Office 365 room mailboxes CalendarProcessing access via Microsoft Graph

Question

When using rooms and equipments, Exchange (in Office 365, but in other versions as well) uses a number of options to handle requests for those resources in events.

By default, Exchange will for instance strip the subject when creating the event in the room's calendar, and replace it with the organiser name. If you then try to fetch the room's calendar (for a meeting room display, for instance), you'll only have the organiser name instead of the subject of each meeting.

This may be appropriate in some scenarios, but in many others one wants the actual subject to be shown in that calendar.

To achieve that, the only option I know of is to use the Powershell Set-CalendarProcessing cmdlet to change DeleteSubject, AddOrganizerToSubject and more.

In a SaaS environment this is pretty annoying as you need the Office 365 admin to use Powershell to do this operation, which may not be completely straightforward, or you need to ask for the user's login and password and pass them to Powershell, which raises security issues, and will not work in many scenarios (2FA, SAML auth...).

Is there a way to access these settings via Microsoft Graph?

Alternatively, if not available via Microsoft Graph, is there a way to use a Microsoft Graph oAuth token to perform this operation via Linux Powershell? I know it's possible to use oAuth tokens, but despite all my efforts I haven't managed to find a way to perform regular hosted oAuth login and use the token received for this purpose.

Any hints welcome!

Edit

To clarify: I'm in a SaaS scenario where I am the SaaS provider, so I need to allow admins of my customers to change those settings easily or automatically, it's not to access my own room mailboxes (I would use powershell for that).

Foretoken

Answer 1

I don't see anything in the MS Graph Reference that would do what you want. With that said, the barriers you state in your question for using the remote powershell api shouldn't be hard to accomodate.

For starters, your IT provider for email should work with you to configure rooms the way that you want/need. If they are willing to delegate this to you, then there are ways to set up Role Based Access Control (https://4sysops.com/archives/create-custom-rbac-roles-in-exchange-and-office-365/) to give you only access to calendar processing.

Likewise, MS has posted instructions and tools to use MFA with Exchange Online Powershell (https://learn.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell?view=exchange-ps).

Dedans

Just to clarify: I'm in a SaaS scenario where I am the SaaS provider, so I need to allow admins of my customers to change those settings easily or automatically. – Foretoken

Answer 2

According to your description, I assume you want to get the subject of a meeting room.

There is no reference on official Doc for your case yet, we can post this issue to the Graph support on the User Voice.

Chickie

I want to get the subject of events that use a meeting a room, but have originally been created in a regular user's calendar ("inviting" the meeting room). I have already posted a feature request here. Feel free to vote for it! :-) – Foretoken

Answer 3

The only interface I'm aware of for managing this (beyond the Exchange UI of course) is PowerShell.

This isn't supported by Microsoft Graph or Exchange Web Services. It's worth noting that even if this operation was supported, it would still require an Admin to execute it. Operations of this nature almost always require Admin Consent.

Genagenappe

Yep, I don't have a problem with admin consent (already need it for other reasons), it's really being able to do it on behalf of that admin after a regular oAuth admin consent dialog that I'm looking for. On Office 365 I don't even think there's any UI for this. If there is, I would really love to know about it! – Foretoken

It may not be. I was assuming it was but it wouldn't surprise me if it wasn't. – Genagenappe

Answer 4

Try using JEA (Just Enough Administration) or PSSessionConfigurations . Create a constrained endpoints and give access for necessary user/groups for required cmdlets.

Zeitgeist