Configure Microsoft Exchange and Azure (customer IT)

Audience: Customer IT, Exchange administrator, Azure / Entra ID administrator, information security officer

Reservation Sync needs a room mailbox for every room you want to synchronize, a room list, and permission to access those room mailboxes through the Microsoft Graph API. This guide walks you through the set-up in Exchange Online and in the Azure portal (Microsoft Entra ID).

• 1. Connect to Exchange
  • 1.1. Exchange admin center
  • 1.2. Exchange Online PowerShell
• 2. Create room mailboxes
  • 2.1. Align room reservation settings with Workplace
• 3. Create a room list
  • List the rooms in a room list
• 4. Register Reservation Sync in Azure
  • 4.1 Register the app
  • 4.2 Generate a Client Secret
  • 4.3 Grant API permissions
  • 4.4. Restrict access to room mailboxes only
  • 4.4 Grant Admin Consent
• 5. Share the credentials with Spacewell
• Useful links

1. Connect to Exchange

The following steps implement and/or validate settings in Microsoft Exchange Online that are required by the Reservation Sync Interface to establish connectivity with Spacewell Workplace.

1.1. Exchange admin center

The Exchange admin center (EAC) is the web console for Exchange Online: https://admin.exchange.microsoft.com/

More information about EAC can be found here: https://learn.microsoft.com/en-us/exchange/exchange-admin-center.

1.2. Exchange Online PowerShell

You need PowerShell and internet access. Start Windows PowerShell as administrator and run:

powershellwide760

Confirm with [Y] Yes.

Then install the Exchange Online PowerShell module and confirm with [Y] Yes:

powershellwide760

This command will download and install the Exchange Online PowerShell module. Confirm with [Y] Yes and then Enter.

Connect with your own administrator account, sign in (and approve in Microsoft Authenticator if 2FA is on):

powershellwide760

The Microsoft “Sign in to your account” popup appears:

Enter the administrators password and confirm with Enter.

In Powershell the following screen is visible and the user is logged in to Exchange Online PowerShell:

Check the domain:

wide760

To disconnect when you are done:

powershellwide760

More information about connecting to Exchange Online PowerShell can be found here: https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps&preserve-view=true

2. Create room mailboxes

Every reservable room in Workplace needs a matching room mailbox in Exchange. Room mailboxes are resource mailboxes: they need no Microsoft 365 licence, cost nothing, and you can create as many as you need.

Room mailboxes can be created manually through the Exchange Admin Center or using PowerShell. Both options are described below. Please select the method that most adheres to your current workflow.

Option A: Create a Room Mailbox via Exchange Admin Center

Login to Exchange Admin Center, and go to Recipients > Resources and click Add a room resource.

This opens a dialog for new Room Mailbox parameters. nter a name and e-mail address and click Next.

Optional: fill in extra properties (capacity, location, etc.). Reservation Sync does not need them, but they help users find the right room in Outlook Room Finder (see Room Finder Add-in for Outlook).

Booking Options: leave the default values or match the room configuration in Asset. See section 2.1 below.

Review the configured properties for the room mailbox and click Create. The room appears in the list of resources.

Once the room mailbox is created, you can see the room mailbox in the list of Resources:

Option B: Create a Room Mailbox via Exchange Admin Shell (PowerShell)

Connect to Exchange Admin Shell and issue the below command to create a new Room Mailbox with the below command:

powershellwide760

• The parameter -Name is used to set the display name of the Room in Outlook and Teams
• The parameter -alias is used to generate the email address, e.g. in the above case it will be conf_room@yourdomain.com
• The parameter -Room is most important, which identifies it as a Room resource mailbox and not a User account.

Check the result:

powershellwide760

The -Identity parameter value is the same as the -alias used in the create command above.

2.1. Align room reservation settings with Workplace

Room mailboxes automatically accept or decline meeting requests based on their calendar-processing settings. These settings directly affect Reservation Sync and must match the room settings in Asset.

The -Identity parameter is the alias of the room mailbox, you can also use email address here (conf_room or conf_room@yourdomain.com).

The format-list option ensures that PowerShell displays the extensive list of properties for the room mailbox:

While some of these properties are controllable from the Exchange Admin Center, more advanced configuration can be achieved from Exchange Admin Shell using the CalendarProcessing command.

View the current settings of a room (alias or e-mail address):

powershellwide760false

Setting	What it does	Recommendation
AutomateProcessing	Whether requests are accepted automatically or passed to a room delegate	AutoAccept, unless booking delegates are configured
BookingWindowInDays	How far ahead the room can be booked (default 180)	Same as in Workplace
ConflictPercentageAllowed	Whether a recurring series is accepted when some occurrences conflict. At 0%, the series is declined if one occurrence conflicts	Set deliberately to prevent out-of-sync situations
AllowConflicts	Whether the room accepts a request that overlaps another reservation	False. If True, the room accepts every request and double reservations occur; reconciliation does not fix these, it only reports them
DeleteSubject, AddOrganizerToSubject	By default the room removes the subject; Workplace then shows the organizer’s name instead	Set both to False if subjects must show in Workplace
RemovePrivateProperty	By default (True) the "Private" flag is removed from incoming meetings	Set to False so private meetings created in Workplace stay private in Outlook

Show subjects in Workplace:

powershellwide760

Verify the change by running the Get-CalendarProcessing command of the particular meeting room again.

Keep private meetings private:

wide760

Run Get-CalendarProcessing again to verify. All properties are described in https://learn.microsoft.com/en-us/powershell/module/exchange/set-calendarprocessing?view=exchange-ps

3. Create a room list

Room lists group room mailboxes. They are not distribution lists, shared mailboxes or security groups. Reservation Sync uses them to link room mailboxes to reservable rooms in Asset, and Outlook Room Finder uses them to group rooms.

Create a room list

powershellwide760

• The -Name parameter is used to specify the display name of the Room List in Outlook Room Finder
• The -Alias parameter is used to generate the email address that is used by Reservation Sync
• The -RoomList parameter is used to identify this group as a Room List

More informatioin about Room Lists can be found here: https://learn.microsoft.com/en-us/powershell/module/exchange/new-distributiongroup?view=exchange-ps

Add a room to the list

powershellwide760

• The -Identity parameter is the alias or email address of the room list
• The -Member parameter is the alias or email address of the room mailbox. This can also be another room list

To verify the addition of the member, run below command

wide760

Remove a room from the list

powershellwide760

List all room lists

wide760

• The -ResultSize Unlimited parameter ensures that all the room lists are returned
• The Where clause filters the list to only Room lists and not other types of groups
• The Format-Table formats the output to a table structure with 3 columns: DisplayName, Identity and Email address
  The -AutoSize parameter resizes column widths in the output to match the data

List the rooms in a room list

To view all the member rooms and room lists for a given room list, use the below command

wide760

The -Identity parameter is the alias of the room list whose members are to be fetched

4. Register Reservation Sync in Azure

Reservation Sync connects to Exchange Online through Microsoft Graph, Microsoft’s standard API that replaces Exchange Web Services (EWS). It uses OData REST APIs and OAuth 2.0 client credentials. It uses OData REST APIs and OAuth 2.0 with Client Credentials. You need administrator rights in Azure AD / Entra ID.

4.1 Register the app

Sign in to the Azure portal and open Microsoft Entra ID > App registrations

On the App registrations page, select New registration:

Enter a name. Keep Accounts in this organizational directory only. Leave Redirect URI empty. Click Register.

On the overview page, copy the Application (client) ID and Directory (tenant) ID and keep them safe.

4.2 Generate a Client Secret

The next step is to generate a client secret for API access.

In the app, open Certificates & secrets > New client secret.

Enter a description and an expiry period in line with your organization’s policy. Click Add.

Copy the Value and the Expires date and keep them safe. This information is needed for a future configuration step.

4.3 Grant API permissions

Open API permissions > Add a permission > Microsoft Graph > Application permissions.

Add these permissions, then click Add permissions:

• Calendars.Read
• Calendars.ReadBasic.All
• Calendars.ReadWrite
• MailboxSettings.Read
• Place.Read.All

You can now see the added permissions in the list of Configured permissions for the App in the center panel:

More information about App permissions can be found here: https://learn.microsoft.com/en-us/graph/auth-v2-service

Time zones (only for Outlook 2013 or older). Reservation Sync creates and updates meetings in UTC. Modern Outlook and Teams show times in each user’s own time zone; Outlook 2013 and older show UTC. MailboxSettings.Read lets Reservation Sync read the organizer’s preferred time zone.

4.4. Restrict access to room mailboxes only

Create a mail-enabled security group for the rooms:

powershellwide760

• The -Type parameter security defines this group as a mail enabled security group
• The -Alias parameter defines the email address of the group

Add every room in scope:

powershellwide760

• The -Identity parameter is the alias of the security group
• The -Member parameter is the alias of the room mailbox

Create the access policy. Use the Application (client) ID from 4.1 and the e-mail address of the security group:

powershellwide760

The -AccessRight parameter RestrictAccess ensures that the access is restrictive and limited to the policy scope.

More details about API access policy here

https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access

4.4 Grant Admin Consent

The calendar data processed through these permissions is personal data under EU GDPR, which normally requires user consent. Because Reservation Sync is a background app, an administrator consents once on behalf of all users. Microsoft Graph requires this before the API can be used.

In API permissions, the columns "Admin consent required" and "Status" show a warning.

Click Grant admin consent for <organization name> and confirm with Yes.

The status changes to granted for each permission.

5. Share the credentials with Spacewell

What	Where you found it
Application ID	Application (client) ID, step 4.1
Directory ID	Directory (tenant) ID, step 4.1
Client secret	Step 4.2
Client secret expiry date	Step 4.2
E-mail domains	Your e-mail domain(s), e.g. spacewell.com

Share the client secret securely, for example with a single-use, expiring link (e.g. Onetime Secret): enter the secret, a passphrase and a lifetime, create the link, and send the link, the passphrase and the other details to the Spacewell consultant, with your organization name and Application ID in the subject. If the link has already been used when Spacewell opens it, you will be asked to delete the secret and create a new one. You can use any other secure channel that fits your policy.

Useful links

• Microsoft supported scenarios in regards to Hybrid setups: https://techcommunity.microsoft.com/t5/exchange-team-blog/the-end-of-the-rest-api-for-on-premises-mailboxes-preview/ba-p/3221219
• Exchange Admin Shell cmdlet reference documentation https://learn.microsoft.com/en-us/powershell/module/exchange/?view=exchange-ps
• https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0
• https://learn.microsoft.com/en-us/graph/auth/?context=graph%2Fapi%2F1.0&view=graph-rest-1.0