Skip to main content
The Microsoft 365 integration normally connects through the anny app: an administrator grants consent once for the organization. Some organizations must not approve third-party apps in their tenant, for example when a data center manages the tenant centrally. In that case, you create an app registration in your own tenant and enter its credentials in anny. The app, its permissions and its secret stay under your control. This article is for Microsoft Entra ID administrators.
Using your own app registration is part of the Enterprise plan. Without it, the integration only shows the Authorize button.

​
Requirements

  • An anny organization on the Enterprise plan and admin rights in your anny account
  • A Microsoft 365 organization with Exchange Online mailboxes (cloud, not on-premises)
  • An account in Microsoft Entra ID that can create app registrations and grant admin consent for application permissions, for example with the Global Administrator or Privileged Role Administrator role
  • The calendars you want to connect already exist (for example room mailboxes for your rooms)

​
Required permissions

The app registration needs these Microsoft Graph permissions, each as an application permission:
  • Calendars.ReadWrite: Read, create, change and delete events in the connected calendars, and get notified about changes
  • User.Read.All: Show accounts in the Microsoft calendar selection and verify the connection
  • MailboxSettings.Read: Detect with Diagnose rule whether a mailbox’s automatic replies interfere with events
MailboxSettings.Read is optional: sync runs without it, and the diagnosis just doesn’t check automatic replies.
Delegated permissions don’t work here. anny works without a signed-in person, which is also why no room mailbox needs an account with a password.

​
Set up the connection

The labels in the Microsoft Entra admin center can differ slightly by language and version.
1

Register the app

In the Microsoft Entra admin center, open App registrations and click New registration. Enter a name such as anny and choose Accounts in this organizational directory only. You don’t need a redirect URI.
2

Add the permissions

Open API permissions → Add a permission → Microsoft Graph → Application permissions and select the permissions from the list above. Then click Grant admin consent. Each permission then shows that consent was granted.
3

Create a client secret

Open Certificates & secrets → Client secrets → New client secret and choose a lifetime. Microsoft limits it to 24 months at most. Copy the Value right away, not the ID: Microsoft only shows it once.
4

Copy the IDs

From the app registration’s Overview, copy the Directory (tenant) ID and the Application (client) ID.
5

Open the integration in anny

In the sidebar, open Account › Apps & Integrations, select Microsoft 365 under All Apps and Integrations and click Set up.
6

Enter the credentials

In the Connection section, click Use your own app registration below the Authorize button. Enter the Directory (tenant) ID, Application (client) ID and Client secret, then click Verify connection. anny only stores the credentials once Microsoft accepts them and the permissions are sufficient.
7

Connect calendars and activate

From here it works like the regular connection: choose which calendars are linked to which resources and activate the integration. You’ll find the steps under Connect Microsoft 365 to anny.

​
Renew the client secret

When the secret expires, the integration deactivates itself and the affected admins get a notification. anny doesn’t warn you beforehand, so note the expiry date yourself and renew the secret in time.
1

Create a new secret

Create a new client secret in the Microsoft Entra admin center and copy the Value.
2

Deactivate the integration

Deactivate the integration with the toggle in the page header. Credentials can only be changed while it’s deactivated.
3

Enter the credentials again

In the Connection section, click Reconnect, enter all three values and click Verify connection.
4

Activate the integration

Activate the integration again. Then delete the old secret in the Microsoft Entra admin center.

​
Limit access to specific mailboxes

Application permissions initially apply to all mailboxes in your tenant. You limit access to selected room and resource mailboxes in Exchange Online: the guide Limit Microsoft 365 calendar access to specific mailboxes also applies to your own app. Keep in mind:
  • Use the IDs of the enterprise application that belongs to your app registration.
  • The role Application MailboxSettings.Read is enough instead of Application MailboxSettings.ReadWrite.
  • User.Read.All stays in Entra ID. Without it, anny rejects the connection.

​
Switch back to the anny app

Deactivate the integration and, on its detail page, choose the three dots → Remove authentication. The Connection section then shows the Authorize button again.

​
Limitations

  • Client secrets only: certificates aren’t supported as credentials.
  • No reminder before expiry: anny only notifies you once the secret has expired and the integration has deactivated itself.
  • Microsoft 365 only: the Microsoft Teams integration still connects through its own anny app.

​
FAQ

No. anny stores it encrypted and doesn’t show it again after you enter it. That’s why the fields are empty when you click Reconnect and you enter all three values again.
No. Application permissions access the mailboxes without signing in.

​
Troubleshooting

Check that you copied the client secret’s Value and not its ID, that the secret is still valid, and that the directory ID and application ID belong to the same app registration. A new secret can take a few minutes to work.
Microsoft accepted the credentials, but anny can’t read your tenant’s accounts. Check that User.Read.All is added as an application permission and that admin consent was granted. New permissions can take a while to apply.
The directory ID and application ID are IDs in the format 00000000-0000-0000-0000-000000000000. A domain such as company.onmicrosoft.com isn’t accepted.
Credentials can’t be changed while the integration is active. Deactivate it with the toggle in the page header and try again.
The client secret has usually expired or been deleted. Enter a new one as described under Renew the client secret. You’ll find other causes under Connect Microsoft 365 to anny.