Paradox has multiple integration options that can be utilized to give Olivia access to the information she needs to get the job done when it comes to scheduling. High level, creating a calendar integration will allow Paradox to read data on the user’s calendars so the AI Assistant can offer times to candidates that are free on the user’s calendar. Most integration methods utilize a service account that can also be used to send the AI’s communications and calendar invites. 

Paradox supports different platforms for calendar integrations, including M365 and Google. Here are the different integrations options within each platform, this document will go over each option in detail:

• M365
  • Service Account 
  • Azure Admin Account 
  • Individual User Account 
• Google
  • Individual User Account 
• Other less common methods that are not covered in this doc
  • Exchange 
  • Zoom (Zcal) 
  • Paradox Native Calendar 

See this chart for an overview of the decisions steps and considerations or certain options when selecting Calendar integration:

For calendar integrations using M365, there are 3 methods: 

• Service Account
• Azure Admin Account
• Individual Account

In order to use a service or admin account, a Paradox application will need to be consented within your Azure environment. All integration methods are OAuth 2.0 supported.

Service Account

• This integration method utilizes a single user account in your Azure tenant to connect with the application.
• For more details on the Service Account method, see this documentation. 
• For information on how to configure the M365 calendar integration in the Paradox account, see this documentation.

Azure Admin Account

• This integration method utilizes an admin account consent to provide permissions to a group of users to use the application.
  • This method does not support email generation from the account connected - meaning that calendar invites will not be created by the account, and will either have to be sent from a separate email address or from a Paradox domain email.
• For more details on the Azure Admin Account method, see this documentation.
• For information on how to configure the M365 calendar integration in the Paradox account, see this documentation.

Individual Account

• This integration method utilizes individual authentication on a user-by-user basis to connect to your calendar. 
• When the account-wide integration methods are not appropriate for connecting user calendars at a global scale, Paradox can support individual authentication on a user-by-user basis. This approach uses a majority of the permissions described above but at a more granular level down to the user that is actually connecting their calendar. 
• Paradox uses Microsoft’s OAuth 2.0 process to log in, consent to application permissions, and link the connection to the proper user account. Note: User credentials will never be stored in Paradox.
• Users will be able to take their own actions in order to connect their M365 account to the Paradox. 
• For information on how to configure, see this documentation.

Paradox Azure Application

Paradox’s M365 calendar integration leverages a configured Enterprise Application in Azure. An Azure Global Administrator grants admin consent to connect the application to your tenant. Once consented, the application acts on behalf of your designated service account or azure admin, using that specific user's identity context to execute Microsoft Graph API calls via OAuth 2.0 permissions.

Here is a diagram showing the flow of the integration configuration:

There are two ways that the Paradox application can be created and managed within your Azure environment: 

1. Paradox Default Application
   • This is a preconfigured application that can be added to your tenant through the OAuth consent of the service account user. 
   • This requires an Azure global admin to consent to adding the application to the environment. 
2. Managed Application
   • This is a custom application that the you manage in your environment.
   • This requires an Azure global admin to register an Enterprise Application within Azure.

Paradox will maintain the connection between Staging and Production environments for the duration of the engagement to ensure the ability for ongoing testing.

Google

For calendar integrations using Google, there is one method: Individual Account. There is currently no global Google integration (ie. Paradox account-wide) available, but that feature will be released in the near future.

Individual Account

• This integration method utilizes individual authentication on a user-by-user basis to connect to your calendar.
• When the account-wide integration methods are not appropriate for connecting user calendars at a global scale, Paradox can support individual authentication on a user-by-user basis. This approach uses a majority of the permissions described above but at a more granular level down to the user that is actually connecting their calendar. 
• Paradox uses Google's OAuth 2.0 process to log in, consent to application permissions, and link the connection to the proper user account. Note: User credentials will never be stored in Paradox.
• Users will be able to take their own actions in order to connect their Google account to the Paradox.
• For information on how to configure, see this documentation.

Paradox Google Application

• The set up process requires the user to log in to their Google account to view and consent to the permissions of the application. Once consent occurs, Paradox will be able to read the calendar free/busy information of the user that connected. 
• Olivia uses the Google Calendar API to make coordinating and scheduling interviews easy for internal users and candidates. We have purposely designed Olivia to access the minimum amount of data for the Calendar API to accomplish scheduling automation.
• Google APIs use the OAuth 2.0 protocol for authentication and authorization.
• Olivia utilizes FreeBusyReader access, which lets the grantee see whether the calendar is free or busy at a given time but does not allow access to interview details. See this Google calendar API documentation for more information.
• Olivia does not access or request data outside of the Google Calendar API.  Olivia does not access any other Google APIs including the Gmail.

Your team has the ability to set how calendar invitations are sent to candidates and interviewers. There are three options to do so for the calendar integration methods: 

1. From a Service Account Email
   1. Calendar invites will be sent from a service account that's been connected in Paradox and authenticated into. 
   2. DNS records for the service account must be registered to prevent emails being marked as spam.
   3. This option is not available for integrations with the Azure Admin approach.
2. From a Different Email
   1. Calendar invites will be sent from a dedicated email address that's been connected in Paradox and authenticated into. 
   2. DNS records for the domain of the connected email must be registered to prevent emails being marked as spam.
3. From a Paradox Email
   1. Calendar invites will be sent from a Paradox email with no additional setup required. 

For options 1 and 2 above, 

• This is email impersonation. 
• After creating a service account, your team will need to allow the Paradox application to send emails on behalf of the service account. This email account will be used to send all scheduling communications. Without going through email impersonation, the Paradox alert emails can be considered spam when Paradox sends email communication using the service account domain.
• Paradox leverages SendGrid’s email sending API in order to send all Paradox-application generated emails. This means that your team will need to make updates to your DNS records in order to send from your domain, through Paradox's (SendGrid) network.
• View additional SendGrid Documentation (Paradox’s 3rd party email vendor)

Paradox has dedicated SendGrid IP addresses sending emails, other integration actions such as fetching free/busy data from calendars would be associated with different AWS server IP addresses. Paradox product support can provide IP addresses if needed.

Considerations for setting up email impersonation:

• Only one email impersonation can be configured - Multiple tenants can be connected (ie. integration getting user calendar data), but calendar invites can only send from a single service account. 
• When the account connected for outgoing invites is an Outlook or Google calendar, the system will use this email address to schedule events with room resources. However, if no specific account is configured, Paradox uses the default email address olivia@paradox.ai for booking rooms and creating attendees' calendar events. 
• A calendar invite sent from a Paradox domain (example: olivia@paradox.ai) will not be automatically accepted by the room resource. In addition to this, when connecting new service accounts, the system automatically connects your service accounts to your Assistant Calendars. Because of this, custom email alerts will need to be configured.
• For those using Microsoft Azure, it's possible to add an alias so that the FROM line of service account emails can look as desired. This requires some SMTP configuration in the Azure when creating the service account. 

For more information on email impersonation and the configuration steps, see this documentation.

FAQs

• Do the service account methods give Paradox access to every account (in my tenant)?
  • No it does not. Paradox will have full access to the Service Account which only gets free/busy access to other user's calendars. This is Microsoft's recommended approach.
• Why does the service account need a mailbox? Why isn't email impersonation setup sufficient to send out calendar invites and cancellations?
  • The reason why we have to connect a calendar (ie. an actual mailbox) is because the AI Assistant needs a two-way feedback loop to track RSVPs and trigger automated follow-ups. If Paradox just generated .ics files arbitrarily (which is what calendar events are), and sent it to that user’s email, they add it to their calendar, and they are the organizer of that event. So then the AI Assistant cannot read the response to the invite. Paradox needs to know if a user accepts/declines the invite so the service account needs to be the organizer, therefore allowing the AI assistant to automatically take the appropriate follow-up actions. 
• Can I connect more than one M365 tenant?
  • Yes, you can manage multiple tenants from a single Paradox account. Each tenant’s settings are managed separately.
• Are there other controls that can be implemented, such as restricting authentication to specific IP addresses or other security measures?
  • Because the service account is customer-managed, their team has control to enforce internal security policies, such as password policies and multi-factor authentication (MFA is not recommended, and adding it after account creation can cause disruption as well). Paradox can give designated IP ranges to restrict network access from our end, but we don't provide any further other custom security measures.
• Is an  integration required to create Teams links for virtual interviews? Is it required for Teams chat?
  • Yes, an integration needs to be configured in order for the account's virtual technology to be Teams (ie. virtual interviews links are Teams meetings). The service account is what is used to read the user calendar data, create calendar invitations, and manage invitation responses, so the integration enables that functionality as the service account is the meeting organizer (ie. creates Teams link), cal event owner, etc.
  • No, an integration is not required for Teams chat. See the documentation for Teams chat here.
• Is the service account purely for centralized management?
  • The main benefit of using a service account in centralized management, yes. The Olivia Scheduling application being only scoped to a single account limits the exposure of data to only one account (mailbox).