Already syncing over EWS?
If your Rise Up calendar sync was set up before this article was updated, your integration runs on Exchange Web Services (EWS), which Microsoft is retiring — enforcement begins 1 October 2026 and EWS is fully removed on 1 April 2027. Do not follow this article — see the dedicated guide "Migrating Your Outlook Integration from EWS to Microsoft Graph" instead.
Prerequisites
- A Microsoft 365 tenant with Exchange Online mailboxes.
- A Microsoft Entra ID (formerly Azure AD) account holding the Global Administrator or Privileged Role Administrator role. A regular user or a lesser admin role (e.g. Helpdesk Administrator) will not see the admin consent button required in Section I.
- Access to Exchange Online PowerShell (required to restrict mailbox access, and to create a room list if you use room management).
- Administrator access to your Rise Up platform (Settings › Calendar synchronisation).
Overview
This article explains how to connect Rise Up to your Microsoft 365 environment so that training sessions are automatically synchronised to Outlook calendars, and how to set up meeting-room management. The integration uses the Microsoft Graph API with application (client-credentials) authentication.
Key elements
- App registration: the Microsoft Entra application Rise Up authenticates as — created once in Section I.
- Client secret: the credential the app uses to authenticate — generated in Section I, expires and must be renewed periodically.
- Graph application permissions: Calendars.ReadWrite, Place.Read.All, and User.Read.All, added and consented on the app registration.
- Admin consent: the approval step, performable only by a Global Administrator or Privileged Role Administrator, that activates the declared Graph permissions.
- Service-account mailbox: the dedicated mailbox Rise Up creates events through.
- Application Access Policy: an Exchange Online PowerShell policy that restricts the Graph app permission to the service-account mailbox only.
- Room List (optional): an Exchange distribution group grouping bookable rooms, used for room management.
I. Create and configure the Azure application
Step 1 — Register a new application
- Go to portal.azure.com and open Microsoft Entra ID › App registrations › New registration.
- Give the application a recognisable name, e.g. Rise Up Calendar Sync.
- Under Supported account types, select Accounts in this organizational directory only (single tenant).
- Leave Redirect URI empty — this integration uses application (client-credentials) authentication, not a user sign-in flow.
- Click Register.
Step 2 — Record the Tenant ID and Client ID
On the app's Overview page, copy the following two values — you will enter them in Rise Up later:
- Directory (tenant) ID → this is your Tenant ID.
- Application (client) ID → this is your Client ID.
Step 3 — Create a client secret
- In the left-hand menu, open Certificates & secrets › Client secrets › New client secret.
- Add a description and choose an expiry period.
- Click Add, then immediately copy the secret Value (not the Secret ID) — it is shown only once. This is your client secret.
Tip
Record the secret's expiry date. When the secret expires, calendar sync stops until you create a new secret and update it in Rise Up.
Step 4 — Add the Microsoft Graph API permissions
- In the left-hand menu, open API permissions.
- Click Add a permission › Microsoft Graph › Application permissions.
- Search for and check each of the permissions in the table below, then click Add permissions.
| Permission | Why it is needed |
|---|---|
| Calendars.ReadWrite | Create, update, read, and cancel calendar events. |
| Place.Read.All | Room-list lookups (only if you use the room management feature). |
| User.Read.All | Event ID translation during migration — temporary (see note below). |
The permissions now appear with the status "Not granted for [Tenant]" — they are declared, but not yet approved. That is expected at this stage.
Good to know
Place.Read.All — room-list sync delay: Microsoft Graph does not return newly created or updated room lists in real time. Allow up to 48 hours for a room list change to propagate before it appears in calendar sync.User.Read.All — temporary: only needed for event ID translation during migration. It can be removed once configuration is complete and Graph mode is fully available.
Why Calendars.ReadWrite? Microsoft Graph does not offer a write-only calendar permission, so
Calendars.ReadWrite is required. It is scoped down to a single mailbox in Section III, so Rise Up cannot access employee or unrelated mailboxes.
Important
Do not add full_access_as_app (an Office 365 Exchange Online permission). It is an EWS permission: it does not grant any Microsoft Graph permission and must not be used for Graph access — EWS and Graph are separate authorization boundaries.
Step 5 — Grant admin consent
- Click Grant admin consent for [Company Name] at the top of the API permissions list.
- In the confirmation dialog, click Yes.
- Confirm success: the Status column shows a green checkmark reading "Granted for [Company Name]" next to each permission.
II. Set up the service-account mailbox
Rise Up creates calendar events through one dedicated mailbox. Choose (or create) a dedicated shared/service
mailbox — e.g. bookings@yourcompany.com. This is your service-account mailbox.
Using a dedicated mailbox keeps access scoped and auditable.
- Go to portal.office.com › Admin › Active users and create the account (or pick an existing dedicated one).
- Assign a licence that includes an Exchange Online mailbox (e.g. E3, Business Standard, or equivalent).
What changed from the previous setup
Unlike the legacy EWS configuration, no impersonation setup is required. Access control is now handled entirely by the application access policy in Section III.
III. Restrict the application to the service mailbox
Calendars.ReadWrite as an application permission defaults to
every mailbox in the tenant unless scoped down. Restrict it in
Exchange Online PowerShell (this cannot be done in the Azure portal):
Connect-ExchangeOnline
New-ApplicationAccessPolicy -AppId <ClientID> -PolicyScopeGroupId <ServiceAccountEmail> -AccessRight RestrictAccess -Description "Restrict to booking mailbox"
Replace <ClientID> with the Client ID from Section I / Step 2 and
<ServiceAccountEmail> with the service-account mailbox from Section II. This ensures Rise
Up can access only the dedicated service mailbox — never employee or unrelated mailboxes.
Verify the policy applies (allowed for the service mailbox, denied for any other):
Test-ApplicationAccessPolicy -Identity <ServiceAccountEmail> -AppId <ClientID>
Test-ApplicationAccessPolicy -Identity <SomeOtherMailbox> -AppId <ClientID>The first command should return Granted, the second Denied.
IV. Configure and validate in Rise Up
- Open the settings: in Rise Up, go to Settings › Calendar synchronisation.
- Configure credentials: in the Microsoft Office calendar sync settings, enter your Tenant ID, Client ID, client secret, and service-account mailbox. Add your room list address and booking CC email if you use those features.
- Choose Graph mode: select Graph as your connection mode.
- Test the configuration: click Test configuration to validate the setup.
- Test session creation: create a real training session and confirm it syncs to Outlook.
- Validate the result: check that the session appears correctly in Outlook, with the expected title, time, attendees, and room.
Need help?
Contact the Care team via Zendesk if anything does not sync as expected. Because you are starting directly on Graph, there are no legacy EWS events to translate — once your test session validates, you are fully operational.
V. Room management (optional)
To book meeting rooms from Rise Up, group your rooms into a Room List in Exchange Online PowerShell:
New-DistributionGroup -Name "Rise Up Rooms" -RoomList
Add-DistributionGroupMember -Identity "Rise Up Rooms" -Member <RoomMailbox>Repeat Add-DistributionGroupMember for each room, then enter the Room List address in the Rise Up calendar synchronisation settings.
48-hour propagation delay
Microsoft Graph does not return newly created or updated room lists in real time. Allow up to 48 hours after creating or changing a room list before it appears in calendar sync.
VI. Security and access control
Two access models are possible with application permissions. Rise Up requires the restricted model described in Section III.
| Approach | Security level | Configuration | Recommendation |
|---|---|---|---|
| No access policy (tenant-wide access) | Low — the app can reach every mailbox | None (default) | Not recommended |
| Application access policy (Section III) | Enhanced — access limited to the service mailbox only | One PowerShell policy | Required for Rise Up |
FAQ & Troubleshooting
Issue Solution The configuration test fails Verify the Tenant ID, Client ID, and client secret (make sure you copied the secret Value, not the Secret ID), and confirm admin consent shows green checkmarks on all three Graph permissions. The "Grant admin consent" button is not visible The signed-in account must hold the Global Administrator or Privileged Role Administrator role. Sessions do not sync to Outlook Confirm Graph is selected as the connection mode, and run Test-ApplicationAccessPolicyto confirm the service mailbox returns Granted.Rooms or the room list do not appear Check the Room List address and its members, and allow up to 48 hours for Graph to return a new or updated room list. Sync stops working after months of running fine The client secret has probably expired — create a new secret in Certificates & secrets and update it in Rise Up. The app can access more mailboxes than expected Apply the application access policy from Section III and verify it with Test-ApplicationAccessPolicy.-
Which permissions does Rise Up need?
Microsoft Graph application permissions:Calendars.ReadWrite,Place.Read.All(room management only), andUser.Read.All(temporary — removable once configuration is complete and Graph mode is fully available). The legacyfull_access_as_appExchange Online permission is no longer used and must not be added for Graph.
Can I limit which mailboxes Rise Up can access?
Yes — and you should. The application access policy in Section III restricts access to the single dedicated service mailbox; every other mailbox returns Denied.
Why does Rise Up need read-write calendar access?
Microsoft Graph does not offer a write-only calendar permission, soCalendars.ReadWriteis required. It is scoped down to the service mailbox, so Rise Up cannot access employee or unrelated mailboxes.
Which Microsoft licences are compatible?
Any licence that includes an Exchange Online mailbox for the service account (e.g. E3, Business Standard, or equivalent).
I already have a working calendar sync — do I need to redo this setup?
No. If your sync was set up on EWS, keep your existing app registration and follow the dedicated guide "Migrating Your Outlook Integration from EWS to Microsoft Graph" instead — nothing new needs to be created. -
Contact Support
Migrating Your Outlook Integration from EWS to Microsoft Graph
Managing Room Lists for Calendar Sync
Understanding Application Access Policies in Exchange Online