Microsoft 365 integrations in the Connected Apps section of the Integration Center simplifies how you connect and manage an organization’s Microsoft 365 accounts within Paradox. This provides a single, clear setup path, supports multiple Microsoft tenants within a single account, and enables self-service configuration, significantly reducing the need for Paradox support intervention.

Prerequisites

To set up the Microsoft 365 Integration, you will need:

• Microsoft 365 admin credentials for your organization.
• If you choose the Service Account approach, it is recommended that you have the Sharing Policy in Azure is set to Availability Only as default.
• If you choose the Custom App configuration, you will need your Azure Application (Client) ID, Directory (Tenant) ID, and Client Secret Value.
• A Paradox user role with permission to access the Connected Apps section of the Integration Center.
• The setting Email Technology in the Scheduling section of Client Setup should be selected for Outlook before performing the M365 connection steps below. Learn more about this in Client Setup.

Complete the below configuration steps to set up a Microsoft 365 integration with Paradox.

Configure a Microsoft 365 integration

1. Select All Apps in the top left corner of the header and then select Integrations.
2. From the left panel of the Integration Center, open the Connected Apps section.
3. Select Connect Microsoft 365 on the tile.
   • Note: If an integration is already connected, select the action menu, or ellipses, on the tile and Tenant Connection Details. In the modal, select + Add New Tenant to connect another one.
4. In the Integration Approach step, select the method your organization prefers for calendar management. Options include:
   • Service Account – Uses a dedicated Microsoft 365 account to manage calendars across your organization. This is best for centralized control.
   • Azure Admin Account – Grants organization-wide permissions via your Azure admin. Best for enterprises that require admin-level control without a specific service account.
5. Select Continue in the bottom right corner of the modal.
6. In the App Management Selection step, select the method for how the Paradox application is registered in your Azure environment. Options include:
   • Use Default App – A quick setup using the pre-configured Paradox application. No additional Azure configuration is required.
   • Custom App – Uses your organization's registered Azure application, requiring you to provide the Application ID, Tenant ID, and Client Secret.
7. Select Continue in the bottom right corner of the modal.
8. The Functionality Selections step is where you can enable the features that the tenant connection will support. At least one feature must be selected. These features include:
   • Microsoft O365 National Clouds – Select the Microsoft O365 environment that matches your organization’s setup:
     • Microsoft O365 Global Cloud – The standard environment for most commercial businesses worldwide.
     • Microsoft O365 Government GCC High – For U.S. government contractors and agencies.
   • Send Calendar Invites – This will display for Service Accounts only. Enable this to send interview invites to candidates and interviewers from the service account's email address.
     • Note: Only one account is used for sending emails even if the your team has multiple tenants connected (more information on this below). 
   • Read Calendar Availability – Enable this to allow the service account to check free/busy times for scheduling. NOTE: This will not allow the system to see the details of busy times; rather, it only notes what times a user is not available.
     • Default to Calendar Timezone Sync – Enable (or disable) this to sync Paradox timezone with O365 Working Hours timezone each time the calendar is accessed. This is automatically enabled by default. Learn more about employee/user timezones here.
   • Enable Microsoft Teams Meetings – Enable this to automatically create Teams meeting links for every scheduled virtual interview. If selected, configure the following related settings:
     • Meeting recording – Enable this setting to allow the meeting to record. 
     • Transcription – Enable this setting to allow meeting transcriptions. 
       • Note: The Microsoft Teams Admin must enable the meeting recording and transcription in the Teams tenant-level policies setting, which is done in Microsoft Teams Admin Center under Meetings > Meeting policies > Recording & Transcription.

     • If you enable the Microsoft Teams Meetings setting and want to use Microsoft Teams as your virtual technology, then you will also need select Microsoft Teams as your virtual technology provider in the Scheduling section of Client Setup. 

        
     • Set attendees as co-organizers – Enable this setting to set attendees as co-organizers.
     • Lobby Bypass Settings – Select who is admitted directly into the meeting from the following options:
       • Organizer – Only the organizer is admitted into the meeting and bypass the lobby.
       • Organization – Only the participants from the same company and guests are admitted into the meeting and bypass the lobby.
       • Organization and Federated – Only the participants from the same company or trusted organization and guests are permitted in the meeting and bypass the lobby.
       • Everyone – Everyone is admitted into the meeting. 
       • Invited – Only people the organizer invites are admitted into the meeting and bypass the lobby.
       • Organization Excluding Guests – Only the participants from the same company are admitted into the meeting and bypass the lobby.
         
9. Select Continue in the bottom right corner of the modal.
10. If you selected Custom App in step #6, then you will need to copy information between the Paradox setup wizard and your organization's Azure Portal. so that the app has the right access and that Paradox can communicate with it. See the Microsoft Admin View section of this Microsoft documentation on how to register an application. From the Paradox side, complete the below steps. If you did not select Custom App, move to step #11.
    1. Copy the specific Paradox Redirect URL shown in the setup wizard and paste it into the app's settings in your Azure Portal. The URL type must be ‘Web’
       1. Service Account Setup: https://olivia.paradox.ai/user/outlook-oauth2 (or the EU version)
       2. Azure Admin Setup: https://paradox.ai/azure-admin-consent (or the EU version)
          

          

    2. Review the list of required Microsoft Graph API permissions displayed in Paradox. This list changes based on the functionality you selected in step #8.
    3. Navigate to your Azure Portal App registrations and add the copied permissions.
       
       
       • Note: This will be under section API Permissions and you will be adding Microsoft Graph API permissions by typing them into the search bar. 
         
    4. A Microsoft 365 Admin must grant admin consent for these permissions in Azure.
    5. Once your Azure configuration is complete, select Continue.
    6. Enter the following credentials from your registered Azure application:
       • Application ID – The unique ID number for your app.
       • Secret Value – The app's secret password (ensure you use the Value, not the ID).
       • Directory (Tenant) ID – Your unique Azure tenant identifier.
       • Secret Value Date Expiration – Select a future date.
         
11. If you selected Azure Admin Account in step #4 above, then you'll need to enter your organization's Tenant ID in the Tenant ID field in GUID format. If you did not select Azure Admin Account, then move to the next step #12.
    1. In the Connection step, select Sign in with Microsoft. This initiates the necessary authentication flow:
       • Service Account – The OAuth flow opens a window/tab for the service account user to sign in and consent to the delegated permissions.
         • If the permissions for the Paradox app hasn't been consented by an Azure Admin, user consent needs to be granted by either an admin signing into grant consent or sending a request to an admin. 
       • Azure Admin – An admin consent URL opens a window/tab for the Azure Admin to grant consent to the application permissions.
    2. On the Microsoft page, select Accept.
    3. If successful, the Sign In Successful! message displays. Select Continue.

12. In the Tenant Overview modal, review the tenant connection details and adjust as needed.
13. Select Complete Setup.
14. After completing the tenant setup, a separate window will appear to configure how interview invitations are sent. This setting applies to all connected tenants. Select one of the following options:
    • Send Calendar Invites from Service Account Email – Only visible if a Service Account tenant is connected and configured to send invites.
    • Send Calendar Invites from a Different Email – This option connects a dedicated email address by signing in with Outlook.
    • Send Calendar Invites from Paradox Email – This option send invitations from a default Paradox sender and requires no additional setup.
15. If the Send Calendar Invites from Service Account Email or Send Calendar Invites from a Different Email option is selected, then the system prompts the user to address DNS records to prevent calendar invitation emails from being marked as spam. Learn more about Email Impersonation here.

From there, the Microsoft 365 integration is connected and ready to use! You can manage tenants and settings from the Microsoft 365 tile in Connected Apps.

Microsoft Azure Admin view

This section will include more details and navigational images of the steps for registering an application inside of the Azure Admin center (if that is the preferred approach). 

Actions available for modifying tenant settings

This section details actions you can take for modifying tenant settings after the initial setup.

1. Select All Apps in the top left corner of the header and then Integrations from its drop-down menu.
2. From the left panel of the Integrations Center, open Connected Apps.
3. Select the action menu, or ellipses, in the Microsoft 365 tile and then Tenant Connection Details.
4. In the modal that opens, you can take the following actions:
   • Add New Tenant – Allows you to add another tenant, taking you through the step-by-step process.
   • Open Settings – Allows you to edit your tenant settings, taking you back to the Configure Calendar Invitations step to choose how interview invitations are sent to candidates and interviewers.

For each individual tenant, you can complete the following actions, depending on the status:

• Edit Tenant Configuration – Allows you to edit your tenant configuration, taking you back to the Tenant Overview step to review and edit tenant configurations as needed. Use this to update functional settings (like Teams) or Custom App secret values.

  When editing tenant configuration, if you change a setting that affects permissions or authentication (such as Enable Microsoft Team Meetings), the Tenant Overview step highlights steps where action is needed with the Review Required badge.

   
• Reconnect Tenant – Allows you to reconnect the tenant. Use this specifically if the Service Account password has changed or if the connection status shows Disconnected. This refreshes the security token without changing your configuration.
• Disconnect Tenant – Allows you to disconnect the tenant.
• Update Tenant Credentials – To maintain security, your organization may rotate credentials. Follow these steps based on your integration approach:
  • For Service Accounts: Paradox does not store your Microsoft password. If your Service Account password is changed in Microsoft 365, the connection breaks. If this is the case, select Reconnect Tenant from the action menu, or ellipses. You will be prompted to Sign in with Microsoft. Simply log in with the new password to restore the connection.
  • For Custom Apps: When your Azure Client Secret is nearing expiration:
    1. Generate a new Secret Value in the Azure Portal.
    2. In Paradox, select Edit Tenant Configuration and then select Credentials.
    3. Paste the new Secret Value and update the Expiration Date.
    4. Select Sign in with Microsoft to verify the new secret and click Save.

FAQs

• Is the integration giving Paradox full access to all user calendar data (ie. concern for application permission access)?
  • No, the Paradox application does not have full access to users' calendars. The admin consent and permission scope steps address this. 
  • The service account method has Delegated scope, which means that permissions (such as Calendars.ReadWrite) apply solely to the authenticating Service Account, not the entire Azure tenant.
  • Although the Azure account method has Application scope, permissions (such as Calendars.ReadBasic.All) are then limited down to Basic, which is the least privileged calendar permission available to get Free/Busy data.
  • Restricted Calendar Access: Paradox has no access to individual user calendar details; it only sees standard free/busy availability dictated by your organization's Azure default sharing policy.
  • Centralized Management: Paradox performs all scheduling, calendar management, and interview invitations exclusively on behalf of the Service Account.
• Can I connect more than one O365 tenant?
  • Yes, you can manage multiple tenants from a single Paradox account. Each tenant’s settings are managed separately.
  • Paradox will send all emails from one email address even if there are multiple connections to read calendar data from different tenants.
• Is an O365 integration required to create Teams links for virtual interviews? Is it required for Teams chat?
  • Yes, an O365 integration needs to be configured in order for the account's virtual technology to be Teams (ie. virtual interviews links are Teams meetings). The service account is what is used to read the user calendar data, create calendar invitations, and manage invitation responses, so the integration enables that functionality as the service account is the meeting organizer (ie. creates Teams link), calendar event owner, etc.
  • No, an O365 integration is not required for Teams chat. See the documentation for Teams chat here.
• What happens if permissions change in Azure?
  • You must re-authenticate and grant any new required permissions before changes are saved.
• What happens if the connection credentials expire? Does the Paradox connection support password rotation? 
  • You can update the tenant's credentials (see the tenant actions information above). It is not a “set and forget” type of implementation.
  • If the credentials for a service account changes, then that will cause the tenant to be disconnected. The tenant will need to be reconnected in Connected Apps. 
• Will the Service Account mailbox be able to receive emails or see outgoing emails?
  • Paradox uses SendGrid to send mail, so you won't be able to see the emails in the account's inbox.
• If MFA is required to log into the service account, does the platform support that during the OAuth connection process? 
  • Yes, but Paradox does not recommend it.
  • If your team enables MFA after connecting, then that can break the connection if there's no exception for the service account.
• Does my team need to have 2 applications, one for Staging and one for Production? 
  • It it not required to have 2 separate applications for a Staging and a Production environment. There is no technical limitation if you use a different application for each or the same one for both environments. 
  • Besides the fact the changes in the application (permissions, credentials, etc.) will affect both environments where it's used, there's no functional difference in using one or separate applications. A use case for having separate applications would be testing; say for example, you want to add or remove permissions for an application in STG, if you use the same application, the changes might affect functionality for live calendar integrations in PROD if you're only using one. 
• If my team is using a @paradox.ai sender email, can the permissions granted to the service account be reduced (e.g. read-only instead of read/write)?
  • Yes. Permissions correspond to the functionality chosen for the integrated tenant, so if your team wants to only use the service account to read user calendar data and the invites are coming from a different service account (ie. @paradox.ai), then you can configure that in Connected Apps.
• The tenant is connected, why do emails still show as coming from the Olivia email?
  • The scheduling emails sent depend on the email impersonation configured in the step ‘Configure Calendar Invitations’. By default, the connected tenants send from Paradox email. Email impersonation for other alerts can be configured in Assist > Custom Email Alerts.
• The tenant is connected, how do users email account calendars get connected?
  • Automatically all the users connect based on their email address (all users who exist with the same email in the Entra ID Active Directory, in a tenant the service account has access to). There is no individual action needed, the connected email will auto-populate in pages like Roles and Permissions, and My Calendar. 
• What if my team wants to use a subdomain? What do we need to consider?
  • If a subdomain is desired to be used for the scheduling emails, email impersonation needs to be configured so that CNAME records are added to your DNS host to prevent emails from being blocked due to differing domains. 
  • CNAME records need to be added for whichever subdomain your team wants to send emails from.
• What if my team has contingent workers? How does that impact the integration?
  • If the contingent workers are full users in the Entra active directory, there are no impacts to the integration as user's account will sync alike to other non-contingent users.  
  • If the contingent worker is not a part of the tenant though, Paradox cannot access the calendar data of an external account with no authentication in the CEM. 
    • For Custom Apps: If new permission scopes are required, the updated list is displayed, and you must update the permissions in the Azure Portal before proceeding to re-authenticate.
    • Re-authentication: You must select Sign in with Microsoft to re-authenticate and verify that all current, required permissions have been granted.