Calendar Sharing In Exchange Online After Multi-Tenant Organizations (MTO) Is In Place

When you configure a Multi-Tenant Organization (MTO) relationship in Microsoft 365 one of the configurations that it can put in place for you is an Exchange Organization Relationship. This relationship allows you to view the Free/Busy status of mailboxes in the other organization(s) in the MTO. But this is not sharing your calendar, though it might look like it is sharing your calendar. In this blog post we are going to look at some other settings you might need to put in place to allow calendar sharing as well.

The default in Exchange Online is that you can share your calendar with another Exchange Server or Exchange Online organization but to a maximum of Free/Busy and no more details. This is less permissions than the organization relationship that has gone in place with the MTO, and so you might share your calendar with someone in the other organization and wonder why your permissions are so restricted. This is the sort of view that you will see in Outlook when you try and share your calendar and the default Calendar Sharing settings are in place:

Both of these views show that the share of the calendar is limited to Free/Busy status and not any other calendar sharing permissions such as seeing the Titles (Subject) and Location or Reviewer or higher levels of permission such as Editor.

This permission level is irrespective of the Organization Relationship that MTO created, as that defaults to Free/Busy/Subject/Location, which is otherwise know as LimitedDetails and not just Free/Busy, or AvailabilityOnly to give it its other name.

The Organization Relationship works when you are creating an event and need to view the status of individual attendees – but when you need to view the other users calendar in the Calendar view in Outlook side by side or overlaid on your calendar, you are subject to the Exchange organization Calendar Sharing permissions instead.

By default these permissions are “*:CalendarSharingFreeBusySimple” and “Anonymous:CalendarSharingFreeBusyReviewer”.

This means that you can share your calendar with any other Exchange organization (*) up to the “…FreeBusySimple” level – which is the same as just “Free/Busy” or AvailabilityOnly to use the other term for this permission level that you see in the unrelated Organization Relationship. The Anonymous permission is for non-Exchange organizations (such as Gmail) and though the organization level permission says “…FreeBusyReviewer” this is by default not allowed because individual anonymous calendar publishing (the anonymous form of calendar sharing) is restricted at the mailbox level as well.

So if you want to share your calendar to the organization that you have just set up an MTO with, and have it more than FreeBusySimple, you need to add another domain to the “Default Calendar Sharing” calendar sharing policy. This seems a bit counter intuitive though – why not just add another policy? The reason why we do not add another policy (though I do have reasons in the next paragraph) is that the mailbox is configured to use the Default Calendar Sharing policy – so just adding the domain and sharing level to the Default Calendar Sharing policy will apply to all users (as they all use this policy by default).

But you might have a reason to restrict this, that is have only some people in your organization able to share a calendar with the other side of the MTO or with other Exchange organizations in general. You can do this with multiple policies, but remember that a mailbox can only have one policy and so your Calendar Sharing policies might need to contain multiple domains, or have the domain repeated on multiple policies, to achieve your aim.

Lets take a look at this example to see what I mean. The Fabrikam “London Office” users are allowed to share their calendar with Contoso Ltd and up to full details level, but the rest of the company is not allowed any external calendar sharing. We would need to create/update the following two policies.

1. A new Calendar Sharing policy called “London Office To Contoso” which reads “contoso.com:CalendarSharingFreeBusyReviewer”
2. Update the “Default Sharing Policy” to “” (that is empty, no domains and no Anonymous sharing)
3. Update the mailbox for each user in the London Office to use the new policy via PowerShell: Get-DistributionGroupMembers “London Office” | Set-Mailbox -SharingPolicy “London Office To Contoso”

Or this second example, everyone can share their calendar with any other Exchange Organization for Free/Busy only, but London Office can also share with Contoso.

1. A new Calendar Sharing policy called “London Office To Contoso” which reads A new Calendar Sharing policy called “London Office To Contoso” which reads “*:CalendarSharingFreeBusySimple”,”contoso.com:CalendarSharingFreeBusyReviewer”
2. Update the “Default Sharing Policy” to “*:CalendarSharingFreeBusySimple” (that is Free/Busy to any other Exchange organization and no Anonymous sharing)
3. Update the mailbox for each user in the London Office to use the new policy via PowerShell: Get-DistributionGroupMembers “London Office” | Set-Mailbox -SharingPolicy “London Office To Contoso”

The difference here is that we set both the default and the new policy to contain the “all domains” (*) entry, but for the new policy we added a new domain which reads “*:CalendarSharingFreeBusySimple” in addition to the Contoso entry mentioned in the first example. So sharing to Contoso can be up to Reviewer level and sharing to everyone else in an Exchange organization can be “Simple” level only. If we only included the Contoso domain entry in the policy to the London users, they would not be able to do the external sharing to any other Exchange organization that the rest of the company could do (those subject to the Default Sharing Policy). The following image shows this policy being created in the Exchange Online Admin Center:

And then finally, consider the case of Calendar Sharing (via Calendar Sharing Policy) and Availability Sharing (via the Organization Relationship). You could have a position where the New Event dialog in Outlook which shows Availability is different to what the Calendar view shows if someone has had a calendar shared to them directly.

Availability cross-organization works only on the “Default” permission level in your calendar permissions in Outlook (displayed as “My Organization” inside Outlook, but other permissions added directly on the calendar only impact Calendar Sharing (and both are subject to a maximum permission based on their respective policy). So for example, lets look at Chris’s calendar permissions in PowerShell.

PS> Get-MailboxFolderPermission "chris:\calendar"

FolderName           User                 AccessRights                           SharingPermissionFlags
----------           ----                 ------------                           ----------------------
Calendar             Default              {AvailabilityOnly}
Calendar             Anonymous            {Reviewer}
Calendar             otheruser@domain.com {Reviewer}
Calendar             diffuser@othercompa… {Reviewer}

He has “Default” permission of AvailabilityOnly, which means for other organizations and anyone not specifically listed in his own tenant (“My Organization” in Outlook), he is sharing Free/Busy only (even if the Organization Relationship allows LimitedDetails). This is true even if you are “otheruser” in this example – you are in a different organization and the specific permission you get is Reviewer for Calendar Sharing but still AvailabilityOnly for new events and schedule view. Reviewer level permissions only turn up in Calendar view once Chris’s calendar is added “Other Users” Outlook.

Photo by Aleksandar Cvetanovic: https://www.pexels.com/photo/brown-wooden-block-desk-calendar-displaying-september-13-1425099/