We support an alternative authentication flow that allows us to read and write resources on behalf of a user. The technical details are explained in this document.


Authentication as a service allows Envoy to access all rooms’ calendar automatically. For customers who want to grant Envoy Rooms access to selected rooms’ calendar, we recommend you choose authentication as a user as described in this document.

Please make the changes in Microsoft 365 admin center before setting up Envoy Rooms on Envoy Dashboard.

Setting up O365 service account and permissions

Service account

We recommend you create a dedicated account for Envoy Rooms. This service account will not have access to any room calendars by default. The Global admin within O365 will need to grant access on a per-calendar basis.

While logged in as an O365 Global Admin, please create the service account and grant the following scopes to that service account:

  • Offline_access

  • Calendars.ReadWrite.Shared

  • Place.Read.All

Note: Place.Read.All requires a Global Administrator to grant permissions.

More information about permissions


Grant access to a room’s calendar

  1. Navigate to Exchange in the admin center


2. Find the room to be managed by Envoy Rooms and Click the pen icon to edit the resource

3. Add the service account to Full Access by clicking the + button

4. Click Save. It will look like this:

Setting up Envoy Rooms on the Dashboard

Note: In our testing, the Delegate Access took 2 days to propagate on Microsoft Exchange.

  1. Connect the service account to Envoy Rooms

Here are the permissions we ask for when using this method:

Please make sure you log in as the service account before clicking this link on the Dashboard.

Note: Rooms can take 24-48 hours to populate with this method of connection.

Did this answer your question?