# Restricting which mailboxes Cronofy can see

When you connect your organization using [Free/Busy Calendar Access Mode](/calendar-admins/enterprise-connect-office365-graph/free-busy-access-mode/index.md), you connect via a service account. This service account behaves as a proxy for Cronofy, we can see the Free/Busy availability of all the calendars the service account can see.

You may want to exclude certain people from this — an executive team, a legal department, or staff in a region with stricter data handling requirements. This is done in Exchange Online, you can deny the service account access to certain calendars, and thus deny Cronofy access to certain calendars.

Excluding someone this way affects only Cronofy. It does not change what colleagues can see when they schedule internally, and it does not require any change on the Cronofy side.

## What this does not do
- **It does not apply to new mailboxes.** This is a per-mailbox setting, and Microsoft provides no tenant-wide equivalent. People who join your organization later will be visible to Cronofy unless you run the command for them, or include it in your joiner process.

- **It does not revoke Cronofy's access to your tenant.** This restricts individual calendars only. To remove Cronofy's access entirely, revoke the application's consent in the [Microsoft Entra admin center](https://entra.microsoft.com) or use your [Enterprise Connect Dashboard](https://app.cronofy.com/jump/enterprise_connect).

- **It may behave differently in a hybrid deployment.** Where mailboxes are split between Exchange on-premises and Exchange Online, the Availability service uses your organization relationship rather than individual account permissions, so Free/Busy information can still be shared. Please contact us if this applies to your environment.

## Before you begin
You will need:

- The email address of the service account used for your Free/Busy connection.

- Permission to run Exchange Online PowerShell against your tenant, which requires an Exchange administrator role such as Recipient Management.

Connect to Exchange Online before running any of the commands below:

```powershell
Connect-ExchangeOnline
```

For help with this step, see Microsoft's guide to [connecting to Exchange Online PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell).

## Excluding a mailbox
Deny the service account access to the calendar of the person you want to exclude:

```powershell
Add-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com -AccessRights None
```

Use `Add-MailboxFolderPermission` the first time. Your service account will not usually have a permission entry of its own on the calendar, because it reads through the calendar's `Default` entry instead.

If an entry does already exist the command fails, and you should use `Set-MailboxFolderPermission` to change it instead:

```powershell
Set-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com -AccessRights None
```

Confirm the result:

```powershell
Get-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com
```

### Excluding several mailboxes
```powershell
$excluded = @("first.user@yourdomain.com", "second.user@yourdomain.com")

foreach ($mbx in $excluded) {
  $folder = Get-MailboxFolderStatistics -Identity $mbx -FolderScope Calendar |
    Where-Object { $_.FolderType -eq "Calendar" }
  Add-MailboxFolderPermission -Identity "$($mbx):\$($folder.Name)" `
    -User serviceaccount@yourdomain.com -AccessRights None
}
```

The `Get-MailboxFolderStatistics` lookup is included because the Calendar folder name is localized. A literal `:\Calendar` will fail against a mailbox whose language is set to German (`Kalender`), French (`Calendrier`), and so on.

## Restoring access
To let Cronofy see a calendar again, remove the permission entry you added:

```powershell
Remove-MailboxFolderPermission -Identity excluded.user@yourdomain.com:\Calendar `
  -User serviceaccount@yourdomain.com
```

> **INFO:** `Remove-MailboxFolderPermission` is not how you restrict access. Removing the entry deletes the restriction and the calendar falls back to its `Default` permission, which in most tenants restores the service account's access.

Use `-AccessRights None` to exclude a mailbox, and `Remove-MailboxFolderPermission` only when you want to undo it.

## Why this works
Free/Busy connections use **delegated** permissions. Cronofy reads availability by calling Microsoft's [getSchedule](https://learn.microsoft.com/en-us/graph/api/calendar-getschedule) API as your service account, rather than as an application holding tenant-wide rights.

This means each of your users' calendars decides what Cronofy receives. Microsoft's [documentation for getSchedule](https://learn.microsoft.com/en-us/graph/outlook-get-free-busy-schedule) is explicit on this point:

> While the consented permission lets an app use **getSchedule** on the requested users' calendars, through Outlook, the requested user controls which event data, if any, that **getSchedule** returns.

Exchange resolves calendar permissions from most specific to least specific. Every calendar has a `Default` entry that applies to anyone without an entry of their own, and an entry naming a specific account always takes precedence over it.

Granting your service account an explicit `None` therefore overrides the `Default` entry for that one account on that one calendar. Microsoft defines `None` as "The user has no access to view or interact with the folder or its contents", leaving nothing for Cronofy to read.

### Why not change the calendar’s Default permission
Setting a calendar's `Default` entry to `None` also blocks the service account, but it blocks everyone else at the same time. That person disappears from Scheduling Assistant across your whole organization, and colleagues can no longer see when they are free. Microsoft [confirms this behaviour](https://learn.microsoft.com/en-us/exchange/troubleshoot/move-or-migrate-mailboxes/cannot-see-free-busy-information): with `Default` set to `None`, no Free/Busy information is displayed at all.

Denying your service account specifically achieves the same exclusion for Cronofy without affecting internal scheduling.

If you have any questions about restricting access to your organization's calendars, please contact us at [support@cronofy.com](mailto:support@cronofy.com).



---
[Read in HTML](/calendar-admins/enterprise-connect-office365-graph/free-busy-access-mode/restrict-service-account-access/)