For IT administrators: Microsoft 365
Approve CrowFlo for your organization
Someone in your organization wants to offer booking links that book on their own Outlook calendar. Microsoft 365 asks an administrator to approve apps like CrowFlo first, and it is right to. Here is exactly what CrowFlo asks for, and the approval itself. It takes about two minutes.
- Delegated permissions only
- Credentials encrypted at rest
- Never sold or used to train AI
- Removable at any time
Permissions
What CrowFlo asks for
Calendars.ReadWriteFind free times, and add, move or cancel meetings booked through the person’s own links. Microsoft lists it as full access to calendars; it is the only Microsoft permission that lets an app add a meeting.
offline_accessKeep the connection working without signing in again every hour.
openid, email, profileKnow which account was connected.
All three are delegated: CrowFlo only ever acts as the person who connected, on their own calendar. It asks for no application permissions.
Scope
What approving allows, and what it does not
Approving allows
- Each person in your organization connects their own Outlook calendar, without asking you again.
- CrowFlo reads when events start and end, whether they show the person as busy, and whether they are cancelled.
- CrowFlo creates, moves and cancels only the meetings booked through that person’s links, with a Teams link made by Outlook where the calendar offers Teams.
CrowFlo never gets
- Anyone’s calendar by itself. Every connection is made by the person whose calendar it is.
- Event titles, descriptions, locations or attendees.
- Mail, files, contacts, Teams chats or any application (app-only) permission.
Approve
Two ways to approve
With one link
Fastest. Works whether or not anyone has asked yet.
- 1Select Approve CrowFlo for your organization above.
- 2Sign in with an account holding one of the roles listed.
- 3Review the permissions and select Accept.
- 4You land on a CrowFlo page confirming it. People can connect straight away.
From a request someone sent
If your organization uses Microsoft’s admin consent workflow.
- 1Sign in to the Microsoft Entra admin center.
- 2Go to Entra ID, then Enterprise apps, then Admin consent requests.
- 3Select CrowFlo, review the permissions, and approve.
Microsoft’s guides: Grant tenant-wide admin consent, Review admin consent requests.
Optional
Only some people
Approving lets everyone in your organization connect a calendar. To limit it, in the Microsoft Entra admin center open Enterprise apps, then CrowFlo; under Properties set Assignment required to Yes, then add the people or groups who may use it under Users and groups. Microsoft then refuses anyone else. See Assign users and groups to an application.
Data
What CrowFlo keeps
The connected address and account identifiers, the access credentials Microsoft issues, encrypted at rest with AES-GCM, and the details of the meetings booked through each person’s links. Busy times are used to answer the request in hand and are not stored. Information received from Microsoft is not sold, not used for advertising, and not used to train AI models.
The full terms: Privacy Policy (clause 3.7b), Data Processing Addendum, Subprocessors.
Removal
How to remove it
- For everyone. In the Microsoft Entra admin center, open Enterprise apps, find CrowFlo, and delete it or remove its permissions. Links that book on those calendars stop taking bookings until it is approved again.
- For one person. They disconnect in CrowFlo, at Settings, Meetings, which deletes the credentials CrowFlo holds, so it can no longer reach their calendar. Meetings already booked stay on their calendar. An approval for the whole organization is removed only by an administrator.
Completing a security review?
Questions about permissions, data handling or our subprocessors go straight to the team that builds CrowFlo.