https://tzplanner-outlookaddin.mjfnet.com/manifest.xml
Assign your pilot users or designated security group (up to 50 users) and click Deploy.

💡 Propagation Time: Deployed add-ins appear in target users' Outlook ribbons within 1–6 hours without requiring manual client configuration.

Open Microsoft 365 Admin Center Provide Pilot Feedback

Enterprise IT / CISO: Permission Scope Audit & Admin Roles

Global Meeting Scheduler adheres to the principle of least privilege, requesting only standard read scopes necessary to compute equitable meeting suggestions:

Permission	Type	Purpose
User.Read	Delegated	Reads signed-in user's profile to identify local time zone and working hours.
User.Read.All	Delegated	Reads meeting attendee display names and profiles to look up time zones.
MailboxSettings.Read	Application	Reads mailbox settings (working hours, working days, and time zones) for all meeting attendees across the tenant.
GroupMember.Read.All	Delegated	Expands Distribution Lists and Microsoft 365 Groups invited to the meeting.
access_as_user	Delegated (TzPlanner API)	Allows Outlook client to invoke TzPlanner API suggestion calculations on behalf of user.

Administrator Roles & Consent Authority Matrix

Entra ID Administrator Role	Consent Authority Level	Target Scope & Operations
Global Administrator	Full Tenant Authority (Application + Delegated)	Interactive 1-Click Consent, PowerShell automated provisioning, and centralized app deployment in M365 Admin Center.
Privileged Role Administrator	Privileged Permissions (Application + Delegated)	Interactive 1-Click Consent for Graph Application permissions (`MailboxSettings.Read`).
Cloud Application Administrator / Application Administrator	Enterprise App & Delegated Permission Management	Instantiating service principals and granting delegated permissions (`User.Read.All`, `GroupMember.Read.All`, `access_as_user`).
Exchange Administrator	Exchange & Add-in Deployment	Deploying the add-in centrally to users via Microsoft 365 Admin Center (Settings → Integrated apps).

Automated Deployment: PowerShell (Microsoft Graph SDK)

For automated tenant provisioning pipelines or MSP environments, you can execute this snippet via Microsoft Graph PowerShell SDK (Requires Global Administrator, Privileged Role Administrator, or Cloud Application Administrator):

# Connect to customer tenant
Connect-MgGraph -Scopes "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All"

# 1. Instantiate Global Meeting Scheduler Service Principal
$clientSp = Get-MgServicePrincipal -Filter "appId eq '08f23efc-e4a2-4f14-a2f8-0cd3f446ede3'"
if (-not $clientSp) {
    Write-Host "Creating Global Meeting Scheduler Service Principal..."
    $clientSp = New-MgServicePrincipal -AppId "08f23efc-e4a2-4f14-a2f8-0cd3f446ede3"
}

# 2. Grant tenant-wide SSO consent for access_as_user
$ssoGrant = Get-MgOauth2PermissionGrant -Filter "clientId eq '$($clientSp.Id)' and resourceId eq '$($clientSp.Id)'"
if (-not $ssoGrant) {
    New-MgOauth2PermissionGrant -ClientId $clientSp.Id -ResourceId $clientSp.Id -ConsentType "AllPrincipals" -Scope "access_as_user" | Out-Null
}

Write-Host "Global Meeting Scheduler tenant authorization completed successfully."