TABLE OF CONTENT

• 1. General
  • 1.1 Microsoft Entra ID
    • 1.1.1 Register App
    • 1.1.2 Create a client secret
    • 1.1.3 Note the enterprise app properties
    • 1.1.4 Add API permissions
    • 1.1.5 Configure access permissions for room mailboxes – Part 1/2
      • Option A (simple method, recommended for most customers – security group)
      • Option B (advanced method, for specialized requirements – management scope)
  • 1.2 Exchange Online (PowerShell)
    • 1.2.1 Connect to Exchange Online
    • 1.2.2 Create a room list 
    • 1.2.3 Create a service principal for your app
    • 1.2.4 Configure access permissions for room mailboxes – Part 2/2
      • Continuation of Option A (simple method, recommended for most customers – security group)
      • Continuation of Option B (advanced method, for specialized requirements – management scope)
    • 1.2.5 Test access permissions
  • 1.3 sklera CMS
    • 1.3.1 Sign in to the sklera CMS
    • 1.3.2 Connect Microsoft Graph calendar
    • 1.3.3 Add or edit calendars
• 2. General notes
  • 2.1 Resource mailboxes with AutoAccept enabled
• 3. Further external links

1. General

Exchange Online is integrated through the Microsoft Graph API with role-based access control (RBAC). 

Setup requires configuration in Microsoft Entra ID, Exchange Online (PowerShell), and the sklera CMS. 

1.1 Microsoft Entra ID

1.1.1 Register App

• To set up the integration, you must register an application in Microsoft Entra ID.
  Go to the Microsoft Entra admin center: https://entra.microsoft.com.
  
  In the portal, navigate to "Entra ID > App registrations" and select "New registration".
  
  
  
• Enter a name for your app and specify the appropriate redirect URI. Then click "Register".
  
  

  Note: The redirect URI depends on your sklera Cloud variant.

  
  

  sklera Cloud variant	Redirect URI
  sklera Public Cloud	https://my.sklera.tv/oauth/microsoft/callback
  sklera Private Cloud	https://<YOUR_CMS_URL>/oauth/microsoft/callback

  
  
  
  
• Make a note of the Application (client) ID and the Directory (tenant) ID.
  You'll need these later in the sklera Room Manager to link the calendars. 

1.1.2 Create a client secret

• In "Certificates & secrets", create a new client secret. Click "New client secret".
  
  

• Optionally enter a description and set the expiration period.
  Then click "Add".

  
  
  

• Copy the Value of the client secret. You'll need it later in the sklera Room Manager to establish the connection.

  

  
  
  

1.1.3 Note the enterprise app properties

• Select "Enterprise apps" and locate your app (for example, sklera Exchange Connector).
  Copy the Application ID and Object ID. You'll need these later in Exchange Online to create a service principal.

1.1.4 Add API permissions

To add rooms graphically in Room Manager, the app requires access to your room lists.

If the required API permission (Place.Read.All) is not granted, new rooms can only be added by entering the SMTP address (Input Room Address). Graphical selection is not available in this case.

Example of graphical room selection:

If you don't use room lists or don't want to grant the API permission, you can skip the following steps and continue with section 1.1.5.

• Go to "API permissions".
  
  
• Click "Add a permission".
  
  
• Select "Microsoft Graph".
  
  
• Select "Application Permissions".
  
  
• Search for "Place" and select "Place.Read.All".
  
  
• Grant admin consent by clicking "Grant admin consent for ....".
  
  
• Click "Yes".

1.1.5 Configure access permissions for room mailboxes – Part 1/2

The sklera Room Manager can access only mailboxes that are members of a specified security group or that are included in a defined management scope. Access to other mailboxes is not possible.

To configure this, a security group or a management scope must be created, and the required role (permission) must be assigned by using a management role assignment.

Important: Changes to permissions in Microsoft Entra ID may take some time to take effect due to replication and caching.

Option A (simple method, recommended for most customers – security group)

With this option, access permissions are controlled through the room mailboxes' membership in a security group.

• Create a new security group by going to the "Groups" menu and clicking "New group".
  
  
• Enter a name for the security group, and then click "Create".
  
  
• Go to "All groups" and select the security group you just created.
  
  
• Note the Object ID. You'll need it later in the Exchange Online (PowerShell) section to create a management role assignment.
  
  
• Go to "Members" and click "Add members".
  
  
• Search for the rooms you want to add, and then click "Select" to add them to the group.

Option B (advanced method, for specialized requirements – management scope)

With this option, access permissions are controlled through the room mailboxes' membership in a management scope.
The management scope can be defined based on any attribute (for example, mailbox type, alias, or location).

Setup is done exclusively through PowerShell and is described below.

1.2 Exchange Online (PowerShell)

1.2.1 Connect to Exchange Online

• Open PowerShell and connect to Exchange Online.

Connect-ExchangeOnline

New-DistributionGroup Vienna -Type distribution -RoomList

Add-DistributionGroupMember -Identity Vienna -Member galileo

New-ServicePrincipal -AppId aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa -ObjectId oooooooo-oooo-oooo-oooo-oooooooooooo -DisplayName "skleraExchangeConnector"

New-ManagementRoleAssignment -App oooooooo-oooo-oooo-oooo-oooooooooooo -Role "Application Calendars.ReadWrite" -RecipientGroupScope ssssssss-ssss-ssss-ssss-ssssssssssss -Name SKLERA_GRAPH_CALENDARS_READWRITE

New-ManagementScope -Name "sklera_allowedRooms_scope" -RecipientRestrictionFilter "RecipientTypeDetails -eq 'RoomMailbox' -and Alias -like 'room-at-*'"

Note: You can customize the command with your own filters as needed.

See also:
https://learn.microsoft.com/en-us/powershell/module/exchange/new-managementscope?WT.mc_id=M365-MVP-- 6771&view=exchange-ps


https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-managementscope?WT.mc_id=M365-MVP-6771&view=exchange-ps#-recipientrestrictionfilter


https://learn.microsoft.com/en-us/powershell/exchange/recipientfilter-properties?WT.mc_id=M365-MVP-6771&view=exchange-ps

New-ManagementRoleAssignment -App oooooooo-oooo-oooo-oooo-oooooooooooo -Role "Application Calendars.ReadWrite" -CustomResourceScope "sklera_allowedRooms_scope" -Name SKLERA_GRAPH_CALENDARS_READWRITE

Test-ServicePrincipalAuthorization -Identity oooooooo-oooo-oooo-oooo-oooooooooooo -Resource galileo

Set-CalendarProcessing -Identity <RESOURCEMAILBOX> -DeleteSubject $False -AddOrganizerToSubject $False

Note: This setting applies only to new appointments, not to existing ones.