Restricting which mailboxes Cronofy can see

Read as Markdown

When you connect your organization using Free/Busy Calendar Access Mode, you connect via a service account. This service account behaves as a proxy for Cronofy, we can see the Free/Busy availability of all the calendars the service account can see.

You may want to exclude certain people from this — an executive team, a legal department, or staff in a region with stricter data handling requirements. This is done in Exchange Online, you can deny the service account access to certain calendars, and thus deny Cronofy access to certain calendars.

Excluding someone this way affects only Cronofy. It does not change what colleagues can see when they schedule internally, and it does not require any change on the Cronofy side.

What this does not do #

It does not apply to new mailboxes. This is a per-mailbox setting, and Microsoft provides no tenant-wide equivalent. People who join your organization later will be visible to Cronofy unless you run the command for them, or include it in your joiner process.
It does not revoke Cronofy’s access to your tenant. This restricts individual calendars only. To remove Cronofy’s access entirely, revoke the application’s consent in the Microsoft Entra admin center or use your Enterprise Connect Dashboard.
It may behave differently in a hybrid deployment. Where mailboxes are split between Exchange on-premises and Exchange Online, the Availability service uses your organization relationship rather than individual account permissions, so Free/Busy information can still be shared. Please contact us if this applies to your environment.

Before you begin #

You will need:

The email address of the service account used for your Free/Busy connection.
Permission to run Exchange Online PowerShell against your tenant, which requires an Exchange administrator role such as Recipient Management.

Connect to Exchange Online before running any of the commands below:

Connect-ExchangeOnline

For help with this step, see Microsoft’s guide to connecting to Exchange Online PowerShell.

Excluding a mailbox #

Deny the service account access to the calendar of the person you want to exclude:

Add-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com -AccessRights None

Use Add-MailboxFolderPermission the first time. Your service account will not usually have a permission entry of its own on the calendar, because it reads through the calendar’s Default entry instead.

If an entry does already exist the command fails, and you should use Set-MailboxFolderPermission to change it instead:

Set-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com -AccessRights None

Confirm the result:

Get-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com

Excluding several mailboxes #

$excluded = @("first.user@yourdomain.com", "second.user@yourdomain.com")

foreach ($mbx in $excluded) {
  $folder = Get-MailboxFolderStatistics -Identity $mbx -FolderScope Calendar |
    Where-Object { $_.FolderType -eq "Calendar" }
  Add-MailboxFolderPermission -Identity "$($mbx):\$($folder.Name)" `
    -User serviceaccount@yourdomain.com -AccessRights None
}

The Get-MailboxFolderStatistics lookup is included because the Calendar folder name is localized. A literal :\Calendar will fail against a mailbox whose language is set to German (Kalender), French (Calendrier), and so on.

Restoring access #

To let Cronofy see a calendar again, remove the permission entry you added:

Remove-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com

Remove-MailboxFolderPermission is not how you restrict access. Removing the entry deletes the restriction and the calendar falls back to its Default permission, which in most tenants restores the service account’s access.

Use -AccessRights None to exclude a mailbox, and Remove-MailboxFolderPermission only when you want to undo it.

Why this works #

Free/Busy connections use delegated permissions. Cronofy reads availability by calling Microsoft’s getSchedule API as your service account, rather than as an application holding tenant-wide rights.

This means each of your users’ calendars decides what Cronofy receives. Microsoft’s documentation for getSchedule is explicit on this point:

While the consented permission lets an app use getSchedule on the requested users’ calendars, through Outlook, the requested user controls which event data, if any, that getSchedule returns.

Exchange resolves calendar permissions from most specific to least specific. Every calendar has a Default entry that applies to anyone without an entry of their own, and an entry naming a specific account always takes precedence over it.

Granting your service account an explicit None therefore overrides the Default entry for that one account on that one calendar. Microsoft defines None as “The user has no access to view or interact with the folder or its contents”, leaving nothing for Cronofy to read.

Why not change the calendar’s Default permission #

Setting a calendar’s Default entry to None also blocks the service account, but it blocks everyone else at the same time. That person disappears from Scheduling Assistant across your whole organization, and colleagues can no longer see when they are free. Microsoft confirms this behaviour: with Default set to None, no Free/Busy information is displayed at all.

Denying your service account specifically achieves the same exclusion for Cronofy without affecting internal scheduling.

If you have any questions about restricting access to your organization’s calendars, please contact us at support@cronofy.com.