Hybrid Calendar Service with Office 365 integration reference

Summary

The Hybrid Calendar provides a rich collaboration experience between Cisco Webex Meetings and Webex App with Office 365, for users and rooms.

Currently, the integration provides the following major features:

Provide end users the ability to schedule a collaboration meeting with any calendar client connected to Office 365 without having to install plug-ins or extensions. Just type a keyword into the Location field (for example, @webex or @meet) or put a SIP URI or meeting address into the meeting body.
Show a meetings list in users' Webex App applications—desktop, mobile, and hard endpoints.
Pop up a notification with a Join button, also known as One Button to Push (OBTP).
Update a user’s Webex App presence status when the user sets up automatic replies in Office 365 (sometimes referred to as out-of-office status).

This article gives an overview of how the cloud-based Hybrid Calendar Service integrates the Office 365 cloud with the Webex cloud to provide these features.

For similar overviews of the other Hybrid Calendar Service integrations, see the following articles:

Cisco Webex Hybrid Calendar Service with Microsoft Exchange integration reference (for Expressway-based Calendar Connector deployments)
Cisco Webex Hybrid Calendar Service with Google Calendar integration reference

For the latest feature and deployment information, see https://www.cisco.com/go/hybrid-services-calendar.

Data handling

The Hybrid Calendar receives meeting details from the calendar system and parses the meeting location and body for URIs and URLs that can be used to join the meetings. The service uses other information, such as start and end time and invitees, to populate the meetings list in the Webex App app and on certain devices, and to provide One Button to Push (OBTP). At no point does the service store or send unencrypted sensitive data such as meeting description, meeting body, or email addresses of invitees. That data is sent encrypted to the Webex cloud (and stored there in encrypted form) for the purposes of providing the meetings list and OBTP.

For data encryption, the Hybrid Calendar uses the same Webex cloud encryption service that the Webex App app uses. As such, key management is provided either by the cloud Key Management Server (KMS), or, if you choose to deploy Hybrid Data Security, by your own on-premises KMS. (For more details, see the Webex App Security Paper.)

Office 365 tenant support

Note the following considerations for your Office 365 tenant:

We support either a single Microsoft 365 tenant or a Webex organization with many tenants.
We only support the Worldwide instance of Microsoft 365. ( Other instances which we do not support include USGovDoD, USGovGCCHigh, China and Germany.)

We only support the Worldwide instances of Office 365. ( Other instances which we do not support include USGovDoD, USGovGCCHigh, Germany and China.)
Although your tenant(s) may use Multi-Geo Capabilities in Microsoft 365 to store data in a chosen geography, Webex stores data according to its own data residency specifications based on the country designated for the customer organization. For more information, see https://www.cisco.com/go/webex-teams-locality.

Authentication and authorization during deployment

The Hybrid Calendar uses Microsoft Graph Authorization to access users' calendars within an organization.

There are two options to providing authorization for Hybrid Calendar to access user's calendar. In Enterprise environments, the Global administrator of the Office 365 tenant grants the permissions to the Hybrid Calendar to provide access to all users in the organization. This method is exclusive to enterprise customers. The second option is to allow users to authorize Hybrid Calendar themselves using Connect your Microsoft 365 calendar. Connect your Calendar requires a periodic user reauthorization. This method is available to all types of users.

Enterprise application authentication process

Provisioning grants the Hybrid Calendar the following required permissions:

Permission	Usage
Read and write calendars in all mailboxes.	Update the meeting text with the join details.
Sign in and read user profile.	Required for the other permissions listed. Hybrid Calendar does not use it directly.
Read and write all user mailbox settings.	Determine the user's language for localization purposes. Read out-of-office status. Set out-of-office status (reserved for future use.)
Read domains.	Read domains

In Control Hub, only administrators with privileged access can set up the Hybrid Calendar for a customer's organization. The provisioning process requires authentication and consent by a Global administrator for the Office 365 tenant to which your users belong.

The flow includes the following high-level steps:

The administrator signs in to the Control Hub and starts the Hybrid Calendar with Office 365 setup.
The Hybrid Calendar redirects the browser to the Office 365 cloud for authentication and consent.
The Global administrator for the Office 365 tenant signs in.

Once signed in, the administrator sees the application permission details (vendor name, necessary permissions, and so on).
The administrator agrees to give access to the Hybrid Services application for user calendars.
The administrator can enter a test email address, then confirms the permissions.
Depending on the results of the test, the administrator gets an updated success or failure indication.

Enterprise provisioning process

User application authentication process

User provisioning grants the Hybrid Calendar the following required permissions:

Permission	Usage
Read and write calendars.	Update the meeting text with the join details.
Offline access.	Grants Webex a refresh token which limits end user reauthorization requests to every 30 days.
Read and write all user mailbox settings.	Determine the user's language for localization purposes. Read out-of-office status. Set out-of-office status (reserved for future use.)
Sign in and read user profile.	Required for the other permissions listed. The Hybrid Calendar does not use it directly.

Hybrid Calendar in the Microsoft Azure portal

Once you have authorized Hybrid Calendar to access your Office 365 tenant for the Enterprise, you can see it in the enterprise applications list in the Microsoft Azure Active Directory admin center.

Click the service name, Webex Calendar Service, to see the permissions that have been granted to the service.

Limit the application scope to specific mailboxes

When you set up the Hybrid Calendar for the enterprise, we request authorization for the entire organization. Microsoft Azure allows you to limit the scope to specific mailboxes either before or after provisioning.

Use the Microsoft documentation to limit the scope. For example, see https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access for steps to limit the scope before provisioning Hybrid Calendar.

Provisioning Hybrid Calendar with API operations

The Hybrid Calendar uses the Microsoft Graph API to access Office 365 calendar events. This API supports a broad range of operations with Office 365. However, the Hybrid Calendar only uses a subset of commands that are related to calendar use cases.

Table 1. Operations currently used by Hybrid Calendar
Graph operation	Usage
POST /users/{id \| userPrincipalName}/calendar/events	Add an event or meeting to a user's calendar.
GET /users/{id \| userPrincipalName}/events/{id}	Retrieve details about a single event in a user's calendar.
GET /users/{id \| userPrincipalName}/calendar/events/{id}/instances? startDateTime={start_datetime}&endDateTime={end_datetime}	Get the occurrences of a recurring meeting for a specified time range.
GET /users/{id \| userPrincipalName}/calendar/events	Retrieve details about events in a user's calendar folder.
POST /subscriptions	Subscribe for notifications on changes to a user's calendar.
GET /users/{id\|userPrincipalName}/mailboxSettings	Get a user's locale and out-of-office status.
DELETE /subscriptions/{id}	Unsubscribe from notifications on changes to a user's calendar.
PATCH /users/{id \| userPrincipalName}/calendar/events/{id}	Update properties of calendar events (including join information and extended properties) in addition to other fields pertaining to the meeting.
POST /users/{id\|userPrincipalName}/calendar/getSchedule	Displays the user availability and free/busy status for a specified time range.
DELETE /users/{id \| userPrincipalName}/calendar/events/{id}	Deletes an event from a calendar.
POST /users/{id \| userPrincipalName}/calendar/events/{id}/{accept \| decline \| tentativelyAccept}	Allows the user to accept/decline/tentatively-accept the status for a meeting.