Microsoft Admin Consent Guide for Sedna Calendar

This document explains what permissions Sedna Calendar requires and how Microsoft administrators can manage access for their organisation.

Sedna Calendar is a calendar integration application that connects with Microsoft 365 to display and manage calendar events. The application uses Microsoft Graph API with delegated permissions, meaning it can only access data on behalf of signed-in users. Because one of the required permissions (Place.Read.All) is classified by Microsoft as admin-only, Sedna Calendar requires admin consent for your organisation. User self-consent is not supported.

Permissions Required

Sedna Calendar requests the following delegated permissions (user-level, not application-level):

Security Notes

• All permissions are delegated - the app can only access data the signed-in user can access
• No application-level permissions are used - the app cannot access data without a user present
• Each user can only see and modify their own calendar, not other users' calendars
• Place.Read.All reads only the tenant's shared room and location directory — not other users' calendar contents or personal data.

Admin Consent Options

Granting Admin Consent

An admin grants consent on behalf of all users so they don't see individual consent prompts. Visit the following URL and sign in with an admin account.

After signing in and accepting, the admin will be redirected to Sedna Calendar with a confirmation that consent was granted. All required permissions are included in the URL.

Why user self-consent isn't supported

Sedna Calendar requests the Place.Read.All permission to display meeting rooms and location details. Microsoft classifies this as an admin-only permission because it reads the tenant's shared room and building directory rather than personal data. As a result, users cannot grant consent themselves even if your organization normally allows user consent for apps. A Microsoft 365 administrator must grant consent once for the organization using the steps above.

Alternative: Grant Admin Consent via the Azure Portal

Admins who prefer to avoid the consent URL can grant consent directly in the Microsoft Entra admin center. This is equivalent to using the consent URL. Use whichever is more convenient.

1. Navigate to Azure Portal → Microsoft Entra ID (formerly Azure Active Directory)
2. Go to Enterprise Applications
   1. Left menu → Enterprise applications
   2. Search for "Sedna Calendar"
   3. If not found, a user may need to sign in first and attempt to connect their calendar to create the service principal
3. Grant Admin Consent
   1. Select the Sedna Calendar application
   2. Go to Permissions in the left menu
   3. Click Grant admin consent for [Your Organisation]
   4. Review the permissions and click Accept
4. Verify Consent

1. After granting, the permissions should show "Granted for [Your Organisation]"

Optional: Restrict Access to Specific Users/Groups

After granting consent using either option above, you can optionally limit which users can use Sedna Calendar.

1. Navigate to Enterprise Applications → Select Sedna Calendar
2. Configure User Assignment
   1. Go to Properties in the left menu
   2. Set Assignment required? to Yes
   3. Click Save
3. Assign Users or Groups
   1. Go to Users and groups in the left menu
   2. Click Add user/group
   3. Select the users or security groups that should have access
   4. Click Assign

Result: Only assigned users can authenticate with Sedna Calendar. Others will see an access denied error.

Conditional Access (Optional)

For organisations with Microsoft Entra ID P1/P2, you can create Conditional Access policies for Sedna Calendar:

1. Navigate to Microsoft Entra ID → Security → Conditional Access
2. Create new policy targeting the Sedna Calendar enterprise app
3. Configure conditions (e.g., require MFA, block certain locations, require compliant devices)

Revoking Access

Remove Org-Wide Consent

1. Enterprise Applications → Sedna Calendar → Permissions
2. Click Review permissions or remove individual permission grants

Remove for Specific Users

1. Enterprise Applications → Sedna Calendar → Users and groups
2. Select users and click Remove

Users Can Revoke Their Own Access

Users can remove Sedna Calendar's access at: https://myapps.microsoft.com → Click profile → View account → Manage your apps

Frequently Asked Questions

Q: Can Sedna Calendar access other users' calendars? A: No. Sedna Calendar only uses delegated permissions, meaning it can only access the signed-in user's own calendar data.

Q: Does Sedna Calendar store calendar data? A: Calendar data is cached locally in the user's browser to improve performance. No calendar event data is stored on Sedna servers.

Q: What happens if we revoke consent? A: Users will need to re-authenticate and consent again. Any locally cached data in the browser will become stale.

If you have any issues, feel free to contact our support team.