Cross-Tenant Policies To Replace Free/Busy Organization Relationships

Exchange Web Services (EWS) is used to support cross-tenant free/busy lookups (between different M365/Entra ID tenants). EWS is being disabled in Exchange Online, and so any Organization Relationship that you have that allows Free/Busy cross-tenant needs to be updated to Cross-Tenant Access Policies (XTAP).

Microsoft have the documentation for this at Migrate to Microsoft 365 Cross-Tenant Access Policy for sharing Free/Busy, Calendars, and MailTips | Microsoft Learn but this assumes that you do not have an existing cross-tenant policy. If in Entra ID you have already created a cross-tenant policy, then the first part of section 2 of the above will fail with the error:

New-MgBetaPolicyCrossTenantAccessPolicyPartner_Create: Another object with the same value for property tenantId already exists.

Status: 409 (Conflict)
ErrorCode: Request_MultipleObjectsWithSameKeyValue

So, this blog post covers the steps to set this up where the tenant already exists in the Cross-Tenant Access Settings in Entra ID, for example where you have created a multi-tenant organization (MTO) or have already set up the policy.

To complete these steps requires Microsoft Graph Beta modules installed, specifically the Microsoft.Graph.Beta.Identity.SignIns module. And this module needs to be v2.39.0 or later (the August 2026 version).

To check the version of the module installed, or indeed if you have it installed at all, run:

Get-Module Microsoft.Graph.Beta.Identity.SignIns

If this returns nothing, you need to install the module:

Install-Module Microsoft.Graph.Beta.Identity.SignIns

And if the module is not 2.39.0 or higher, to update it:

Update-Module Microsoft.Graph.Beta.Identity.SignIns -Force

Once the module is installed, restart your PowerShell window and run the following to force the beta module to be loaded (as you might have the v1.0, non-beta, version installed and loaded instead. Then connect to your tenant with Microsoft Graph:

Import-Module Microsoft.Graph.Beta.Identity.SignIns

Connect-MgGraph -Scopes "Policy.Read.All,Policy.ReadWrite.CrossTenantAccess,Policy.ReadWrite.CrossTenantCapability" -ContextScope Process

You need the tenant ID from your partner and then set that in the $partnerId variable:

$partnerId = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

Then use this to update the existing cross-tenant access policy for the $partnerId used above. This sets a variable called $m365CollaborationInbound to all users. If you want to do a different group of users, the modify the JSON:

$m365CollaborationInbound = @{
    users = @{
        accessType = "allowed"
        targets = @(
            @{ target = "AllUsers"; targetType = "user" }
        )
    }
}
Update-MgBetaPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerId -M365CollaborationInbound $m365CollaborationInbound

You can then continue with the steps in the Microsoft document above, but I have included them here for completeness. These will set up the cross-tenant access policy for the same as “AvailabilityOnly” (so just free/busy) and then all MailTips:

# Free/Busy Cross-Tenant Policy (replaces EWS based Organization Relationships)

$capability = "crossTenantCalendarAvailabilityBasic"

$group = @{
    resourceId = "All"
    resourceType = "user"
}

$body = @{
    "@odata.type" = "microsoft.graph.$capability"
    inboundAccess = @{
        isAllowed = $true
        resourceScopes = @{
            included = @(
                $group
            )
            excluded = @(
                @{ }
            )
        }
    }
}

New-MgBetaPolicyCrossTenantAccessPolicyPartnerM365Capability -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerId -BodyParameter $body

# MailTips Cross-Tenant Policy

$capability = "crossTenantMailTipsAll"

$group = @{
    resourceId = "All"
    resourceType = "user"
}

$body = @{
    "@odata.type" = "microsoft.graph.$capability"
    inboundAccess = @{
        isAllowed = $true
        resourceScopes = @{
            included = @(
                $group
            )
            excluded = @(
                @{ }
            )
        }
    }
}

New-MgBetaPolicyCrossTenantAccessPolicyPartnerM365Capability -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerId -BodyParameter $body