Connecting Outlook calendar: guide for IT teams

What the Outlook calendar connection does, the permissions it asks for, and how an IT administrator can approve it in Microsoft Entra ID.

Recruit connects to Outlook so interviews can be scheduled around real availability. This article is written for the IT or security team at an organisation using Recruit. It explains what the connection can and cannot access, and the simplest way to approve it. Recruiters who just want to connect their own calendar should read Connecting your calendar instead.

What the connection does

• Each Recruit user connects their own Outlook calendar from Settings, then My Profile, then Calendar Integrations, by choosing Connect with Microsoft. There is no shared mailbox, service account or organisation-wide access.
• Recruit reads when the user is busy, so candidates are only offered times when the interviewers are free.
• When an interview is booked, Recruit creates the event in the organiser's own calendar with a Microsoft Teams meeting link. If the booking is cancelled, Recruit removes the event.
• Sign-in uses the standard Microsoft identity platform (OAuth 2.0 authorization code flow). Nothing is installed, and Recruit never sees a Microsoft password.

Permissions requested

Recruit asks for three Microsoft Graph delegated permissions.

• Calendars.ReadWrite: read the signed-in user's own calendar availability, and create and cancel interview events in that same calendar.
• User.Read: read the user's name and email address, so Recruit can show which account is connected.
• offline_access: keep the connection working between sessions with a refresh token, so users do not have to approve it again each time.

All three are delegated permissions. Recruit can only act as the individual who signed in, and only on their own calendar. No application permissions are requested, so Recruit has no unattended or tenant-wide access to any calendar or mailbox.

Approving the connection

How much IT involvement is needed depends on your Entra ID user consent settings.

1. Ask a pilot user, such as someone on the recruitment team, to open Settings, then My Profile, and choose Connect with Microsoft under Calendar Integrations. This brings up the Microsoft consent screen for the Recruit application.
2. If your tenant lets users consent to these permissions, the pilot user can approve it themselves and no further IT action is needed. Each user then approves it individually when they connect.
3. If your tenant restricts user consent, the user sees a Need admin approval message. You can approve the request through your admin consent workflow, or continue to the next step.
4. Recommended: grant admin consent once for the whole tenant. In the Microsoft Entra admin centre, open Enterprise applications and select the Recruit application, which appears after the first connection attempt. Open Permissions and choose Grant admin consent. Recruiters can then connect without any approval prompts.
5. Optional: to limit who can connect, turn on Assignment required on the enterprise application and assign it to a group of recruitment users.

Granting admin consent means your team reviews the permissions once, keeps the application visible under Enterprise applications, and avoids approval requests arriving one user at a time.

How the security questions are answered

• Least privilege: only the permissions above are requested. The connection cannot read or send email, open another user's calendar, or see anything at tenant level.
• No mailbox access: Recruit sends candidate emails through its own email service. It does not read from or send through your users' mailboxes, and no mail permissions are requested.
• Calendar privacy: colleagues in Recruit see only the times a person is busy when they build an event. Meeting titles, attendees and locations are never retrieved or shown.
• Credentials: sign-in happens on login.microsoftonline.com. Access tokens are short-lived and refreshed automatically, and the stored tokens are encrypted at rest with AES-256-GCM.
• Limited writes: Recruit only creates interview events with Teams links in the connecting user's own calendar, and deletes them when a booking is cancelled.
• Revocation: a user can disconnect in Recruit at any time, which deletes the stored tokens straight away and is recorded in the audit log. Your IT team can also remove access centrally from the enterprise application in Entra ID.

Where to get help

If your security team needs more detail, or you would like someone from the Hireroad support team on a call while you grant consent, email support@hireroadai.com.