The Azure Admin integration method utilizes a single admin consent to provide permissions to a group of users to use the application (default is the whole organization, in the Azure tenant).

When the service account global implementation is not appropriate or approved by your team, then the Admin Consent approach can be utilized. Your team may want this method when you have specific legal/security requirements around not supporting Service Accounts in your organization or you don’t want to purchase a license for the Service Account. This method does not support email generation (for calendar invitations sent to candidates and interviewers) from the account connected. This means that when the tenant is connected, calendar invites will either have to be sent from a dedicated email address that's been connected in Paradox and authenticated into, or calendar invites will be sent from a Paradox email (ex: clientname@paradox.ai)

After a tenant is connected (ie. Paradox is connected at the global level), then all users will be automatically connected based on their email addresses (all users who exist with the same email in the Azure, or Entra ID Active Directory, in a tenant the service account has access to). There is no individual action needed; the connected email will auto-populate in pages like Roles and Permissions and My Calendar. It is possible to disconnect individual users there/allow them to set up a different individual connection.

Prerequisites

If utilizing MS Teams, the account will need a full license that allows the generation of MS Teams meetings.

Paradox Azure Application

Paradox’s O365 calendar integration leverages a configured Enterprise Application in Azure. An Azure Global Administrator grants admin consent to connect the application to your tenant. Once consented, the application acts on behalf of your designated azure admin, using that specific user's identity context to execute Microsoft Graph API calls via OAuth 2.0 application permissions.

There are two ways that the Paradox application can be created and managed within your Azure environment: 1) Paradox Default Application, 2) Managed Application.

• Paradox Default Application
  • Through the application consent process, we can connect your tenant to the Paradox Default application. This is a preconfigured application that can be added to your tenant through the OAuth consent of the service account user. 
  • This typically requires an Azure global admin to consent to adding the application to the environment. 
• Managed Application (registering an application in Azure)
  • If you prefer to manage your own application in your environment, that is something that can be accomplished. In order to manage a custom application, Register an Enterprise Application within Azure. 
  • You will need to provide the following registered application details to Paradox (example):
    • App ID: 1a058ccb-060a-432c-****-************
    • Tenant ID: 99bbf8d0-600c-4b78-****-************
    • Secret Value: yiX4Omm~6~Mu6I********************
    • Expiration date for the secret key

Configuration diagram 

Click here to learn the steps needed to configure the M365 Azure Admin calendar integration in your Paradox CEM account.

Tenant available actions

The connected tenant can be enabled for the following functionality:

• Read Calendar Availability – The application checks free/busy times for scheduling.
  • Calendar Timezone Sync – Sync Paradox timezone with O365 Working Hours timezone each time the calendar is accessed.
• Microsoft Teams Meetings – Teams is used as your virtual technology, meaning Teams meetings links is created for every scheduled virtual interview.
  • Recording and Transcription – Allow auto recording and transcription for Teams meetings. This media is accessible by the meeting organizer(s).
  • Attendees as co-organizers – Allow for interviewers to be set as co-organizers for Teams meetings.
  • Lobby Bypass – Set who is admitted into the meeting and bypass the meeting lobby.
    • Organizer
    • Organization
    • Organization and Federated
    • Everyone
    • Invited
    • Organization Excluding Guests

Integration permissions scope

• This method uses application permissions.
  • Unlike delegated permissions, application permissions grants Paradox access to the calendar data of all users in the organization without requiring their consent.
• The following permissions are utilized for the Paradox Interview Scheduling Application. Which permissions are required correlate to the functionality chosen for the integration. See this MS documentation for these permissions.
  • Calendars.ReadBasic.All
    • Needed if functionality ‘Read Calendar Availability'  is enabled
    • Used to read the Free/Busy data of users within your tenant. This permission is the least privileged calendar permission available to get Free/Busy data.
    • Allows the app to read events (does not include properties such as body, attachments, and extensions) of all calendars without a signed-in user.
    • Link to Microsoft Documentation
  • MailboxSettings.Read
    • Needed for functionality ‘Read Calendar Availability'  is enabled
    • Used to identify and set the appropriate time zone for users of the Paradox environment.
    • Allows the app to read users’ mailbox settings without a signed-in user. Does not include permission to send mail.
    • Link to Microsoft Documentation
  • OnlineMeetings.ReadWrite.All
    • Needed for functionality ‘Microsoft Teams Meetings’  is enabled
    • Used to create and manage Microsoft Teams URLs for all interviews. The service account will act as the meeting owner when creating the Teams URLs. 
    • The read/write permission only gives permission for the service account and does not give Teams read/write access to other user’s Teams.
    • Link to Microsoft Documentation 
  • User.ReadBasic.All
    • Needed as default permission
    • Used to read the service account’s profile and gives access to sub claim.

Example Microsoft Graph API request

• If an API request is sent on behalf of any other user in your tenant outside of the service account, the integration will provide an error as Paradox does not have API permission for any user outside of the Service Account.
• The following examples are of a request that the Paradox CEM would make on behalf of a service account in your O365 tenant. The request is made by the service account olivia@paradoxolivia.onmicrosoft.com with the interviewer email: test@paradoxolivia.onmicrosoft.com. 
• Calendar Availability 
  • Paradox will use the get free/busy API call to get the free/busy data of the interviewer(s). The List calendarView action lets you get the availability information of a user for a specific period of time.

  • See API request and response

    Example Request: GET https://graph.microsoft.com/v1.0/me/calendar/calendarView?startDateTime=2017-01-01T19:00:00-08:00&endDateTime=2017-01-07T19:00:00-08:00

    This request does not have a body but will have headers that include Bearer Auth tokens for the proper user.

    Example response to previous GET call:

    {
      "value": [
        {
          "originalStartTimeZone": "originalStartTimeZone-value",
          "originalEndTimeZone": "originalEndTimeZone-value",
          "responseStatus": {
            "response": "response-value",
            "time": "datetime-value"
          },
          "iCalUId": "iCalUId-value",
          "reminderMinutesBeforeStart": 99,
          "isReminderOn": true
        }
      ]
    }

     

     
• User Timezone
  • When the application is connected, Paradox will call the mailboxSettings call to identify and update user time zones to match the configuration of the user’s mailbox settings. 

  • See API request and response

    Example Request: GET https://graph.microsoft.com/v1.0/me/mailboxSettings

    This request does not have a body but will have headers that include Bearer Auth tokens for the proper user. 

    Example response to previous GET call:

    {
        "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Me/mailboxSettings",
        "automaticRepliesSetting": {
            "status": "Scheduled",
            "externalAudience": "All",
            "scheduledStartDateTime": {
                "dateTime": "2016-03-14T07:00:00.0000000",
                "timeZone": "UTC"
            },
            "scheduledEndDateTime": {
                "dateTime": "2016-03-28T07:00:00.0000000",
                "timeZone": "UTC"
            },
            "internalReplyMessage": "<html>\n<body>\n<p>I'm at our company's worldwide reunion and will respond to your message as soon as I return.<br>\n</p></body>\n</html>\n",
            "externalReplyMessage": "<html>\n<body>\n<p>I'm at the Contoso worldwide reunion and will respond to your message as soon as I return.<br>\n</p></body>\n</html>\n"
        },
        "timeZone":"UTC",
        "language":{
          "locale":"en-US",
          "displayName":"English (United States)"
        },
        "workingHours":{
            "daysOfWeek":[
                "monday",
                "tuesday",
                "wednesday",
                "thursday",
                "friday"
            ],
            "startTime": "08:00:00.0000000",
            "endTime": "17:00:00.0000000",
            "timeZone":{
                "name":"Pacific Standard Time"
            }
        },
        "dateFormat": "MM/dd/yyyy",
        "timeFormat": "hh:mm tt",
        "delegateMeetingMessageDeliveryOptions": "sendToDelegateOnly"
    }