O365 Calendar Adapter – Support app-only authentication (Entra ID app registration with client secret)

Add an authentication option to the Office 365 Calendar Adapter that uses an Entra ID (Azure AD) enterprise application registration with the OAuth 2.0 client credentials flow (tenant ID, client ID, and client secret). This would replace the need for a licensed user or service account to authenticate.

Current behavior
The adapter authenticates as a user account that has delegated access to the room and resource mailboxes. Customers have to provision and license a service account, exempt it from MFA and Conditional Access, and manage password rotation. When that account’s password expires, gets locked, or is caught by a new security policy, calendar data stops flowing to signage and room panels without warning.

Requested behavior

• Add an authentication type selector to the adapter: User Account (existing) or Application (Client Credentials).

• For Application auth, accept Tenant ID, Client ID, and Client Secret. Optionally accept a certificate as well.

• Use Microsoft Graph application permissions such as Calendars.Read (or Calendars.ReadWrite where booking or extend actions are needed) with admin consent.

• Support customers who limit the app to specific mailboxes through Exchange Online RBAC for Applications or an Application Access Policy.

• Show the secret’s expiration date and warn before it expires.

Business justification

• Security and compliance: Enterprise customers, especially law firms and financial services, increasingly block or flag MFA-exempt service accounts. App-only auth is Microsoft’s recommended pattern for daemon and background integrations.

• Reliability: Fewer outages caused by password expiry, account lockouts, or Conditional Access changes.

• Cost and friction: Customers don’t need a licensed mailbox for the service account. It also shortens security review during implementation, which is currently a common source of delay.

• Competitive parity: Most workplace and room-scheduling platforms already support app registration auth.

Acceptance criteria

• The adapter can read room calendars using only Tenant ID, Client ID, and Secret, with no user credentials.

• Access can be scoped to specific mailboxes, and the adapter fails gracefully on mailboxes outside that scope.

• Existing user-account configurations are unaffected.

• The secret’s expiry shows in the UI and an alert is raised before it expires.

Customer impact: BLG has requested this most recently