TRMNL Booking for Microsoft Exchange
Organization administrator guide — onboarding, authorization, room policy, shared organizer, validation, and support procedures
- Applies to: Microsoft 365 / Exchange Online
- Audience: Microsoft 365, Entra, and Exchange administrators
- Version: 24 July 2026
About this manual
This manual explains how to connect TRMNL Booking to an Exchange Online tenant, configure conference-room calendars, use a dedicated shared organizer mailbox, validate bookings, and troubleshoot the most common failures.
Scope: The integration supports Exchange Online rooms, parking spaces represented by equipment mailboxes, and Microsoft Places workspaces and desks. Purely on-premises Exchange is not supported. Hybrid environments require resources and calendars to be available through Exchange Online and Microsoft Graph.
Onboarding roadmap
- Create or select a stable Microsoft 365 integration account.
- Create and configure Exchange room mailboxes.
- Grant the integration account read access to each room calendar.
- Create a shared organizer mailbox and delegate Full Access plus Send As.
- Optionally create an Entra group for parking equipment mailboxes.
- Grant Microsoft Entra consent and connect the Microsoft workspace in TRMNL.
- Configure the shared organizer address and parking resource group in TRMNL.
- Synchronize resources, select the ones Booking should manage, and validate room schedules.
- Run acceptance, conflict, cancellation, privacy, and offboarding tests.
1. Purpose and capabilities
The Microsoft Exchange integration connects TRMNL Booking to your organization's Exchange Online room calendars. It can:
- Discover Microsoft 365 rooms, workspaces, desks, and configured parking equipment.
- Synchronize room availability and upcoming events.
- Display room schedules on TRMNL devices.
- Create and cancel room bookings.
- Use the connected Microsoft account or a dedicated shared mailbox as organizer.
The connection uses Microsoft Graph and delegated OAuth authorization. TRMNL never needs the Microsoft account password.
2. How the integration works
TRMNL separates resource discovery, event synchronization, and booking creation:
| Function | Microsoft service | Result |
|---|---|---|
| Discover resources | Microsoft Places | Imports rooms, workspaces, desks, capacity, mode, and location metadata |
| Discover parking | Microsoft Graph groups | Imports the configured Entra group's user members as parking spaces |
| Read schedules | Microsoft Graph calendarView | Synchronizes current and upcoming room events |
| Create bookings | Organizer mailbox calendar | Creates a meeting and invites the room as a resource |
| Accept or decline | Exchange Resource Booking Assistant | Applies room policy, conflicts, duration, and approval rules |
TRMNL does not write meetings directly into a room calendar. It creates the meeting in an organizer mailbox and adds the room as a resource attendee. Exchange then accepts, declines, or routes the request for approval according to the room's policy.
3. Supported Microsoft resources
- Exchange room mailboxes exposed by Microsoft Graph as Room.
- Microsoft Places workspaces exposed as Workspace.
- Microsoft Places individual desks exposed as Desk. TRMNL reads the mailbox from the desk's mailbox details.
- Exchange equipment mailboxes included in the configured parking resource group. TRMNL imports each direct user member as one parking space. See 16.2.
Other equipment mailboxes such as company cars or projectors are not imported automatically.
Room Lists are optional. They help organize rooms in Outlook Room Finder but do not grant TRMNL discovery or calendar access.
Microsoft reference: Manage resource mailboxes in Exchange Online
4. Microsoft permissions
TRMNL requests delegated Microsoft permissions. Delegated access operates on behalf of the connected account and remains constrained by that account's Exchange permissions.
| Permission | Purpose | Admin consent |
|---|---|---|
| openid, email, profile | Identify the connected Microsoft user and tenant | Normally no |
| offline_access | Refresh authorization after the browser session ends | Normally no |
| Calendars.ReadWrite | Read and manage the connected user's calendar | Normally no |
| Calendars.ReadWrite.Shared | Access calendars delegated or shared with the connected user | Normally no |
| Place.Read.All | Discover organizational rooms, workspaces, and location metadata | Yes |
| GroupMember.Read.All | Read the configured parking resource group membership | Yes |
| User.ReadBasic.All | Read parking mailbox names and addresses from group membership | Yes |
Important: Calendars.ReadWrite.Shared does not grant access to every mailbox. The connected account must separately receive permission to each room calendar and shared organizer mailbox.
GroupMember.Read.All and User.ReadBasic.All are only used by the parking resource group. Skip the parking configuration entirely if your tenant does not represent parking spaces as equipment mailboxes.
Microsoft reference: Microsoft Graph permissions reference
Microsoft reference: Permissions and consent in the Microsoft identity platform
5. Recommended account model
5.1 Connected integration account
Use a stable Microsoft 365 user account to complete OAuth sign-in. Prefer a dedicated integration identity rather than a personal administrator account.
- Has an Exchange Online mailbox.
- Is protected by MFA and normal Conditional Access policies.
- Is not retained as a Global Administrator after setup.
- Has read access to each room calendar.
- Has Full Access and Send As to the shared organizer mailbox.
5.2 Shared organizer mailbox
Use a shared mailbox to own meetings created through TRMNL. It does not sign into TRMNL and its password is never shared.
- The shared mailbox appears as meeting organizer.
- The connected administrator or integration user is not added as an attendee.
- The organizer identity stays stable when human administrators change roles.
- The connected account can still appear in audit or delegated-sender metadata.
Fallback behavior: If no shared organizer is configured, the connected Microsoft account becomes the organizer of every TRMNL booking.
6. Prerequisites
☐ Exchange Online tenant is active.
☐ At least one Exchange room mailbox exists.
☐ A Microsoft Entra administrator can grant application consent.
☐ An Exchange administrator can configure resources and delegation.
☐ A stable connected integration account is available.
☐ A shared organizer mailbox is available, if using the recommended model.
☐ An Entra group of parking equipment mailboxes is available, if importing parking spaces.
☐ Primary SMTP addresses for all relevant mailboxes are known.
☐ The administrator has access to the TRMNL account that owns the Booking app installation.
TRMNL ownership: Only the TRMNL installation owner can connect, synchronize, configure, or disconnect the organization-wide Microsoft integration.
7. Prepare room mailboxes
Open the Exchange admin center at admin.exchange.microsoft.com and navigate to Recipients > Resources. For every intended room, verify:
- Recipient type is Room, not Equipment.
- Primary SMTP address is correct.
- Capacity is configured.
- Building and location metadata are configured.
- Mailbox is active and visible in Exchange Online.
- Booking policy matches organizational requirements.
Provisioning delay: Newly created rooms can take time to propagate through Microsoft Places. Allow up to 24 hours before treating a missing new room as an integration failure.
7.1 Optional location metadata
Set-Place `
-Identity "[email protected]" `
-City "London" `
-Building "Headquarters" `
-Capacity 12
7.2 Optional Room List
New-DistributionGroup `
-Name "Headquarters Rooms" `
-RoomList
Add-DistributionGroupMember `
-Identity "Headquarters Rooms" `
-Member "[email protected]"
Room List scope: A Room List helps Outlook users locate rooms. It does not grant Graph permissions or calendar access.
8. Connect to Exchange Online PowerShell
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline `
-UserPrincipalName "[email protected]"
If PowerShell asks whether to trust PSGallery, enter A or Y while the prompt is still active.
Microsoft reference: Connect to Exchange Online PowerShell
9. Configure room booking behavior
Inspect the existing room policy before changing it:
Get-CalendarProcessing `
-Identity "[email protected]" |
Format-List
A common automatically approved room configuration is:
Set-CalendarProcessing `
-Identity "[email protected]" `
-AutomateProcessing AutoAccept `
-AllBookInPolicy $true `
-AllowConflicts $false
Policy caution: This is an example, not a universal recommendation. Do not enable AllBookInPolicy if your organization requires restricted bookers or delegate approval.
| Setting | Administrative effect |
|---|---|
| AutomateProcessing | Normally AutoAccept for automated room processing |
| AllBookInPolicy / BookInPolicy | Controls who may receive automatic approval |
| AllowConflicts | Controls overlapping reservations |
| BookingWindowInDays | Limits how far in advance the room can be booked |
| MaximumDurationInMinutes | Limits meeting duration |
| ScheduleOnlyDuringWorkHours | Restricts bookings to room working hours |
| AllowRecurringMeetings | Controls recurring reservations |
| ResourceDelegates | Defines users who manually approve requests |
Exchange applies BookingWindowInDays independently of TRMNL's own Settings > Bookable Until. A walk-up visitor can only reserve a slot both allow, so keep the two consistent.
Microsoft reference: Set-CalendarProcessing
10. Preserve meeting titles and descriptions
Exchange room mailboxes commonly remove the subject, replace it with the organizer's name, and delete the meeting body. Preserve original meeting subjects and descriptions with:
Set-CalendarProcessing `
-Identity "[email protected]" `
-DeleteSubject $false `
-AddOrganizerToSubject $false `
-DeleteComments $false
Get-CalendarProcessing `
-Identity "[email protected]" |
Format-List DeleteSubject, AddOrganizerToSubject, DeleteComments
Privacy review required: Meeting titles can expose confidential information on physical displays. Keep subjects hidden if your privacy policy requires generic Busy labels.
TRMNL can only display details returned by Microsoft Graph. Exchange processing, room calendar permissions, and private-event policy determine whether synchronized values contain the original subject and description, the organizer name, or generic values. DeleteComments defaults to $true for resource mailboxes using AutoAccept, so explicitly set it to $false when descriptions should reach TRMNL. This affects incoming meeting requests and does not restore text already removed from existing room-calendar events.
11. Grant room-calendar access
Room discovery and calendar access are separate. Place.Read.All can discover a room without allowing the connected account to read that room's events.
For least-privilege synchronization, grant the connected integration account Reviewer access to each room calendar:
Add-MailboxFolderPermission `
-Identity "[email protected]:\Calendar" `
-User "[email protected]" `
-AccessRights Reviewer
If the entry already exists, update it:
Set-MailboxFolderPermission `
-Identity "[email protected]:\Calendar" `
-User "[email protected]" `
-AccessRights Reviewer
Inspect the effective permission:
Get-MailboxFolderPermission `
-Identity "[email protected]:\Calendar"
In localized tenants, find the actual calendar folder name:
Get-MailboxFolderStatistics `
-Identity "[email protected]" `
-FolderScope Calendar |
Select-Object Name, FolderPath
Microsoft reference: Add-MailboxFolderPermission
12. Create the shared organizer mailbox
Create a shared mailbox in the Microsoft 365 admin center under Teams and groups > Shared mailboxes, or use Exchange Online PowerShell:
New-Mailbox `
-Shared `
-Name "TRMNL Booking" `
-DisplayName "TRMNL Booking" `
-PrimarySmtpAddress "[email protected]"
Microsoft reference: Create a shared mailbox
13. Delegate the shared organizer mailbox
Grant the connected integration account both Full Access and Send As:
Add-MailboxPermission `
-Identity "[email protected]" `
-User "[email protected]" `
-AccessRights FullAccess `
-InheritanceType All
Add-RecipientPermission `
-Identity "[email protected]" `
-Trustee "[email protected]" `
-AccessRights SendAs `
-Confirm:$false
Verify both permissions:
Get-MailboxPermission `
-Identity "[email protected]" |
Where-Object User -Like "*trmnl-integration*"
Get-RecipientPermission `
-Identity "[email protected]" `
-Trustee "[email protected]"
Propagation: Mailbox creation and delegation are not always immediately available through Microsoft Graph. Wait before testing if the mailbox or permissions were just created.
Microsoft reference: Create Outlook events in a shared or delegated calendar
14. Grant Microsoft Entra consent
In TRMNL, navigate to Apps > Booking > Integrations > Microsoft Exchange > Add company, then sign in with the connected integration account.
If Microsoft reports that administrator approval is required:
- Submit the consent request if your tenant enables the workflow.
- Open the Microsoft Entra admin center at entra.microsoft.com.
- Navigate to Entra ID > Enterprise apps > Admin consent requests.
- Review the application and requested Microsoft Graph permissions.
- Grant consent if approved by your organization.
- Return to TRMNL and repeat the connection using the integration account.
Avoid personal admin coupling: Do not complete the permanent connection with a personal Global Administrator unless that is the intended long-term integration identity.
15. Check the authorized application
- Open the Microsoft Entra admin center.
- Go to Entra ID > Enterprise apps.
- Find the TRMNL application shown during consent.
- Open Security > Permissions.
- Confirm the expected delegated Microsoft Graph permissions are present.
- Review Sign-in logs if OAuth or token refresh is failing.
If Assignment required is enabled for the enterprise application, explicitly assign the integration account under Users and groups.
Service continuity: Revoking consent, disabling the enterprise application, blocking the integration account, or removing mailbox delegation stops synchronization.
Microsoft reference: Manage application access and security
16. Configure the Microsoft workspace in TRMNL
The booking organizer and the parking resource group are both configured on the integration's configuration page:
- Open Apps > Booking > Integrations.
- Find the connected Microsoft 365 workspace.
- Select Configure organizer and resource groups.
Both fields are optional and are validated together when you select Save changes. If either check fails, TRMNL reports Microsoft could not verify these settings. Check Full Access, Send As, group ID, and consent. and keeps the previous values.
16.1 Configure the booking organizer
Enter the shared mailbox's primary SMTP address under Booking organizer:
TRMNL verifies that the shared-calendar scope is present, Microsoft Graph can open the mailbox calendar, the calendar is editable, and its owner matches the entered address.
Validation boundary: Saving the address verifies calendar access. Create a real pilot booking to confirm Send As and Exchange room processing.
Leaving the field blank uses the connected Microsoft account as organizer. Changing the organizer affects new bookings only. Keep the previous organizer mailbox and delegation until existing meetings have ended or been cancelled.
16.2 Configure the parking resource group
Microsoft Places does not model parking, so TRMNL imports parking spaces from an Entra group you nominate. Every direct user member of that group becomes one parking space.
Prepare the group in Microsoft 365 or Entra:
- Create each parking space as an Exchange equipment mailbox, with a booking policy that matches your requirements (section 9 applies to equipment mailboxes too).
- Create an Entra security group, for example
TRMNL Parking Spaces. - Add each parking equipment mailbox as a direct member of that group.
- Copy the group's object ID from the Entra admin center under Entra ID > Groups.
Then in TRMNL, enter that object ID under Parking resource group and select Save changes.
What TRMNL imports per member:
| Field | Source |
|---|---|
| Name | The member's display name, falling back to its email address |
The member's mail address, falling back to its user principal name |
|
| Building | The member's officeLocation, when set |
| Capacity | Always 1 |
| Booking mode | Always reservable |
Group membership rules:
- Only direct user members are imported. Nested groups are ignored — TRMNL does not expand them, and their members will not appear.
- A member with neither a mail address nor a user principal name is skipped.
- Grant the integration account calendar access to each parking mailbox exactly as for rooms (section 11). Group membership alone does not grant it.
Consent first: Saving a group ID fails with a reconnect prompt if GroupMember.Read.All and User.ReadBasic.All have not been granted. Complete the Entra consent in section 14 before entering the group ID.
17. Synchronize rooms and events
17.1 Resource synchronization
Select Synchronize on the connected Microsoft workspace. Resource synchronization discovers rooms, workspaces, and desks and updates:
- Name and primary email address.
- Capacity.
- Building, floor, and section.
- Room, workspace, or desk type.
- Equipment tags and location metadata.
- Native Places mode. Reservable resources permit advance booking, drop-in resources permit only an immediate duration-based booking, and assigned, unavailable, or unknown modes are unavailable for public booking.
Workspaces are capacity pools: concurrent reservations are allowed while units remain. Exchange remains authoritative under concurrent requests, so configure its workspace capacity policy to match Places. Unavailable resources continue to synchronize and can appear in device collections, but are omitted from public booking.
Check-in fields are reserved for future behavior. TRMNL does not import Microsoft checkInClaim records or implement auto-release.
17.2 Select which resources synchronize
Discovering a resource is not the same as using it. Synchronized Calendars on the integration decides which discovered resources reach Booking, and it behaves differently on the first synchronization than on every one after it:
- First synchronization: every discovered resource is selected automatically.
- Every later synchronization: newly discovered resources arrive unselected. A room created in Exchange after the initial connection stays hidden until an administrator selects it.
An unselected resource does not appear under Calendars, cannot be added to a collection or device, and has no public booking link. Select new resources after any Exchange or Places inventory change:
- Open Apps > Booking > Integrations.
- Select Edit on the Microsoft workspace.
- Under Synchronized Calendars, select the resources Booking should manage. Select all and Select none help with long inventories.
- Select Save changes.
Deselecting is destructive: clearing a resource removes it from every device display and from every collection that includes it. Those assignments are not restored by selecting the resource again — rebuild them by hand.
Two reasons a new room is invisible: Places provisioning delay (wait up to 24 hours) and the unselected default above. Rule out the second before escalating the first.
17.3 Event synchronization
Each room calendar is fetched separately. TRMNL synchronizes a rolling window from the current time through the next 30 days. Opening a room, displaying it on a device, or using its booking page can trigger a refresh; the room page also provides an explicit refresh action.
Diagnostic distinction: A room can appear in the resource list while event synchronization fails. Discovery success does not prove room-calendar permission.
18. Rollout verification
18.1 Test native Exchange behavior
Create an ordinary Outlook meeting that invites the pilot room. Confirm:
- Exchange accepts the request.
- The event appears in the room calendar.
- A conflicting meeting is declined according to policy.
- The subject is preserved if title display was enabled.
Gate: If this test fails, correct Exchange room policy before testing TRMNL.
18.2 Test TRMNL synchronization
- Select Synchronize.
- Confirm the pilot room is selected under Synchronized Calendars.
- Confirm it appears under Microsoft Workspace Resources.
- Open the room and refresh its calendar.
- Confirm Last sync has a timestamp and no Sync error is displayed.
18.3 Test TRMNL booking
Create a future booking named TRMNL integration test and confirm:
- The event exists in the shared organizer mailbox.
- The room is a resource attendee.
- The room accepts the request.
- The shared mailbox is the organizer.
- The connected account is not an attendee.
- The booking appears in Outlook and TRMNL.
- The intended title or privacy-safe replacement is displayed.
18.4 Test conflict and cancellation
Create a second booking over the same time and confirm it is rejected or declined according to policy. Then cancel the original booking through TRMNL and confirm the organizer event is cancelled, the room reservation disappears, and the slot becomes available after synchronization.
18.5 Test parking spaces
Skip this section if no parking resource group is configured.
- Confirm each group member appears under Microsoft Workspace Resources as a parking space.
- Confirm each is selected under Synchronized Calendars.
- Open one and confirm its schedule synchronizes; grant Reviewer access if it does not.
- Create a TRMNL booking and confirm the equipment mailbox accepts it.
19. Troubleshooting
| Symptom | Likely cause | Resolution |
|---|---|---|
| No rooms synchronize | Missing Place.Read.All consent | Review Enterprise application permissions and reconnect |
| Some resources are missing | Resource is Equipment | Use a Room or Workspace where appropriate |
| New room is missing | Resources discovered after the first synchronization arrive unselected | Select it under Synchronized Calendars (see 17.2) |
| New room is still missing | Microsoft Places provisioning delay | Wait up to 24 hours and synchronize again |
| Room vanished from a display | It was deselected under Synchronized Calendars | Re-select it, then rebuild its display and collection assignments |
| Room List made no difference | Room Lists do not grant access | Configure resource type and calendar permissions |
| Room appears but fetch fails | No room-calendar permission | Grant Reviewer access to the integration account |
| Graph 404: object not found | Wrong address, provisioning, or permission | Verify primary SMTP, mailbox type, and folder access |
| Organizer cannot be saved | Missing shared scope or delegation | Reconnect; grant Full Access and Send As |
| Organizer was just created | Propagation is incomplete | Wait, then retry using the primary SMTP address |
| Admin remains organizer | Organizer field is blank | Configure the shared organizer mailbox |
| Parking group cannot be saved | GroupMember.Read.All or User.ReadBasic.All was never consented | Reconnect the workspace, granting both, then re-enter the group ID |
| No parking spaces imported | Members are nested groups, or lack a mail address | Add the equipment mailboxes as direct members |
| Parking space has no schedule | The integration account lacks calendar access to that mailbox | Grant Reviewer access as for a room |
| Room declines a free slot | Exchange policy rejected it | Inspect the decline and CalendarProcessing settings |
| Room remains pending | Delegate approval or async processing | Check delegates and mailbox processing settings |
| Organizer replaces title | Room subject-processing policy | Set DeleteSubject and AddOrganizerToSubject to false |
| Meeting description is empty | Room comment-processing policy | Set DeleteComments to false |
| Only Busy is visible | Detail permission or privacy policy | Review permission and privacy settings |
| Cancellation fails later | Original organizer is inaccessible | Restore old organizer delegation temporarily |
| Sync stops later | Token, account, or Conditional Access change | Review Entra sign-in logs and reconnect |
19.1 Inspect a room decline
Get-CalendarProcessing `
-Identity "[email protected]" |
Format-List AutomateProcessing,
BookingType,
AllBookInPolicy,
BookInPolicy,
AllowConflicts,
BookingWindowInDays,
MaximumDurationInMinutes,
ScheduleOnlyDuringWorkHours,
ResourceDelegates
20. Security and privacy
- Never send Microsoft administrator passwords to TRMNL or support personnel.
- Use OAuth sign-in only.
- Use a dedicated integration account instead of a personal Global Administrator.
- Remove privileged directory roles from the integration account after consent.
- Keep MFA and Conditional Access enabled.
- Grant room calendars Reviewer access rather than Full Access where possible.
- Grant Full Access only to the shared organizer mailbox that must be edited.
- Periodically review Enterprise application permissions and sign-in logs.
- Review whether meeting titles are appropriate for publicly visible devices.
- Treat booking QR codes and public booking pages as approved access points.
Enable Settings > QR Code Security to rotate public booking URLs daily, so a copied link stops working the next day. Rotation invalidates printed codes as well — see Walk-up booking.
TRMNL stores Microsoft access and refresh tokens in encrypted application fields. Disconnecting removes the stored connection but does not automatically delete meetings already created in Exchange.
Credential incident: If any Microsoft password was shared during testing, rotate it immediately.
21. Offboarding
- Review future meetings created by the current organizer mailbox.
- Cancel or transfer meetings that must not remain.
- Keep the original mailbox and delegation active until its meetings are cleared.
- Disconnect Microsoft Exchange from TRMNL.
- Revoke Entra application consent if removing TRMNL organization-wide.
- Remove room-calendar permissions granted to the integration account.
- Remove Full Access and Send As from the shared organizer.
- Disable or delete the integration user only after checking other integrations.
- Remove the shared mailbox only after all meetings it owns have ended or been cancelled.
22. Final administrator sign-off
☐ Every intended resource is a Room or Workspace.
☐ Microsoft Entra admin consent is granted.
☐ The integration account can read every room calendar.
☐ Every intended resource is selected under Synchronized Calendars.
☐ Rooms automatically process invitations as intended.
☐ Meeting-title privacy has been reviewed.
☐ The shared organizer has Full Access and Send As delegation.
☐ TRMNL accepts and verifies the shared organizer address.
☐ The parking resource group imports the expected spaces, if configured.
☐ A room accepts a TRMNL-created booking.
☐ The connected account is not a meeting attendee.
☐ Conflict handling works.
☐ Cancellation works from TRMNL.
☐ The event appears correctly in Outlook and on the TRMNL device.
Microsoft documentation
- Manage resource mailboxes in Exchange Online
- Microsoft Graph permissions reference
- Permissions and consent overview
- Connect to Exchange Online PowerShell
- Set-CalendarProcessing
- Add-MailboxFolderPermission
- Create a shared mailbox
- Create events in shared or delegated calendars
- Manage Enterprise application access and security