--- title: Microsoft 365: Hybrid Setup slug: microsoft-365-hybrid-setup docTags: createdAt: 2026-07-02T10:14:12.929Z --- This guide helps teams set up Ashby's native Microsoft 365 integration in a hybrid configuration: keeping some access application-wide for easier scheduling, while relying on individual Microsoft authorization for more sensitive workflows like email syncing and sending. A hybrid Microsoft 365 setup in Ashby can work well when your team wants the convenience of application-wide scheduling coverage together with more selective user-level access for email workflows. The most successful setups happen when the team decides in advance which workflows should stay broad and which should move to individual Microsoft authorization. :::hint{type="warning"} **Prerequisites** To complete the hybrid setup route for Microsoft 365, you'll need the following permissions: - Organization Admin access in Ashby, to enable the native Microsoft 365 integration with application-wide admin consent. - Microsoft Entra admin access, to remove or manage granted permissions for the Ashby enterprise application in your Microsoft tenant. ::: # What Microsoft hybrid setup supports Ashby's native Microsoft 365 integration supports both application-wide admin consent and individual user authorization. In a hybrid setup, your team can: - Keep application-wide access where it reduces rollout and scheduling friction across the organization - Remove selected application-wide permissions afterward if you prefer a more restrictive setup for specific workflows - Have users who need those workflows authorize Microsoft individually in Ashby At a high level, Ashby checks for individual user authorization first and falls back to application-wide access if individual authorization is not present. # Use case for Microsoft hybrid setup This approach is most useful when your team wants broad calendar coverage for scheduling, but does not want every Microsoft permission to remain application-wide after setup. A common example is: - Keep calendar-related access application-wide so recruiters and coordinators can view interviewer availability without requiring every interviewer to authorize individually - Move email-related workflows to delegated or individual authorization so only the users who actually need to send or sync email through Ashby authorize those permissions # Recommended hybrid setup pattern ## Step 1: Connect Microsoft 365 in Ashby with application-wide admin consent Start by enabling Ashby's native Microsoft 365 integration with application-wide admin consent. This is the fastest way to get the integration in place for your organization. You can access that Admin page here. ## Step 2: Keep the application-wide permissions you want for broad coverage Many teams keep calendar-related access application-wide so interview scheduling works smoothly without requiring every interviewer to connect Microsoft individually. For example, Ashby uses `Calendars.ReadWrite` for interview scheduling and calendar sync, and `MailboxSettings.Read` supports scheduling accuracy by reading settings like time zone and working hours. It's best practice to keep both of these scopes available at the application-wide level; otherwise, every user in your organization needs to authorize their Microsoft account individually in Personal Settings. ## Step 3: Remove selected application-wide permissions in Entra A common pattern is removing application-wide email permissions such as: - `Mail.Send` - `Mail.ReadWrite` For native Ashby Microsoft 365 setups, make these changes in the granted Microsoft tenant authorization for the Ashby enterprise application in Entra. ![](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/LrutbpYJqT7NAwRCpKG3M_ashby-microsoft-entra-admin-center-2026-07-02-at-114834-am.jpg) ## Step 4: Go back to Ashby and refresh integration page You should see the revoked scopes on the integration with a red circle. ![](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/2IrPMu2YdqfaSv9mRDhDN_microsoft-365-hybrid-setup-in-ashby.jpg) ## Step 5: Have users who need email features authorize individually in Ashby Users who need delegated access should go to **Personal Settings > Microsoft 365 Settings** in Ashby and authorize their Microsoft account individually. This is especially relevant for users who need to: - Send email from their own Microsoft account through Ashby - Sync recruiting-related email history into Ashby - Use Microsoft Teams meeting creation - Schedule interviews on Microsoft group calendars # What to expect after the change If you remove selected application-wide scopes and rely more on delegated access, the experience becomes more user-specific. In practice, that means: - Users who relied on the removed application-wide scopes may need to complete their own Microsoft authorization in Ashby - Tenant-side Microsoft policies can have a bigger impact on whether a workflow succeeds - Some features may stop working if the required permission is no longer available application-wide and the individual user has not authorized it # Important workflows that still require individual authorization Some Microsoft workflows require individual authorization even if your organization already has application-wide Microsoft 365 access connected in Ashby. The most common examples are: - Microsoft Teams meeting creation - Microsoft group or shared calendar scheduling If your team plans to use those workflows, make sure the relevant organizers or schedulers complete individual Microsoft authorization in Ashby. # Reconnect warning :::hint{type="danger"} If you disconnect and reconnect the native Microsoft 365 integration in Ashby, Microsoft re-requests the full application-wide permission set when you reconnect. If your team intentionally revoked selected application-wide permissions after setup, you need to repeat that cleanup afterward. For that reason, if your team is intentionally using a hybrid setup, document your expected Entra-side configuration internally before anyone reconnects the integration. ::: # FAQ ### Can my security team or other stakeholders have visibility or be notified when users authenticate with their Microsoft 365 credentials in Personal Settings? Please reach out to support\@ashbyhq.com for further guidance on this.