Microsoft 365
There are three routes to authorize Ashby with Microsoft 365:
- Hybrid Setup (configure some access application-wide for easier scheduling, while relying on individual Microsoft authorization for more sensitive workflows)
This article explains each route, how to sync users and rooms, and how email sync, Microsoft Teams, and group calendars work once the integration is in place.
Application-wide admin consent
This is the fastest route to get the integration in place for all users. Ashby automatically syncs all users of a Microsoft domain once you give application-wide consent.
You must be an Organization Admin in Ashby and an admin in your organization's Microsoft tenant to configure application-wide admin consent.
This method allows an admin of both Ashby and an organization's Microsoft tenant to authorize all permissions that Ashby requires for everyone in their organization.
A user from your Microsoft organization with the permission to administer applications logs in to Ashby and heads to the Integrations page. Microsoft 365 is in the Platform section of the Integrations Marketplace.
- Click Microsoft 365.
- Click Enable Microsoft 365.
- Click Connect to Microsoft 365.
- Confirm the account and review the permissions requested.
- Click Accept to allow Ashby access.
Once you accept, you see a message confirming that Ashby has enabled the integration.
Admins can also opt to disable the user sync and opt to not automatically enable synced users by unchecking the following checkboxes in the General Settings section of the Microsoft integration.
- Sync Microsoft Users? When unchecked, the automatic user sync is stopped, so Microsoft users in your tenant will not be synced to Ashby.
- Automatically Enable Synced Users? Will stop enabling synced users so they will need to sign into Ashby before they can be scheduled or configured.
Individual consent
If you'd prefer users to give consent on an individual basis, each user can manage Ashby's access from their Microsoft 365 Settings (within Personal Settings).
The user needs to give the same permissions as listed above for application-wide admin consent. A user can click Connect with Microsoft 365 to connect their account.
Users can also individually disable email sync in the Email Settings section of their personal settings.
If users have the email sync option enabled, they can also opt to include personal email aliases in the sync. If they respond to a candidate using one of their personal aliases in their email client, Ashby still detects and syncs it.
All aliases listed under Aliases to include in email sync are set not to sync by default, and the user needs to opt in to enable the sync for that alias.
If you have taken the application-wide admin consent route, users still see To send and receive emails and appointments in Ashby, connect your Microsoft account when navigating to the Microsoft 365 Settings page within Personal Settings. They do not need to complete this additional step if they are not organizing interviews with Teams or group calendars.
They can review the list of scopes in the Status section of this page to confirm what is functional and currently syncing.
Users who are organizing meetings for interviews using Teams, or those looking to schedule interviews to group calendars, need to go through the additional authorization processes within Microsoft 365 Settings to use these features. This applies even if you took the application-wide admin consent route to set up the integration.
Authorizing Microsoft 365 room and user sync
A user with the User.Read.All permission in Microsoft can enable user syncing in the Additional Authorization section of the Microsoft 365 integration settings in the Integrations Marketplace.
You have the following options for syncing users and rooms as part of your integration setup:
- Authorize Microsoft 365 User Sync: Sync users to Ashby from your Microsoft tenant.
- Authorize Microsoft 365 Room and User Sync: Sync your users, or users and rooms, from your Microsoft tenant to Ashby.
If you enable the Authorize Microsoft 365 Room and User Sync option, you need to determine a delegated room sync user. The user you select from the dropdown must have the following permissions in your tenant:
- User.Read.All — for user sync and room sync
- Place.Read.All — for room discovery
- Calendars.ReadWrite.Shared — for shared and room calendar access (the delegated user must be a delegate of the room calendars in Microsoft 365 for calendar subscription to work)
Ashby inherits whatever visibility the delegated sync user has in the tenant for those rooms. Ashby only syncs the rooms that the delegated user has access to in Microsoft. If you see only free/busy information, that is the information Microsoft returns for the delegated user's access level.
If you do not want to sync users into Ashby but do want to sync rooms, ensure that the Sync Microsoft Users? checkbox is unchecked in the General Settings section of the integration tile.
Hybrid setup
For more on configuring a hybrid setup for Microsoft 365, check out Microsoft 365: Hybrid SetupMicrosoft 365: Hybrid Setup.
Email sync
If you enable email syncing as part of your Microsoft 365 configuration, synced emails to and from the candidate appear in the Feed section of the candidate's profile.
Email attachments
Attachments included in an email also appear on the synced email on the candidate's feed in Ashby.
To save an email attachment from an inbound email to the Other Files section of the candidate's profile, click the file icon on the attachment.
The option to save an email attachment as a file on the candidate profile is not available for outbound emails.
A popover opens with the following options:
- Description
- File category (more on this at Candidate Files and File Categories). Ashby prefills this with 'From email on X date', but you can amend it.
- Privacy (if you have permission to view private fields)
Once you save the file, the privacy set is separate from the email privacy settings. Changing the email privacy later does not impact who can access the file saved to the candidate profile. Deleting the email from the candidate's feed does not remove the saved file from the candidate profile automatically.
Microsoft Teams
For more information on scheduling via Ashby, check out Scheduling & Interviews: An IntroductionScheduling & Interviews: An Introduction.
When scheduling an interview, Ashby can also automatically schedule a meeting in Teams if you have the Microsoft 365 integration in place and if you set Microsoft Teams as the interview's location.
The organizer of the Teams meeting needs to have set up individual OAuth within Microsoft 365 Settings (in Personal Settings) to use this, even if you took the application-wide admin consent route.
Group calendars
As part of the Microsoft 365 integration, you can add a group calendar for scheduling interviews. If you'd like to set up a group calendar as part of your integration, reach out to your Customer Success Manager (CSM) or [email protected].
Creating the group calendar
To get started, create a Microsoft 365 Group and add the people who will be scheduling to that group as members. The group comes with a calendar that everyone in the group has write access to.
Newly created Microsoft 365 groups may take up to 24 hours to fully propagate.
Important group requirements
- It must be Public.
- It must be a Group (not a Distribution List or Shared Mailbox).
- Teams capabilities should be enabled.
- It must be mail-enabled (not a security group).
- Make sure Hide this group from the global address list is unchecked.
These requirements are critical for the calendar to sync correctly with Ashby.
Authorizing and adding the group calendar in Ashby
Anyone who is scheduling on that calendar needs to go through the individual Microsoft 365 authorization in their Personal Settings.
The user adding the calendar must be an Organization Admin in Ashby and also be a member or owner of the group.
For workspaces with more than 100 groups, reach out to [email protected] for assistance adding a specific group calendar if you don't see the group calendar listed. Ashby asks you to supply the Group Object ID, which appears either in the URL when you navigate to the group or, if you have access to your domain within Azure, in the group Object ID section.
To add the group calendar, head to the Microsoft 365 integration settings in Integrations. You then see the option + Add Calendar. The calendar you add becomes the default calendar when scheduling interviews.
Additional considerations
- To schedule interviews onto this calendar, users need to authorize with individual OAuth.
- The organizer of the meeting is the group name, and interviewers are attendees. Therefore, name the group something that can be externally facing, as it shows on candidate invites.
- When you authorize a new calendar, users should reauthenticate in their Personal Settings.
Email aliases
Microsoft 365 email alias sharing in Ashby uses Personal Settings > Email Sharing. A user can share their email address with specific Ashby users from this page.
Personal Microsoft 365 aliases do not appear in Admin > Organizational Settings > Shared Email Aliases and cannot be used as the organization-wide no-reply address.
The steps below explain how to enable Microsoft 365 alias sending for the Personal Settings email-sharing workflow.
Ashby supports sending emails from user aliases. To successfully send an email from an alias, a Microsoft admin needs to enable the Turn on from sending aliases option in the Exchange Online Admin Center.
Log in and navigate to Settings > Mail Flow > General, then check the Turn on from sending aliases checkbox.
If this setting is not enabled, emails still send but fall back to the user's primary email address.
Unlike Google, Microsoft does not allow different From names on an alias. For example, if an email from your primary email has the From name of Julie Meadows, most email clients show messages from your alias with the same From name. In this example, Julie Meadows shows as the From name for emails sent from the alias email address as well.
To set up a company-specific no-reply email address, see Email Domain SetupEmail Domain Setup. This is the supported route for a company-specific no-reply address with Microsoft 365, and it is available on Enterprise plans.
Known limitations
Currently, there are a few options that the integration does not support.
Email Signatures
- Ashby cannot sync email signatures over from Microsoft 365.
Calendar syncing and scheduling
- If you are the interview organizer and on the panel interviewing, you see two events on your calendar if a group calendar is not in place.
FAQs
What access level do I need to authenticate this application?
The person who grants access to the application by clicking Connect to Microsoft 365 must be someone who can manage Azure application registrations and grant application permissions to the Graph API.
Can my team set up a custom application instead of using the Ashby integration?
Review Microsoft Custom Applications (GCC High)Microsoft Custom Applications (GCC High) for guidance on setting up an Azure application and pointing it to Ashby.
Can I set up both Google Workspace and Microsoft 365 integrations in my Ashby account?
Ashby currently supports deep integration with either Google Workspace or Microsoft 365, but not both simultaneously. For more information, check out Does Ashby support integrating with both Google and Microsoft at the same time?Does Ashby support integrating with both Google and Microsoft at the same time?
I've set up the Google Workspace integration — can I use Microsoft Teams for interviewing?
Ashby currently supports deep integration with either Google Workspace or Microsoft 365, but not both simultaneously.
Can I reschedule or change the date and time of an interview via the event on my Outlook calendar?
We support a two-way syncing option, so if you move an interview event on your Outlook calendar to a new date and/or time, Ashby syncs and reflects the changes. In most cases, we recommend rescheduling in Ashby (for example, if you're amending the interview type or interviewers on the panel).
You need to move the calendar event on the account's shared interview calendar (the calendar determined in the Communication tab of your interview) if you did not schedule it via the direct booking option.
For an interview scheduled via a direct booking link, you can move the calendar invite on the shared calendar, or the meeting organizer can move the interview on their personal calendar if they don't have access to the shared calendar.
Ashby then syncs these changes back and sends out new calendar invites. You do not need to resend the calendar invites.
If you reschedule the interview via Outlook, Ashby adds an event to the candidate's feed showing that rescheduling happened outside of Ashby.
How are users pulled into Ashby?
Ashby can sync users over via the following routes:
- If you have user sync enabled as part of your Google Workspace or Microsoft 365 integration settings.
- If you migrate data via the Greenhouse, Workday, or Lever API migration options, Ashby pulls user accounts over as part of the migration.
- If you configure a user sync via System for Cross-domain Identity Management (SCIM).
- If a user signs in for the first time using the native `Sign in with Microsoft` button, Ashby can create their user account even when Microsoft 365 user sync is disabled. The user must sign in with an email address that matches an organization domain configured for the corresponding sign-in method. New accounts created this way start as Limited Access users. Once Directory Sync (SCIM) is enabled, Ashby does not create users through native Microsoft sign-in. Users must be provisioned through Directory Sync (SCIM).
If you have users synced over via an API migration or by enabling user sync as part of the Google Workspace or Microsoft 365 integration and then set up SCIM, the SCIM sync deactivates any user accounts that Ashby initially added but that are not in your SCIM directory. To reactivate any users that Ashby deactivated when it shouldn't have, add them back to your SCIM directory.
If you've enabled the user sync option as part of your Google Workspace or Microsoft 365 integration (and do not have SCIM configured), Ashby automatically provisions and deactivates users based on their status in your workspace or tenant.
If you added users via an API migration from Greenhouse, Workday, or Lever, you can deactivate any users who do not need access manually if you are not planning to configure SCIM. You can read more about deactivating users at How do I provision new users in my Ashby account manually?How do I provision new users in my Ashby account manually?
Will synced users receive a welcome email?
No. Once you add a user, they can sign in at the Ashby sign-in page.
I send a large volume of no-reply emails each day — can I still use a branded email address?
This is possible if you configure an email domain within Ashby. If you are sending more than 1,000 no-reply or automated emails a day, or are looking to set up a company-specific no-reply and are using Microsoft 365, check out our Email Domain Setup guide.
What permissions are necessary on the Ashby side for a user set as the Delegated Room Sync User in Microsoft 365 integration settings?
The user needs to be an active Ashby user for them to be an option to delegate room access. As such, they need to be enabled for sign-in. You can set this user up as a limited access user in Ashby, and they don't need to authenticate in Ashby.
Where are meeting rooms pulled from in Microsoft 365?
In Microsoft 365, meeting rooms appear on the Rooms & Equipment page within the Microsoft 365 admin center.
I have some non-Gregorian calendar events on my calendar and they aren't syncing over, why?
Ashby does not support recurring calendar events that include the "RSCALE" property in their recurrence rules (RRULES), and does not sync these events over during calendar syncs. The "RSCALE" property specifies non-Gregorian calendars. Ashby still syncs all events on the user's calendar without the "RSCALE" property.