# Microsoft Calendar

Connect Microsoft Calendar and use its tools through the Authlane control plane.

## Prerequisites

Use a Microsoft Entra tenant and an account allowed to create app registrations. Review the official
[Microsoft Graph calendar resource](https://learn.microsoft.com/graph/api/resources/calendar),
[app registration guide](https://learn.microsoft.com/entra/identity-platform/quickstart-register-app),
and [Entra app registrations](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade).
Use a multi-tenant account type for a SaaS serving multiple Microsoft organizations, or single
tenant for an internal deployment.

## Self-hosted setup

1. Create or open a Web app in **Microsoft Entra admin center → App registrations**.
2. Under **Authentication**, register the exact Web callback
   `https://<your-authlane-host>/api/v1/oauth/microsoft-calendar/callback`. Leave implicit grant off.
3. Add the delegated Microsoft Graph permissions below under **API permissions**.
4. Grant administrator consent if the target tenant requires it.
5. Create a client secret under **Certificates & secrets** and copy its **Value** immediately.

You may reuse the Microsoft app registered for Mail or SharePoint when you add this callback and
the Calendar permissions to that same registration.

## Configure authentication

Open **Dashboard → Services → Microsoft Calendar**. Enter the Entra **Application (client) ID** as
Client ID, enter the client secret **Value** as Client Secret, choose `read_only` or `full`, and
enable the service. Never expose the Client Secret in frontend code.

## Scopes

Full policy requests:

- `offline_access`
- `openid`
- `profile`
- `User.Read`
- `Calendars.ReadWrite`

Read-only policy requests `Calendars.Read` instead of `Calendars.ReadWrite`. The shared identity
scopes bind the connection and permit refresh. Check the current
[Microsoft Graph permissions reference](https://learn.microsoft.com/graph/permissions-reference)
when configuring tenant consent.

## Execution path

Microsoft lists a Calendar server in the
[Agent 365 MCP catalog](https://learn.microsoft.com/microsoft-agent-365/developer/tooling), but the
Frontier server is not credential-compatible with this standard delegated Graph connection. It
requires an Agent 365 blueprint, separate MCP token audience and per-server permission, and tenant
administration. Authlane therefore produces canonical tools whose SaaS-side adapter calls
`https://graph.microsoft.com/v1.0` using the connected user's Graph token. Authlane is not in the
normal calendar data path; the administrator Sandbox is the explicit testing exception.

## Available tools

- `microsoft_calendar_list_calendars`
- `microsoft_calendar_list_events`
- `microsoft_calendar_get_event`
- `microsoft_calendar_get_calendar_view`
- `microsoft_calendar_get_schedule`
- `microsoft_calendar_create_calendar`
- `microsoft_calendar_update_calendar`
- `microsoft_calendar_delete_calendar`
- `microsoft_calendar_create_event`
- `microsoft_calendar_update_event`
- `microsoft_calendar_respond_to_event`
- `microsoft_calendar_cancel_event`
- `microsoft_calendar_delete_event`

Read-only policy removes create, update, response, cancellation, and delete actions. The remaining
write and destructive tools expose MCP annotations for runtime approval controls.

## Connection lifecycle

Authlane stores credentials encrypted, refreshes access tokens, and computes connected, expired, or
error state. The Microsoft Graph upgrade intentionally expires the old Microsoft connection once;
reconnect it to grant the correct delegated scopes. A later policy change also requires reconnecting.

## Troubleshooting

- For `AADSTS50011`, compare the registered redirect URI character-for-character with the callback.
- Confirm the Client ID and the client secret **Value** came from the same app registration.
- Verify the user can open the target calendar and has consented to the selected delegated scope.
- Tenant consent policy may require an administrator to approve the Graph permissions.