Microsoft 365 - GCC High (Service User) Installation

Prerequisites

• Administrator Permissions:

  You must have administrator permissions for your company's Microsoft workspace.

• Azure Gov Cloud Access:

  You must be able to log in to Azure Gov Cloud and create an enterprise application.

• ModernLoop Platform Access:

  Ensure you have access to the ModernLoop platform. If you do not, please contact your ModernLoop Customer Success Manager (CSM).

List of User-level Permissions

ModernLoop requires the following Service User permissions to function properly:

• Calendars.ReadWrite - read and write calendars

• User.Read - read users full profile

• Mail.Send - send email

• Place.Read.All - read all company places

• openid - sign in and read user profile

• offline_access

All requested permissions are limited to the connected service user account. Our application can only view and act on data that the service user already has access to within Microsoft, and cannot access any additional users, calendars, mailboxes, or organizational data outside of that scope.

Step 1: Create the Service User in Microsoft

Create a single service user to represent your interview calendar. This must be a primary user with at least a basic license. ModernLoop recommends one these naming schemes for your service user as the email address will be visible to candidates and interviewers.

PowerShell Script to Reduce Service User to Availability Only

This is an example of a script that will restrict the service user to Free-Busy blocks on every calendar at your company. You can edit this script as needed to comply with your company's security standards.

After set up, this should be run on a recurring basis or whenever a new account is created.

# Load Exchange Online module if not already loaded
if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
    Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force
}

Import-Module ExchangeOnlineManagement

# Connect to Exchange Online
Connect-ExchangeOnline

# Define the calendar access user
# This is where you add you service users email address
$calendarViewer = "interviews@YOURDOMAIN.com"

# Get all user mailboxes (excluding shared/system)
$mailboxes = Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited

foreach ($mb in $mailboxes) {
    $calendarIdentity = "$($mb.PrimarySmtpAddress):\Calendar"
    
    # Skip if the mailbox belongs to the calendar viewer
    if ($mb.PrimarySmtpAddress -eq $calendarViewer) {
        Write-Host "Skipping $calendarViewer's own calendar..." -ForegroundColor Gray
        continue
    }
    
    try {
        # Remove any existing permission for interviews@ before setting new one
        $existingPerm = Get-MailboxFolderPermission -Identity $calendarIdentity -User $calendarViewer -ErrorAction SilentlyContinue
        if ($existingPerm) {
            Write-Host "Removing existing permission for $calendarViewer on ${calendarIdentity}..." -ForegroundColor Yellow
            Remove-MailboxFolderPermission -Identity $calendarIdentity -User $calendarViewer -Confirm:$false
        }
        
        # Set AvailabilityOnly permission
        Write-Host "Setting AvailabilityOnly on ${calendarIdentity} for $calendarViewer..." -ForegroundColor Cyan
        Add-MailboxFolderPermission -Identity $calendarIdentity -User $calendarViewer -AccessRights AvailabilityOnly
    } catch {
        Write-Host "Failed to set permissions on ${calendarIdentity}: $_" -ForegroundColor Red
    }
}

# Disconnect from Exchange
Disconnect-ExchangeOnline

Step 2: Create the OAuth Application in Microsoft

(Directory + Calendar Setup via Azure Enterprise Application)

To access directory and calendar information necessary for scheduling, you must create an Enterprise Application in your Azure Gov Cloud. Follow the steps below.

Step-by-Step Guide to Creating an Enterprise Application

1. Sign In to Azure Gov Cloud:

   Log in to the Microsoft Azure portal using an account with permissions to create an enterprise application.

2. Register a New Application:

   1. Navigate to App Registrations and click New Registration.

      

   2. Enter ModernLoop or a preferred application name in the Name field.

   3. Select the Multi-tenant option.

   4. Leave the Redirect URL field empty.

   5. Click Register.

      

3. Assign Permissions:

   1. Navigate to the newly created application.

   2. Click on API Permissions → Add a Permission.

   3. Add the following permissions under the Microsoft Graph API:

      • Calendars.ReadWrite Read and write calendars in all mailboxes

      • MailboxSettings.Read Read all user mailbox settings

      • Place.Read.All Read all company places

      • User.Read.All Readall users' full profiles

        

   4. Once permissions are added, click Grant admin consent for ModernLoop.

      

4. Create a Client Secret:

   1. Go to Certificates and Secrets → Client Secrets.

   2. Click New Client Secret.

   3. Add a description (e.g., ModernLoop Integration).

   4. Set an expiration date that matches or exceeds your ModernLoop contract end date.

   5. Click Add.

   6. Save the Client Secret Value immediately, as it will only be shown once.

      

5. Add Authentication Redirect URLs:

   1. Go to Authentication → Add a Platform.

   2. Add the following redirect URLs:

      • https://api.modernloop.io/integration/outlook/oauth/callback

      • https://mloop.prod.modernloop.io/integration/outlook/oauth/callback

      • https://modernloop.us.auth0.com/login/callback

      • https://auth.modernloop.io/login/callback

   3. Ensure Access Tokens are selected for these endpoints.

      

6. Provide Credentials to ModernLoop:

   Share the following details with the ModernLoop team to complete the integration:

   • Application ID

   • Directory (Tenant) ID

   • Client Secret Value (from step 4)

     

Integration Instructions

1. Log in to ModernLoop at https://app.modernloop.io/ using your Microsoft 365 account.

2. Click Connect Microsoft GCC High (Service User)

3. Review the permissions on the Organization App Consent screen

4. Click Accept to grant the necessary permissions.

Allow up to 24 hours for Microsoft to sync with ModernLoop.