Microsoft 365 - GCC High (Service User) Installation

Prerequisites

• Administrator Permissions:

  You must have administrator permissions for your company's Microsoft workspace.

• Azure Gov Cloud Access:

  You must be able to log in to Azure Gov Cloud and create an enterprise application.

• ModernLoop Platform Access:

  Ensure you have access to the ModernLoop platform. If you do not, please contact your ModernLoop Customer Success Manager (CSM).

List of User-level Permissions

ModernLoop requires the following Microsoft Graph permissions for the GCC High (Service User) integration. During setup, your administrator will add these to the Enterprise Application and click Grant admin consent.

All permissions are Delegated permissions, and every one is limited to the connected service user or user account. ModernLoop can only view and act on data that the user already has access to within Microsoft — it cannot access any additional users, calendars, mailboxes, or organizational data outside of that scope.

• User.Read.All– read all users' full profiles

• Place.Read.All– read all company places

• Calendars.ReadWrite– read and write calendars

• Mail.Send– send email

• offline_access– maintain access

• openid– sign in

All requested permissions are limited to the connected service user account. Our application can only view and act on data that the service user already has access to within Microsoft, and cannot access any additional users, calendars, mailboxes, or organizational data outside of that scope.

Step 1: Create the Service User in Microsoft

Create a single service user to represent your interview calendar. This must be a primary user with at least a basic license. ModernLoop recommends one these naming schemes for your service user as the email address will be visible to candidates and interviewers.

PowerShell Script to Reduce Service User to Availability Only

This is an example of a script that will restrict the service user to Free-Busy blocks on every calendar at your company. You can edit this script as needed to comply with your company's security standards.

After set up, this should be run on a recurring basis or whenever a new account is created.

# Load Exchange Online module if not already loaded
if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
    Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force
}

Import-Module ExchangeOnlineManagement

# Connect to Exchange Online
Connect-ExchangeOnline

# Define the calendar access user
# This is where you add you service users email address
$calendarViewer = "interviews@YOURDOMAIN.com"

# Get all user mailboxes (excluding shared/system)
$mailboxes = Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited

foreach ($mb in $mailboxes) {
    $calendarIdentity = "$($mb.PrimarySmtpAddress):\Calendar"
    
    # Skip if the mailbox belongs to the calendar viewer
    if ($mb.PrimarySmtpAddress -eq $calendarViewer) {
        Write-Host "Skipping $calendarViewer's own calendar..." -ForegroundColor Gray
        continue
    }
    
    try {
        # Remove any existing permission for interviews@ before setting new one
        $existingPerm = Get-MailboxFolderPermission -Identity $calendarIdentity -User $calendarViewer -ErrorAction SilentlyContinue
        if ($existingPerm) {
            Write-Host "Removing existing permission for $calendarViewer on ${calendarIdentity}..." -ForegroundColor Yellow
            Remove-MailboxFolderPermission -Identity $calendarIdentity -User $calendarViewer -Confirm:$false
        }
        
        # Set AvailabilityOnly permission
        Write-Host "Setting AvailabilityOnly on ${calendarIdentity} for $calendarViewer..." -ForegroundColor Cyan
        Add-MailboxFolderPermission -Identity $calendarIdentity -User $calendarViewer -AccessRights AvailabilityOnly
    } catch {
        Write-Host "Failed to set permissions on ${calendarIdentity}: $_" -ForegroundColor Red
    }
}

# Disconnect from Exchange
Disconnect-ExchangeOnline

Step 2: Create the OAuth Application in Microsoft

(Directory + Calendar Setup via Azure Enterprise Application)

To access directory and calendar information necessary for scheduling, you must create an Enterprise Application in your Azure Gov Cloud. Follow the steps below.

Step-by-Step Guide to Creating an Enterprise Application

1. Sign In to Azure Gov Cloud:

   Log in to the Microsoft Azure portal using an account with permissions to create an enterprise application.

2. Register a New Application:

   1. Navigate to App Registrations and click New Registration.

      

   2. Enter ModernLoop or a preferred application name in the Name field.

   3. Select the Multi-tenant option.

   4. Leave the Redirect URL field empty.

   5. Click Register.

      

Assign Permissions:

1. Navigate to the newly created application.

2. Click on API Permissions → Add a Permission.

3. Add the permissions under the Microsoft Graph API:

   

   All permissions are Delegated permissions, and every one is limited to the connected service user or user account. ModernLoop can only view and act on data that the user already has access to within Microsoft — it cannot access any additional users, calendars, mailboxes, or organizational data outside of that scope.

   • User.Read.All– read all users' full profiles

   • Place.Read.All– read all company places

   • Calendars.ReadWrite– read and write calendars

   • Mail.Send– send email

   • offline_access– maintain access

   • openid– sign in

4. Once permissions are added, click Grant admin consent for ModernLoop.

   

4. Create a Client Secret:

   1. Go to Certificates and Secrets → Client Secrets.

   2. Click New Client Secret.

   3. Add a description (e.g., ModernLoop Integration).

   4. Set an expiration date that matches or exceeds your ModernLoop contract end date.

   5. Click Add.

   6. Save the Client Secret Value immediately, as it will only be shown once.

      

5. Add Authentication Redirect URLs:

   1. Go to Authentication → Add a Platform.

   2. Add the following redirect URLs:

      • https://api.modernloop.io/integration/outlook/oauth/callback

      • https://mloop.prod.modernloop.io/integration/outlook/oauth/callback

      • https://modernloop.us.auth0.com/login/callback

      • https://auth.modernloop.io/login/callback

   3. Ensure Access Tokens are selected for these endpoints.

      

6. Provide Credentials to ModernLoop:

   Share the following details with the ModernLoop team to complete the integration:

   • Application ID

   • Directory (Tenant) ID

   • Client Secret Value (from step 4)

     

Integration Instructions

1. Log in to ModernLoop at https://app.modernloop.io/ using your Microsoft 365 account.

2. Click Connect Microsoft GCC High (Service User)

3. Review the permissions on the Organization App Consent screen

4. Click Accept to grant the necessary permissions.

Allow up to 24 hours for Microsoft to sync with ModernLoop.

Meeting Rooms Data

For Microsoft 365 GCC High, ModernLoop needs meeting room details provided manually because GCC High restricts the meeting room/Places API access ModernLoop normally uses to sync room metadata. This applies even when using the Service User installation method.

Please provide each room’s email, name, description, capacity, building remote ID, and floor name so the rooms can be used for scheduling (example below):

For more information about meeting room API permissions, refer to Microsoft's documentation.